Slovenia Recording Laws: One-Party Consent Rules and Penalties (2026)

Slovenia is a one-party consent jurisdiction: a participant may record a conversation they are part of without the other person's knowledge. Criminal Code Article 137(2) criminalizes that recording only when it is made with intent to misuse the other person's statement; eavesdropping on a conversation between other people is a separate offense under Article 137(1) regardless of anyone's consent. Unauthorized recording carries a fine or up to one year in prison; public officials who abuse their position face three months to five years.

Overview of Recording Laws in Slovenia

Slovenia allows one-party consent: a participant may record a conversation they are part of without the other person's knowledge. That same recording becomes a crime once it is made with intent to misuse the other person's statement, and eavesdropping on a conversation between other people is prohibited outright, regardless of anyone's consent. The country's legal framework builds on a constitutional guarantee, a criminal statute last consolidated in 2015, and layers of European data protection regulation.

For anyone living in, traveling through, or doing business with Slovenia, the practical bottom line is this: recording your own conversation for ordinary personal reasons is not itself a crime, but recording it in order to misuse the other person's words against them is, and secretly listening in on or recording a conversation you are not part of is prohibited outright. Violations carry criminal penalties, and separate data protection rules can stack additional fines on top.

Three bodies of law work together to produce this result. The Constitution of the Republic of Slovenia sets the foundation. The Criminal Code (Kazenski zakonik, KZ-1) defines specific offenses and penalties. And the Personal Data Protection Act (ZVOP-2), which took effect on January 26, 2023, implements the EU General Data Protection Regulation with Slovenia-specific provisions on surveillance, biometrics, and enforcement.

A fourth layer arrived in 2024 and 2025: the EU AI Act, which applies directly in Slovenia and imposes obligations on real-time biometric surveillance and AI-generated content that affect how recording laws intersect with emerging technology.

Constitutional Protections for Communication Privacy

The Slovenian Constitution anchors privacy protections in several articles that courts treat as fundamental rights.

Article 35 guarantees "the inviolability of the physical and mental integrity of every person and his privacy and personality rights." This provision extends to any form of surveillance or recording that intrudes on personal autonomy.

Article 37 states that "the privacy of correspondence and other means of communication shall be guaranteed." The only permitted exception requires a law that authorizes a court to suspend this protection for a set period, and only when necessary for criminal proceedings or national security.

Article 38 guarantees the protection of personal data, prohibiting any use of personal data that goes beyond the purpose for which it was originally collected.

Taken together, these three provisions mean that recording someone's conversation without their consent is not just a criminal offense but a violation of constitutional rights. Courts apply strict proportionality analysis when any law attempts to carve out exceptions, and they have repeatedly struck down measures that failed to meet that standard.

Criminal Code Article 137: The Core Recording Offense

The primary statute governing audio recording in Slovenia is Article 137 of the Criminal Code (KZ-1), titled "Neupraviceno prisluskovanje in zvocno snemanje" (Unauthorized Eavesdropping and Sound Recording). The current version is KZ-1-NPB4, the officially consolidated text published in Uradni list RS No. 54/15.

This article contains four paragraphs that define the offense, penalties, and prosecution procedures.

Paragraph 1: Eavesdropping on Others' Conversations

Anyone who uses special devices to eavesdrop on a conversation or statement not intended for them, or who records it, commits a criminal offense. The same applies to anyone who transmits such a conversation to a third party, plays a recording for them, or otherwise enables them to learn its contents.

The penalty is a fine or imprisonment of up to one year.

This paragraph targets the classic wiretapping scenario: intercepting a conversation between other people without being a participant. It covers both real-time eavesdropping and the act of recording for later use.

Paragraph 2: Recording Your Own Conversations Without Consent

Anyone who records a confidential statement intended for them, without the other person's consent and with the intent to misuse it (z namenom, da bi tako izjavo zlorabil), also faces criminal liability. Transmitting, playing, or otherwise sharing that recording with a third party triggers the same penalties.

The penalty mirrors paragraph 1: a fine or imprisonment of up to one year.

This is the only paragraph of Article 137 that reaches a participant, and its intent-to-misuse element is what keeps Slovenia a one-party consent jurisdiction rather than an all-party one. Recording a conversation you are part of, without the other person's knowledge, is not itself the offense; the offense requires that the recording be made with intent to misuse the statement. Recording for ordinary personal reference, without that intent, does not violate this paragraph, though obtaining consent up front remains the safest practice since intent can later be inferred from how a recording is used.

Paragraph 3: Aggravated Offense for Public Officials

When a public official commits either of the above offenses by abusing their official position or authority (z zlorabo uradnega položaja ali uradnih pravic), the penalty increases significantly.

The punishment is imprisonment from three months to five years.

This harsher penalty reflects the Slovenian legal system's view that government officials hold a position of trust. Police officers, prosecutors, judges, and other state employees who use their authority to conduct unauthorized recordings face much steeper consequences.

Paragraph 4: How Prosecution Works

Prosecution for paragraph 1 offenses (eavesdropping on others) begins "on a proposal," meaning the victim must file a criminal complaint to initiate proceedings. For paragraph 2 offenses (recording your own conversations without consent), prosecution proceeds by private prosecution, placing the burden on the victim to bring the case forward.

This distinction matters in practice. Eavesdropping cases involve a prosecutor after the complaint is filed. Secret recording cases require the victim to pursue the matter through the court system directly.

Article 138: Visual Recording Restrictions

Article 138 of the Criminal Code addresses unauthorized visual recording (Neupraviceno slikovno snemanje) and follows a similar structure.

Paragraph 1 covers unauthorized recording or photographing of another person or their premises without consent, where doing so substantially violates their privacy (občutno poseže v njegovo zasebnost), or directly transmitting that recording to a third party. The penalty is a fine or imprisonment of up to one year.

Paragraph 2 elevates the offense when a public official commits it through abuse of position: imprisonment from three months to five years.

Prosecution for paragraph 1 violations requires a formal complaint from the victim.

The "substantially violates privacy" standard gives courts discretion. Filming someone on a busy public street may not meet the threshold, but recording them through a window at home almost certainly would.

Criminal Code Article 139: Communication Secrecy and Related Offenses

Article 139 of the Criminal Code (KZ-1), titled "Kršitev tajnosti občil" (Violation of Communication Secrecy), extends privacy protections beyond face-to-face and telephone conversations to cover the secrecy of correspondence and electronic communications more broadly.

The article contains six paragraphs:

Paragraph 1 penalizes unauthorized opening of another person's mail, telegram, or sealed correspondence: a fine or imprisonment up to six months.

Paragraph 2 imposes heavier penalties (a fine or up to one year imprisonment) for three specific acts: (a) using technical or chemical means to access sealed communications without physically opening them; (b) using technical means to intercept telephone or other electronic communications; (c) opening sealed containers protecting transmitted messages.

Paragraph 3 applies the same penalties to anyone who enables third parties to directly access communication content through the methods described in paragraphs 1 or 2.

Paragraph 4 penalizes unauthorized retention, concealment, destruction, or transfer of another person's mail or correspondence before the intended recipient receives it: a fine or up to one year.

Paragraph 5 elevates penalties to three months to five years when the offense is committed by a public official abusing their position, or by a postal worker with responsibility for handling the mail at issue.

Paragraph 6 specifies that prosecution for violations under paragraphs 1 through 4 requires a formal complaint from the victim.

Article 143: Abuse of Personal Data

Article 143 of the KZ-1, titled "Zloraba osebnih podatkov" (Abuse of Personal Data), criminalizes unauthorized disclosure of personal data without legal basis or personal consent in public announcements or publications. It also covers assuming another person's identity or exploiting their personal data in ways that violate their personal dignity. This provision is relevant when recordings or AI-generated content about identifiable individuals are used to damage their reputation or privacy.

Article 140, titled "Nedovoljena objava zasebnih pisanj" (Unlawful Publication of Private Correspondence), addresses unauthorized publication of private letters and correspondence, providing an additional avenue for victims of recording-related privacy violations where the content of private communications is disclosed publicly.

Phone Recording Laws in Slovenia

Recording telephone calls in Slovenia falls under both the Criminal Code and the Electronic Communications Act (ZEKom-2), which replaced the earlier ZEKom-1 when it entered force on November 10, 2022.

Article 214 of ZEKom-2 draws the same participant/non-participant line as the Criminal Code. A non-participant who listens in on, records, or forwards a communication without the consent of the people involved is broadly prohibited, mirroring Article 137(1)'s eavesdropping offense. For a participant, Article 214(6) prohibits recording only where doing so is not an ordinary practice for that kind of communication and the other party could not reasonably expect it, echoing the intent-based limitation in Article 137(2) rather than imposing a blanket all-party rule.

The Slovenian Information Commissioner (Informacijski pooblascenec) has issued guidance addressing business call recording specifically: recording a call in that unexpected, non-ordinary business context without meeting the statutory conditions below can expose a business to liability. The Commissioner has also noted that even notification of recording is insufficient on its own; all statutory conditions must be met simultaneously.

When Business Call Recording Is Permitted

A narrow exception exists for business communications. Companies may record calls to "provide evidence of market transactions or other business communication," but only when all of the following conditions are met:

• All parties receive advance notice before the recording begins
• The specific purpose of the recording is clearly disclosed
• The storage duration for the recording is defined and communicated
• A lawful basis under GDPR exists for the data processing

The Information Commissioner has emphasized that general "quality assurance" or "training purposes" do not, by themselves, constitute sufficient legal justification for recording calls. Businesses that rely on these vague rationales risk both criminal liability and GDPR enforcement actions.

Online and App-Based Calls

The same rules apply to calls conducted through internet-based platforms such as WhatsApp, Microsoft Teams, or Zoom. These services transmit audio and video as electronic communications within the meaning of ZEKom-2. Recording a Teams meeting or a WhatsApp call carries the same legal analysis as recording a traditional telephone call: a participant recording for ordinary personal reasons is not automatically a crime, but recording with intent to misuse the content, or a non-participant intercepting the call, carries the same exposure under Article 137 that applies to any other conversation. Where AI-assisted transcription or analysis tools are used during such calls, the GDPR lawful-basis requirement applies to the resulting processed data independently of the consent issue for the recording itself.

In-Person Recording: What the Law Covers

Article 137 applies with equal force to in-person conversations. Using a hidden microphone, a smartphone voice recorder app, or any other device to capture a face-to-face discussion without the consent of all parties is a criminal offense.

The statute refers to "special devices" (posebne naprave) in paragraph 1, but courts have interpreted this broadly. A smartphone counts. A smartwatch with a microphone counts. Any device capable of capturing audio falls within the scope of the law.

For paragraph 2, which covers recording conversations you participate in, no special device is required by the text. The offense is triggered by recording a confidential statement without consent and with intent to misuse it.

The "Intent to Misuse" Element

Paragraph 2's requirement of intent to misuse (z namenom, da bi tako izjavo zlorabil) is not a defense to an otherwise-complete offense. It is an element the prosecution must prove, and without it, no crime under paragraph 2 has occurred at all. A participant who records a conversation for purely personal reference, with no plan to share or use it against the speaker, has not committed the offense in the first place.

In practice, this element is easiest to prove after the fact. Courts look at the totality of circumstances, and sharing the recording with anyone, posting it online, using it to pressure or threaten the other person, or introducing it in legal proceedings against them can all demonstrate the required intent retroactively. Because intent is judged by what you later do with a recording rather than by your state of mind at the moment you press record, obtaining consent up front, or at minimum keeping any recording strictly private, remains the safest course.

Recording Police and Public Officials in Slovenia

Recording police officers while they carry out their duties is treated differently from recording private individuals. The Information Commissioner's Office has confirmed that citizens may record police executing official functions as an exercise of constitutional free expression rights under Article 39 of the Slovenian Constitution and Article 10 of the European Convention on Human Rights.

The core principle is that public oversight of police functioning is a necessary condition for a democratic society. Police officers and other public officials, when performing their official duties, have significantly lower expectations of privacy than private individuals in the same physical setting.

Limits on Recording Police

The right to record is not unlimited. According to the Information Commissioner's analysis, recording may be lawfully restricted when:

• The recording would interfere with police executing their operational duties
• The recording would create danger to officers or to persons being arrested or detained

These are operational limits, not categorical prohibitions. A bystander filming a routine traffic stop or a protest from a public vantage point is on solid legal ground. Someone attempting to film an active arrest from a position that physically impedes the officers may not be.

Police Authority to Record

Article 114 of the Police Tasks and Powers Act (ZNPPol) authorizes police officers to use technical means for photography, video recording, and audio recording in two contexts: to monitor the lawfulness of police operations themselves, and at public gatherings where mass violations of public order or criminal offenses are reasonably anticipated.

Officers must notify all persons present that the procedure or gathering is being recorded, either at the start of recording or as soon as circumstances allow. An exception applies when providing notification would prevent or significantly hamper execution of the specific police task.

Recording Versus Interfering

Slovenian law distinguishes between recording police activity and obstructing it. The act of holding a phone and filming is recording. Physically blocking officers, shouting instructions to subjects of police attention, or destroying evidence before police can secure it are separate offenses unrelated to the legality of the recording itself. The two should not be conflated.

Workplace Recording in Slovenia

Slovenian labor law imposes additional restrictions on recording in the workplace, layered on top of the Criminal Code provisions.

Employer Surveillance of Employees

The ZVOP-2 Act and GDPR together regulate employer monitoring. Video surveillance of areas where employees usually work is prohibited unless the employer can demonstrate it is absolutely necessary for safety, property protection, or another compelling reason.

Before installing any surveillance system, employers must:

• Consult with trade union representatives, the works council, or a workers' representative at least 30 days before implementation
• Provide written notice to all employees
• Post visible signage at distances that allow individuals to avoid monitored areas
• Conduct and document a legitimate interest assessment
• Define and disclose retention periods (maximum one year under ZVOP-2)

Certain areas are completely off-limits for surveillance regardless of justification: elevators, restrooms, changing rooms, hotel rooms, and any similar space where individuals reasonably expect a higher level of privacy.

Data Protection Impact Assessment Requirement

Under Article 35 of the GDPR, employers who conduct systematic and extensive monitoring of employees must carry out a Data Protection Impact Assessment (DPIA) before implementing the monitoring program. The ZVOP-2 does not eliminate this requirement; it supplements it with the Slovenian-specific consultation and notice obligations described above. Failure to conduct a required DPIA is itself an administrative violation subject to ZVOP-2 fines.

Employee Recording of Workplace Conversations

Employees who record their own conversations with colleagues or supervisors are subject to the same paragraph 2 analysis as any other participant recording: the recording itself is not automatically a crime, but doing so with intent to misuse the statement, for example to leverage it in a dispute with the employer or leak it, is. Slovenian law does not carve out a workplace exception to either the offense or its intent element.

The Slovenian government has explicitly addressed this point. In response to a 2021 public proposal asking whether citizens should be allowed to record public officials performing their duties, three ministries (Justice, Public Administration, and Interior) confirmed that recording without consent may violate both Article 137 (audio) and Article 138 (visual) of the Criminal Code.

Audio Surveillance in the Workplace

Audio recording of employees is treated even more restrictively than video surveillance. While ZVOP-2 contains specific provisions permitting CCTV under defined conditions, it provides no equivalent authorization for continuous audio monitoring in the workplace. Because the employer is typically not a party to the conversations it records, this is third-party interception under Article 137(1) rather than participant recording under 137(2): an employer that audio-monitors employee conversations without every employee's informed consent risks both criminal prosecution under Article 137 and GDPR enforcement under ZVOP-2.

Recording in Public Spaces

Recording in public spaces occupies a gray area under Slovenian law. The constitutional right to privacy still applies, but expectations of privacy are lower in genuinely public settings.

Slovenian courts have developed a four-factor test for evaluating whether recording in a public space violates privacy:

1. The degree of intimacy of the invaded sphere of privacy
2. The characteristics of the public space under surveillance
3. Whether the cameras or recording devices were visible or disguised
4. The scope and degree of recording compared to its normal and expected purpose

Filming a busy street scene where no individual is singled out is generally permissible. Secretly recording a private conversation on a park bench, even though the setting is technically public, likely crosses the line.

ZVOP-2 explicitly prohibits two categories of automated surveillance in public areas. Automatic license plate recognition (ALPR/ANPR) systems are banned in public spaces. Biometric surveillance systems, including facial recognition used to identify individuals in publicly accessible locations, are similarly prohibited under both ZVOP-2 and the EU AI Act (discussed below). Video surveillance in public spaces is permitted only in specifically justified cases involving a serious and justified danger to life, personal liberty, physical health, or security of property, with recordings retained for no more than six months.

GDPR, ZVOP-2, and Data Protection Enforcement

Slovenia's data protection framework adds a separate layer of liability that applies alongside the Criminal Code.

The GDPR has been directly applicable in Slovenia since May 2018. Any audio or video recording that captures identifiable individuals constitutes personal data processing and therefore requires a lawful basis under Article 6 of the GDPR, such as consent, legitimate interest, or legal obligation.

The ZVOP-2, adopted on December 15, 2022 and effective January 26, 2023, fills gaps the GDPR left to member states. It was the last GDPR implementing act adopted in the entire European Union. An additional traceability log obligation took effect on January 26, 2025 (the second anniversary of ZVOP-2): organizations must maintain audit-trail records of who accessed personal data, when, and for what purpose.

Penalties Under ZVOP-2 and GDPR

The penalty structure is substantial:

• Serious violations (fundamental GDPR principles, consent, data subject rights): fines up to EUR 20 million or 4% of worldwide annual turnover, whichever is higher
• Administrative violations (secondary obligations): fines up to EUR 10 million or 2% of worldwide annual turnover
• Traceability/special processing breaches: EUR 4,000 to EUR 36,000 for medium and large companies; EUR 4,000 to EUR 12,000 for smaller entities
• CCTV-specific violations: EUR 8,000 to EUR 20,000 for medium and large companies; EUR 4,000 to EUR 10,000 for smaller entities
• Responsible individuals: EUR 100 to EUR 8,000 depending on the severity category

The Information Commissioner serves as the enforcement authority for both GDPR and ZVOP-2 violations. The Commissioner has the power to conduct audits, issue corrective orders, and impose fines as an offense authority.

EU AI Act: Real-Time Biometric Surveillance and Deepfakes

The EU Artificial Intelligence Act (Regulation (EU) 2024/1689) entered into force on August 1, 2024, and applies directly in Slovenia as an EU member state. Two sets of provisions are directly relevant to recording law.

Prohibited AI practices (Article 5), in force from February 2, 2025: Real-time remote biometric identification (RTBI) systems in publicly accessible spaces are categorically prohibited, with narrow exceptions for law enforcement use requiring prior judicial authorization for each deployment. This prohibition reinforces and extends ZVOP-2's existing ban on biometric surveillance in public areas.

Transparency obligations (Article 50), enforceable from August 2, 2026: Deployers of AI systems that generate or manipulate image, audio, or video content constituting a deepfake must disclose that the content has been artificially generated or manipulated. The obligation applies to synthetic audio, video, and images produced or significantly altered by AI. Exemptions exist for clearly artistic, satirical, or fictional works, provided the existence of manipulation is still disclosed where it does not hamper the work's purpose. Deployers of AI systems using emotion recognition or biometric categorization must also inform the individuals being analyzed that such a system is in operation.

Deepfakes and domestic law: No Slovenia-specific statute has been enacted to date that separately criminalizes the creation or distribution of deepfakes. The existing framework addresses the issue through KZ-1 Article 143 (abuse of personal data, which covers exploiting a person's likeness or identity in ways that violate their personal dignity), KZ-1 Article 138 (unauthorized visual recording and distribution), and GDPR/ZVOP-2 (where a deepfake constitutes unlawful processing of biometric data). The EU AI Act's Article 50 disclosure obligation will become enforceable in August 2026 and represents the most direct regulatory tool currently available for AI-generated content about identifiable individuals.

Law Enforcement and Wiretapping Exceptions

Slovenian law permits government surveillance only under tightly controlled conditions that mirror the constitutional requirements of Article 37.

Law enforcement agencies may intercept communications when, under Articles 150 to 160 of the Code of Criminal Procedure (Zakon o kazenskem postopku, ZKP):

• A court issues a specific order authorizing the surveillance
• The order is limited to a defined time period
• The surveillance is necessary for the investigation or conduct of criminal proceedings, or for national security
• Less intrusive means are insufficient to achieve the investigative purpose

These requirements reflect the constitutional principle that communication privacy can only be suspended by law, on the basis of a court decision, for a limited time, and when strictly necessary. Any evidence obtained outside these parameters risks exclusion from criminal proceedings.

Business Compliance Checklist

Organizations operating in Slovenia that need to record calls or conduct any form of surveillance should follow these steps:

1. Identify a lawful basis under GDPR Article 6 before recording anything
2. Obtain explicit consent from all parties before recording calls or conversations
3. Provide clear notice that explains the purpose, scope, and retention period of any recording
4. Document your legitimate interest assessment if relying on that basis instead of consent
5. Consult employee representatives at least 30 days before implementing workplace surveillance
6. Post visible signage for any CCTV installation, placed far enough away that people can avoid the monitored area
7. Set retention limits and do not exceed one year for CCTV footage or six months for public-area recordings
8. Conduct a DPIA before implementing any systematic employee monitoring program, as required by GDPR Article 35
9. Appoint a Data Protection Officer if your organization conducts large-scale systematic monitoring
10. Register your processing activities and maintain records as required by GDPR Article 30
11. Report data breaches to the Information Commissioner within 72 hours
12. Audit AI recording tools against EU AI Act Article 5 (prohibited systems) before deployment; if deepfake-generating features are used, build Article 50 disclosure workflows ahead of the August 2, 2026 enforcement date

Penalties Summary Table

Key Differences from Neighboring Countries

Slovenia's recording laws stand out in several ways compared to its neighbors:

• Austria has a similarly structured Criminal Code provision (Section 120): a participant recording their own conversation is not automatically an offense, but disclosing or using the recording against the other person separately requires consent, producing a one-party-to-record result comparable to Slovenia's
• Croatia requires all-party consent under its Criminal Code (Article 144 addresses analogous eavesdropping and communication secrecy offenses); if that all-party reading holds, Croatia is stricter than Slovenia's participant-recording rule, though the enforcement mechanism tracks a similar criminal-complaint model
• Italy allows one-party consent for participants in a conversation, similar in practice to Slovenia's rule for participants
• Hungary follows a one-party consent model for private recordings, similar to Slovenia
• Serbia (non-EU neighbor) uses a one-party consent model under its Criminal Code Article 143, similar to Slovenia's own participant-recording rule despite being outside the EU

Businesses operating across borders in Central Europe should not assume that rules in one country apply in another. Slovenia's narrow intent-to-misuse element for participant recording means casual personal recording is not automatically a crime, but the moment a recording is shared, published, or used against the other party, both criminal and GDPR exposure attach, so cross-border business calls should still default to advance notice and consent from every participant to stay inside every jurisdiction's rules at once.