Cybersecurity Policy Report, Transfers of Health Data to Cloud Companies Analyzed by Slovenian Agency, (Aug 11, 2026)

By Tony Foley

The Slovenian Information Commissioner (IC) has issued a nonbinding opinion in response to a query asking for clarification on the legality under the European Union’s General Data Protection Regulation (GDPR) and its implementing Slovenian legislation of transfers of health data to a cloud located in an EU member state but managed by a company headquartered in the U.S.

The opinion begins by noting that article 23(4) of Slovenia’s Personal Data Protection Act (ZVOP-2), which addresses the permissibility of transferring specified types of data across Slovenian borders, should not be interpreted to mean that the transfer of health data outside Slovenia is totally banned. The IP said that in practice, such a determination would cause serious problems, like when applying for health services or health insurance abroad. Instead, the opinion said, article 23(4) should be read primarily to provide that that it is impermissible to store the entire health database outside Slovenian territory, while permitting the storage of individual data, individual access, and transfers of personal data across the border.

Given the foregoing analysis, the IC said that a transfer of health data to a cloud server located in Germany would be permissible, because Germany is an EU member state, meaning that in principle, there would be no transfer to a third country under the GDPR if the data were stored entirely, and at all times, on a server in Germany and only accessed in the EU. The opinion added, however, that if there also were access to the data from the U.S., it would constitute a transfer of personal data that must be conducted in compliance with chapter V of the GDPR governing cross-border data transfers to countries outside the EU.

The IC told the party requesting the opinion that the contracts with its cloud service provider must specify in detail how personal data will be secured, covering how the premises and software are protected, how the provider prevents unauthorized access to data, and how data is secured during the transmission. In addition, the cloud service provider must explain to its client, in advance and in detail, at which locations its data will be stored.

The opinion concludes with recommendations for data controllers that use cloud services, including conducting thorough risk analyses before deciding to use such services and declining to transfer special types of personal data and all other data with a higher level of risk to the cloud until robust safeguards are in place.

News: InternationalLegislation DataPrivacy DataSecurity GDPR