Bank of Slovenia Council sets five confidentiality tiers and bans cloud processing

The Council of the Bank of Slovenia has adopted a decision establishing five confidentiality tiers for information produced or held by the central bank, together with binding handling rules for every internal and external recipient. The Decision on the Protection of Confidential Information of the Bank of Slovenia was published in Uradni list Republike Slovenije No. 1672/2026 of 15 October 2026 and enters into force on 1 March 2027.

The decision was issued under Article 31(1) and Article 47(3) of the Zakon o Banki Slovenije (ZBan-4) and signed in Ljubljana on 6 October 2026 by Primož Dolenc, president of the Council of the Bank of Slovenia, under file number 009/2026 and document reference 2026-01-2332 (EDA 2026-5023912000-0010). It replaces the Rules on the Protection of Confidential Data of the Bank of Slovenia of 3 September 2019.

It must be applied by all internal and external recipients of the bank’s confidential information, who are responsible for preserving its confidentiality. Information that is secret under the law governing classified information falls outside its scope, and information classified in order to conceal a criminal offence or an abuse of authority is not treated as confidential.

Five tiers, from public to top secret

• BSI-JAVNO — information already public or whose disclosure would have no negative impact on the bank.
• BSI-NEJAVNO — likely negative impact, including temporary market disturbance and financial loss of EUR 10,000 to EUR 100,000.
• BSI-OMEJENO — important negative impact, including loss above EUR 100,000 and up to EUR 1,000,000.
• BSI-ZAUPNO — serious negative impact, including loss above EUR 1,000,000 and up to EUR 10,000,000.
• BSI-TAJNO — very serious negative impact, including very great harm to the operational effectiveness of the Eurosystem and loss above EUR 10,000,000.

Annex 2 maps the new labels onto the markings used by the European Central Bank, the Single Resolution Board and the European Banking Authority: BSI-ZAUPNO, for instance, corresponds to ECB-CONFIDENTIAL, SRB-ORANGE and EBA Confidential use.

Who classifies and who authorises disclosure

• BSI-ZAUPNO may be assigned only by a member of the Council of the Bank of Slovenia and by the secretary general and directors of organisational units, for information within their unit.
• BSI-TAJNO may be assigned only by a member of the Council of the Bank of Slovenia.
• Disclosure of BSI-NEJAVNO information is assessed by the employee; BSI-OMEJENO by the secretary general or the responsible director; BSI-ZAUPNO by the competent Council member or, on the governor’s authorisation, the secretary general; BSI-TAJNO by the governor or a person expressly authorised by the governor.
• Requests from external recipients must be in writing and state the applicant, the legal basis, the purpose, the case reference, the information sought and the form of delivery.

Handling rules for banks, auditors and suppliers

Annex 3 sets minimum technical and organisational measures. For the highest tier, BSI-TAJNO, processing through public cloud services, processing with artificial intelligence tools and processing on mobile devices is prohibited, and data must be stored and processed exclusively on the territory of the Republic of Slovenia. Encryption of data at rest on removable media, workstations, local servers and cloud storage is required or recommended depending on the tier, and security requirements must be written into contracts with suppliers and vendors.

External recipients must restrict access to authorised staff on a need-to-know basis, use the information only for the purpose for which it was provided, and notify the Bank of Slovenia immediately of any breach, identifying the information, the transmitting party, the recipient, the circumstances and the measures taken. Passing BSI-TAJNO or BSI-ZAUPNO information to another recipient must be reported to the central bank, which also consults the original source entity before forwarding information obtained from third parties. Systems processing confidential information must display the classification level to users, and printed extracts may carry a watermark with the date, time, level and recipient.

Declassification and review

BSI-TAJNO and BSI-ZAUPNO documents are as a rule downgraded by one level two years after classification, and BSI-OMEJENO information every six years, down to BSI-NEJAVNO, unless the authorised person expressly refuses the change. Anyone refused access to a document on confidentiality grounds may ask the Bank of Slovenia to lift the classification, a request decided by the authorised person.

The decision reaches well beyond the central bank: banks, auditors, IT suppliers and other counterparties that receive supervisory or operational data will have to align their storage, encryption and subcontracting arrangements with the new tiers before 1 March 2027, when the 2019 rules cease to apply.

Source: Uradni list Republike Slovenije, No. 1672/2026, 15 October 2026, Section I (official reference: 2026-01-2332).