Slovenia Recording Laws: All-Party Consent Rules and Penalties (2026)

Slovenia requires all-party consent to record any private conversation under Criminal Code Article 137. Unauthorized recording carries a fine or up to one year in prison; public officials who abuse their position face three months to five years. The law covers phone calls and in-person discussions alike.

Overview of Recording Laws in Slovenia

Slovenia requires all-party consent to record private conversations. The country's legal framework builds on a constitutional guarantee, a criminal statute last consolidated in 2015, and layers of European data protection regulation that together create one of the stricter recording regimes in the European Union.

For anyone living in, traveling through, or doing business with Slovenia, the bottom line is straightforward: you cannot record a conversation without the knowledge and consent of every person involved. Violations carry criminal penalties, and separate data protection rules can stack additional fines on top.

Three bodies of law work together to produce this result. The Constitution of the Republic of Slovenia sets the foundation. The Criminal Code (Kazenski zakonik, KZ-1) defines specific offenses and penalties. And the Personal Data Protection Act (ZVOP-2), which took effect on January 26, 2023, implements the EU General Data Protection Regulation with Slovenia-specific provisions on surveillance, biometrics, and enforcement.

A fourth layer arrived in 2024 and 2025: the EU AI Act, which applies directly in Slovenia and imposes obligations on real-time biometric surveillance and AI-generated content that affect how recording laws intersect with emerging technology.

Constitutional Protections for Communication Privacy

The Slovenian Constitution anchors privacy protections in several articles that courts treat as fundamental rights.

Article 35 guarantees "the inviolability of the physical and mental integrity of every person and his privacy and personality rights." This provision extends to any form of surveillance or recording that intrudes on personal autonomy.

Article 37 states that "the privacy of correspondence and other means of communication shall be guaranteed." The only permitted exception requires a law that authorizes a court to suspend this protection for a set period, and only when necessary for criminal proceedings or national security.

Article 38 guarantees the protection of personal data, prohibiting any use of personal data that goes beyond the purpose for which it was originally collected.

Taken together, these three provisions mean that recording someone's conversation without their consent is not just a criminal offense but a violation of constitutional rights. Courts apply strict proportionality analysis when any law attempts to carve out exceptions, and they have repeatedly struck down measures that failed to meet that standard.

Criminal Code Article 137: The Core Recording Offense

The primary statute governing audio recording in Slovenia is Article 137 of the Criminal Code (KZ-1), titled "Neupraviceno prisluskovanje in zvocno snemanje" (Unauthorized Eavesdropping and Sound Recording). The current version is KZ-1-NPB4, the officially consolidated text published in Uradni list RS No. 54/15.

This article contains four paragraphs that define the offense, penalties, and prosecution procedures.

Paragraph 1: Eavesdropping on Others' Conversations

Anyone who uses special devices to eavesdrop on a conversation or statement not intended for them, or who records it, commits a criminal offense. The same applies to anyone who transmits such a conversation to a third party, plays a recording for them, or otherwise enables them to learn its contents.

The penalty is a fine or imprisonment of up to one year.

This paragraph targets the classic wiretapping scenario: intercepting a conversation between other people without being a participant. It covers both real-time eavesdropping and the act of recording for later use.

Paragraph 2: Recording Your Own Conversations Without Consent

Anyone who records a confidential statement intended for them, without the other person's consent and with the intent to misuse it (z namenom, da bi tako izjavo zlorabil), also faces criminal liability. Transmitting, playing, or otherwise sharing that recording with a third party triggers the same penalties.

The penalty mirrors paragraph 1: a fine or imprisonment of up to one year.

This is the provision that makes Slovenia an all-party consent jurisdiction. Even if you are a direct participant in the conversation, recording it without the other person's knowledge and consent is a criminal offense when done with intent to misuse the recording.

Paragraph 3: Aggravated Offense for Public Officials

When a public official commits either of the above offenses by abusing their official position or authority (z zlorabo uradnega položaja ali uradnih pravic), the penalty increases significantly.

The punishment is imprisonment from three months to five years.

This harsher penalty reflects the Slovenian legal system's view that government officials hold a position of trust. Police officers, prosecutors, judges, and other state employees who use their authority to conduct unauthorized recordings face much steeper consequences.

Paragraph 4: How Prosecution Works

Prosecution for paragraph 1 offenses (eavesdropping on others) begins "on a proposal," meaning the victim must file a criminal complaint to initiate proceedings. For paragraph 2 offenses (recording your own conversations without consent), prosecution proceeds by private prosecution, placing the burden on the victim to bring the case forward.

This distinction matters in practice. Eavesdropping cases involve a prosecutor after the complaint is filed. Secret recording cases require the victim to pursue the matter through the court system directly.

Article 138: Visual Recording Restrictions

Article 138 of the Criminal Code addresses unauthorized visual recording (Neupraviceno slikovno snemanje) and follows a similar structure.

Paragraph 1 covers unauthorized recording or photographing of another person or their premises without consent, where doing so substantially violates their privacy (občutno poseže v njegovo zasebnost), or directly transmitting that recording to a third party. The penalty is a fine or imprisonment of up to one year.

Paragraph 2 elevates the offense when a public official commits it through abuse of position: imprisonment from three months to five years.

Prosecution for paragraph 1 violations requires a formal complaint from the victim.

The "substantially violates privacy" standard gives courts discretion. Filming someone on a busy public street may not meet the threshold, but recording them through a window at home almost certainly would.

Criminal Code Article 139: Communication Secrecy and Related Offenses

Article 139 of the Criminal Code (KZ-1), titled "Kršitev tajnosti občil" (Violation of Communication Secrecy), extends privacy protections beyond face-to-face and telephone conversations to cover the secrecy of correspondence and electronic communications more broadly.

The article contains six paragraphs:

Paragraph 1 penalizes unauthorized opening of another person's mail, telegram, or sealed correspondence: a fine or imprisonment up to six months.

Paragraph 2 imposes heavier penalties (a fine or up to one year imprisonment) for three specific acts: (a) using technical or chemical means to access sealed communications without physically opening them; (b) using technical means to intercept telephone or other electronic communications; (c) opening sealed containers protecting transmitted messages.

Paragraph 3 applies the same penalties to anyone who enables third parties to directly access communication content through the methods described in paragraphs 1 or 2.

Paragraph 4 penalizes unauthorized retention, concealment, destruction, or transfer of another person's mail or correspondence before the intended recipient receives it: a fine or up to one year.

Paragraph 5 elevates penalties to three months to five years when the offense is committed by a public official abusing their position, or by a postal worker with responsibility for handling the mail at issue.

Paragraph 6 specifies that prosecution for violations under paragraphs 1 through 4 requires a formal complaint from the victim.

Article 143: Abuse of Personal Data

Article 143 of the KZ-1, titled "Zloraba osebnih podatkov" (Abuse of Personal Data), criminalizes unauthorized disclosure of personal data without legal basis or personal consent in public announcements or publications. It also covers assuming another person's identity or exploiting their personal data in ways that violate their personal dignity. This provision is relevant when recordings or AI-generated content about identifiable individuals are used to damage their reputation or privacy.

Article 140, titled "Nedovoljena objava zasebnih pisanj" (Unlawful Publication of Private Correspondence), addresses unauthorized publication of private letters and correspondence, providing an additional avenue for victims of recording-related privacy violations where the content of private communications is disclosed publicly.

Phone Recording Laws in Slovenia

Recording telephone calls in Slovenia falls under both the Criminal Code and the Electronic Communications Act (ZEKom-2), which replaced the earlier ZEKom-1 when it entered force on November 10, 2022.

The general rule under ZEKom-2 is that recording and storage of electronic communications without prior consent of all participants is prohibited. This prohibition applies to private individuals and businesses alike.

The Slovenian Information Commissioner (Informacijski pooblascenec) has issued guidance confirming that telephone recording without prior consent constitutes a criminal offense under the Criminal Code. The Commissioner has also noted that even notification of recording is insufficient on its own; all statutory conditions must be met simultaneously.

When Business Call Recording Is Permitted

A narrow exception exists for business communications. Companies may record calls to "provide evidence of market transactions or other business communication," but only when all of the following conditions are met:

• All parties receive advance notice before the recording begins
• The specific purpose of the recording is clearly disclosed
• The storage duration for the recording is defined and communicated
• A lawful basis under GDPR exists for the data processing

The Information Commissioner has emphasized that general "quality assurance" or "training purposes" do not, by themselves, constitute sufficient legal justification for recording calls. Businesses that rely on these vague rationales risk both criminal liability and GDPR enforcement actions.

Online and App-Based Calls

The same rules apply to calls conducted through internet-based platforms such as WhatsApp, Microsoft Teams, or Zoom. These services transmit audio and video as electronic communications within the meaning of ZEKom-2. Recording a Teams meeting or a WhatsApp call without the consent of all participants carries the same criminal exposure under Article 137 as recording a traditional telephone call. Where AI-assisted transcription or analysis tools are used during such calls, the GDPR lawful-basis requirement applies to the resulting processed data independently of the consent issue for the recording itself.

In-Person Recording: What the Law Covers

Article 137 applies with equal force to in-person conversations. Using a hidden microphone, a smartphone voice recorder app, or any other device to capture a face-to-face discussion without the consent of all parties is a criminal offense.

The statute refers to "special devices" (posebne naprave) in paragraph 1, but courts have interpreted this broadly. A smartphone counts. A smartwatch with a microphone counts. Any device capable of capturing audio falls within the scope of the law.

For paragraph 2, which covers recording conversations you participate in, no special device is required by the text. The offense is triggered by recording a confidential statement without consent and with intent to misuse it.

The "Intent to Misuse" Question

Paragraph 2's requirement of intent to misuse (z namenom, da bi tako izjavo zlorabil) creates a narrower offense than paragraph 1. A participant who records a conversation for purely personal reference, with no plan to share or use it against the speaker, may have a defense.

However, this defense is difficult to sustain in practice. Courts look at the totality of circumstances, and sharing the recording with anyone, posting it online, or using it in legal proceedings can all demonstrate the required intent. The safest course is to obtain consent before pressing record.

Recording Police and Public Officials in Slovenia

Recording police officers while they carry out their duties is treated differently from recording private individuals. The Information Commissioner's Office has confirmed that citizens may record police executing official functions as an exercise of constitutional free expression rights under Article 39 of the Slovenian Constitution and Article 10 of the European Convention on Human Rights.

The core principle is that public oversight of police functioning is a necessary condition for a democratic society. Police officers and other public officials, when performing their official duties, have significantly lower expectations of privacy than private individuals in the same physical setting.

Limits on Recording Police

The right to record is not unlimited. According to the Information Commissioner's analysis, recording may be lawfully restricted when:

• The recording would interfere with police executing their operational duties
• The recording would create danger to officers or to persons being arrested or detained

These are operational limits, not categorical prohibitions. A bystander filming a routine traffic stop or a protest from a public vantage point is on solid legal ground. Someone attempting to film an active arrest from a position that physically impedes the officers may not be.

Police Authority to Record

Article 114 of the Police Tasks and Powers Act (ZNPPol) authorizes police officers to use technical means for photography, video recording, and audio recording in two contexts: to monitor the lawfulness of police operations themselves, and at public gatherings where mass violations of public order or criminal offenses are reasonably anticipated.

Officers must notify all persons present that the procedure or gathering is being recorded, either at the start of recording or as soon as circumstances allow. An exception applies when providing notification would prevent or significantly hamper execution of the specific police task.

Recording Versus Interfering

Slovenian law distinguishes between recording police activity and obstructing it. The act of holding a phone and filming is recording. Physically blocking officers, shouting instructions to subjects of police attention, or destroying evidence before police can secure it are separate offenses unrelated to the legality of the recording itself. The two should not be conflated.

Workplace Recording in Slovenia

Slovenian labor law imposes additional restrictions on recording in the workplace, layered on top of the Criminal Code provisions.

Employer Surveillance of Employees

The ZVOP-2 Act and GDPR together regulate employer monitoring. Video surveillance of areas where employees usually work is prohibited unless the employer can demonstrate it is absolutely necessary for safety, property protection, or another compelling reason.

Before installing any surveillance system, employers must:

• Consult with trade union representatives, the works council, or a workers' representative at least 30 days before implementation
• Provide written notice to all employees
• Post visible signage at distances that allow individuals to avoid monitored areas
• Conduct and document a legitimate interest assessment
• Define and disclose retention periods (maximum one year under ZVOP-2)

Certain areas are completely off-limits for surveillance regardless of justification: elevators, restrooms, changing rooms, hotel rooms, and any similar space where individuals reasonably expect a higher level of privacy.

Data Protection Impact Assessment Requirement

Under Article 35 of the GDPR, employers who conduct systematic and extensive monitoring of employees must carry out a Data Protection Impact Assessment (DPIA) before implementing the monitoring program. The ZVOP-2 does not eliminate this requirement; it supplements it with the Slovenian-specific consultation and notice obligations described above. Failure to conduct a required DPIA is itself an administrative violation subject to ZVOP-2 fines.

Employee Recording of Workplace Conversations

Employees who secretly record conversations with colleagues or supervisors face the same criminal liability under Article 137. Slovenian law does not carve out a workplace exception.

The Slovenian government has explicitly addressed this point. In response to a 2021 public proposal asking whether citizens should be allowed to record public officials performing their duties, three ministries (Justice, Public Administration, and Interior) confirmed that recording without consent may violate both Article 137 (audio) and Article 138 (visual) of the Criminal Code.

Audio Surveillance in the Workplace

Audio recording of employees is treated even more restrictively than video surveillance. While ZVOP-2 contains specific provisions permitting CCTV under defined conditions, it provides no equivalent authorization for continuous audio monitoring in the workplace. Any employer who records workplace conversations without all-party consent faces both criminal prosecution under Article 137 and GDPR enforcement under ZVOP-2.

Recording in Public Spaces

Recording in public spaces occupies a gray area under Slovenian law. The constitutional right to privacy still applies, but expectations of privacy are lower in genuinely public settings.

Slovenian courts have developed a four-factor test for evaluating whether recording in a public space violates privacy:

1. The degree of intimacy of the invaded sphere of privacy
2. The characteristics of the public space under surveillance
3. Whether the cameras or recording devices were visible or disguised
4. The scope and degree of recording compared to its normal and expected purpose

Filming a busy street scene where no individual is singled out is generally permissible. Secretly recording a private conversation on a park bench, even though the setting is technically public, likely crosses the line.

ZVOP-2 explicitly prohibits two categories of automated surveillance in public areas. Automatic license plate recognition (ALPR/ANPR) systems are banned in public spaces. Biometric surveillance systems, including facial recognition used to identify individuals in publicly accessible locations, are similarly prohibited under both ZVOP-2 and the EU AI Act (discussed below). Video surveillance in public spaces is permitted only in specifically justified cases involving a serious and justified danger to life, personal liberty, physical health, or security of property, with recordings retained for no more than six months.

GDPR, ZVOP-2, and Data Protection Enforcement

Slovenia's data protection framework adds a separate layer of liability that applies alongside the Criminal Code.

The GDPR has been directly applicable in Slovenia since May 2018. Any audio or video recording that captures identifiable individuals constitutes personal data processing and therefore requires a lawful basis under Article 6 of the GDPR, such as consent, legitimate interest, or legal obligation.

The ZVOP-2, adopted on December 15, 2022 and effective January 26, 2023, fills gaps the GDPR left to member states. It was the last GDPR implementing act adopted in the entire European Union. An additional traceability log obligation took effect on January 26, 2025 (the second anniversary of ZVOP-2): organizations must maintain audit-trail records of who accessed personal data, when, and for what purpose.

Penalties Under ZVOP-2 and GDPR

The penalty structure is substantial:

• Serious violations (fundamental GDPR principles, consent, data subject rights): fines up to EUR 20 million or 4% of worldwide annual turnover, whichever is higher
• Administrative violations (secondary obligations): fines up to EUR 10 million or 2% of worldwide annual turnover
• Traceability/special processing breaches: EUR 4,000 to EUR 36,000 for medium and large companies; EUR 4,000 to EUR 12,000 for smaller entities
• CCTV-specific violations: EUR 8,000 to EUR 20,000 for medium and large companies; EUR 4,000 to EUR 10,000 for smaller entities
• Responsible individuals: EUR 100 to EUR 8,000 depending on the severity category

The Information Commissioner serves as the enforcement authority for both GDPR and ZVOP-2 violations. The Commissioner has the power to conduct audits, issue corrective orders, and impose fines as an offense authority.

EU AI Act: Real-Time Biometric Surveillance and Deepfakes

The EU Artificial Intelligence Act (Regulation (EU) 2024/1689) entered into force on August 1, 2024, and applies directly in Slovenia as an EU member state. Two sets of provisions are directly relevant to recording law.

Prohibited AI practices (Article 5), in force from February 2, 2025: Real-time remote biometric identification (RTBI) systems in publicly accessible spaces are categorically prohibited, with narrow exceptions for law enforcement use requiring prior judicial authorization for each deployment. This prohibition reinforces and extends ZVOP-2's existing ban on biometric surveillance in public areas.

Transparency obligations (Article 50), enforceable from August 2, 2026: Deployers of AI systems that generate or manipulate image, audio, or video content constituting a deepfake must disclose that the content has been artificially generated or manipulated. The obligation applies to synthetic audio, video, and images produced or significantly altered by AI. Exemptions exist for clearly artistic, satirical, or fictional works, provided the existence of manipulation is still disclosed where it does not hamper the work's purpose. Deployers of AI systems using emotion recognition or biometric categorization must also inform the individuals being analyzed that such a system is in operation.

Deepfakes and domestic law: No Slovenia-specific statute has been enacted to date that separately criminalizes the creation or distribution of deepfakes. The existing framework addresses the issue through KZ-1 Article 143 (abuse of personal data, which covers exploiting a person's likeness or identity in ways that violate their personal dignity), KZ-1 Article 138 (unauthorized visual recording and distribution), and GDPR/ZVOP-2 (where a deepfake constitutes unlawful processing of biometric data). The EU AI Act's Article 50 disclosure obligation will become enforceable in August 2026 and represents the most direct regulatory tool currently available for AI-generated content about identifiable individuals.

Law Enforcement and Wiretapping Exceptions

Slovenian law permits government surveillance only under tightly controlled conditions that mirror the constitutional requirements of Article 37.

Law enforcement agencies may intercept communications when, under Articles 150 to 160 of the Code of Criminal Procedure (Zakon o kazenskem postopku, ZKP):

• A court issues a specific order authorizing the surveillance
• The order is limited to a defined time period
• The surveillance is necessary for the investigation or conduct of criminal proceedings, or for national security
• Less intrusive means are insufficient to achieve the investigative purpose

These requirements reflect the constitutional principle that communication privacy can only be suspended by law, on the basis of a court decision, for a limited time, and when strictly necessary. Any evidence obtained outside these parameters risks exclusion from criminal proceedings.

Business Compliance Checklist

Organizations operating in Slovenia that need to record calls or conduct any form of surveillance should follow these steps:

1. Identify a lawful basis under GDPR Article 6 before recording anything
2. Obtain explicit consent from all parties before recording calls or conversations
3. Provide clear notice that explains the purpose, scope, and retention period of any recording
4. Document your legitimate interest assessment if relying on that basis instead of consent
5. Consult employee representatives at least 30 days before implementing workplace surveillance
6. Post visible signage for any CCTV installation, placed far enough away that people can avoid the monitored area
7. Set retention limits and do not exceed one year for CCTV footage or six months for public-area recordings
8. Conduct a DPIA before implementing any systematic employee monitoring program, as required by GDPR Article 35
9. Appoint a Data Protection Officer if your organization conducts large-scale systematic monitoring
10. Register your processing activities and maintain records as required by GDPR Article 30
11. Report data breaches to the Information Commissioner within 72 hours
12. Audit AI recording tools against EU AI Act Article 5 (prohibited systems) before deployment; if deepfake-generating features are used, build Article 50 disclosure workflows ahead of the August 2, 2026 enforcement date

Penalties Summary Table

Key Differences from Neighboring Countries

Slovenia's recording laws stand out in several ways compared to its neighbors:

• Austria similarly requires all-party consent under Section 120 of its Criminal Code, and the enforcement mechanism tracks closely with Slovenia's criminal-complaint model
• Croatia requires all-party consent under its Criminal Code (Article 144 addresses analogous eavesdropping and communication secrecy offenses), closely mirroring Slovenia's approach
• Italy allows one-party consent for participants in a conversation, making it significantly more permissive than Slovenia
• Hungary follows a one-party consent model for private recordings
• Serbia (non-EU neighbor) uses a one-party consent model under its Criminal Code Article 143, creating a sharp contrast with the all-party requirement immediately across the border

Businesses operating across borders in Central Europe should not assume that rules in one country apply in another. Slovenia's all-party requirement makes it one of the more restrictive jurisdictions in the region.