Does Slovak law mention recording employees' calls?

Yes, in terms. The labour code prohibits the employer, without serious reasons resting in the special nature of its activities, from intruding on employee privacy by making recordings of telephone calls conducted using the employer's technical work equipment, without prior notice.

What exactly does the employer owe before starting?

Two separate things in one sentence: consult the employee representatives on the scope of the control, the manner of its execution and its duration, and inform the employees of the same three points. Doing one is not doing the other, and consultation is not agreement.

Is the criminal risk from recording as bad as it sounds?

Narrower than the folklore. The offence needs unlawful capture and disclosure or other use and serious harm to another's rights, all three. The real exposure is civil: recordings of a person's personal expressions may be made or used only with their permission, and no statutory licence covers an employer's test.

Will a Slovak operator block a spoofed number?

It may, not it must. Slovak law says an operator offering caller identification is entitled, in justified cases, to block presentation in order to protect users against fraudulent calls. Latvia's equivalent obliges the operator to stop routing immediately. No Slovak provision prohibits the caller.

Compliance

Voice phishing simulations in Slovakia

Phone numbers in SlovakiaProvisioned by Callstrike after approval

Slovakia's labour code names the recording of employees' telephone calls in terms, so a recorded voice phishing simulation sits inside the provision without having to be argued in from cameras or email. The harder rule is civil rather than labour: a recording of a person's expressions of a personal nature may be made or used only with their permission, and no statutory licence covers a security test. So the decision here is whether you record at all.

Phone numbers

Supplied by Callstrike

Local numbers in Slovakia, after a one-time approval.

Running a simulation

Permitted, and named in the labour code

It is a near-prohibition with a gateway, plus two separate duties in one sentence.

Consent

Two different words, two different jobs

The notice the labour code wants is not the permission the civil code wants for audio.

Getting a phone number in Slovakia

One approval per country, completed in the console.

Provisioned by Callstrike after approval

Numbers here are not released from open inventory. Your workspace is cleared for this country once, and Callstrike then provisions a dedicated number against it for your simulations. Approval is a one-time, per-country step and usually takes 3 to 5 business days. We only ask for what the regulator requires.

Slovakia asks for more rows than its neighbours, and one document carries most of them. The same business registration evidences the company name, the registration number, the registered seat and the business address, which appear as four separate lines on the form rather than one, and the address line will also take a utility bill, a tax notice, a rent receipt or a title deed. Your administrator identifies themselves with a government-issued identity document or a passport, and a power of attorney or equivalent evidence shows they are a director or country manager entitled to act for the company.

Caller identity is the loosest of any country in this region, and that is worth knowing rather than relying on. We searched properly before saying so: the electronic communications act returns nothing for the words for spoofing and for falsification. What exists is a permission addressed to the operator, which is entitled in justified cases to block presentation of the calling line identity in order to protect users against fraudulent calls. The verb is the whole point. Neighbouring Latvia obliges its operators to stop routing the traffic outright; Slovakia leaves it to the operator's own judgement, which means the constraint on you is contractual and discretionary. Use a number your organisation holds and the question does not come up.

01Complete the regulatory clearance formYour administrator, in the Callstrike console. The form asks only for what the regulator requires.
02Approval is granted against your workspaceTypically three to five business days, and once only for as long as you operate here.
03A dedicated number in Slovakia is assigned to youCallstrike
04Build and launch the campaignYour team

What you provide	Accepted evidence, any one of
Name of authorized representative	Government-issued ID, Passport
Authorization of authorized representativeProof that representative is authorized to act on behalf of the company	Power of attorney, Other documentation showing the individual is a director or country manager for the business
Registered seat	Business registration
Business name	Business registration
Business registration number	Business registration
Business address	Business registration showing the local address, Utility bill, Tax notice, Rent receipt, Title deed

These requirements are set by the carrier and can change. The form in the console is generated from their current rules, so treat it as authoritative and this table as a summary of what to have ready. Checked 2026-09-07.

Is it lawful to run a simulation in Slovakia?

The position in short, before your counsel reads the detail below.

Yes, and the marketing rule is not what stands in the way. The Slovak transposition is more explicitly scoped than most, because the qualifier for direct marketing opens each operative paragraph individually rather than sitting once at the top, and the act defines direct marketing as any presentation of goods or services sent or presented through a publicly available service. An internal test presents neither, so it is outside the trigger of each paragraph. The ceiling on that article is unusual enough to note in passing: a fine running from two hundred euros to five per cent of the preceding year's turnover.

The labour code is where the Slovak conditions actually live, and it is unusually direct about the activity. You may not, without serious reasons resting in the special nature of your own activities, intrude upon an employee's privacy at the workplace and in your common premises by monitoring them, by making recordings of telephone calls conducted using your technical work equipment, or by checking work email, without having given prior notice. Where you introduce a control mechanism, you must consult the employee representatives on the scope of the control, the manner of its execution and its duration, and separately inform the employees of the same three things. Programmes routinely do one of those and believe they have done both.

Consultation here is consultation and not agreement, and the act is explicit about the difference. It defines the four modes of employee participation by name, and monitoring attaches to consultation rather than to co-decision. The clause that settles the mode obliges you to take the representatives' positions into account within your possibilities, which is not a veto. One thing the act does not answer, and we are not going to answer it for you, is who the consultation is with where there is no trade union body, no works council and no employee trustee. The duty to inform the employees themselves is unaffected and is owed regardless.

The rule that decides whether you record is civil, and its exceptions are a closed list of three with none of them available. Recordings concerning a natural person, or of their expressions of a personal nature, may be made or used only with that person's permission. Made or used are two separate acts and both are gated. Permission is not required for official purposes on the basis of a statute, for scientific and artistic purposes, and for news reporting, and on the basis of a statute means on the basis of an Act rather than on the basis of your own written authorisation. Whether the prior notice the labour code requires supplies the permission the civil code demands is not resolved anywhere: the two provisions use different words and neither cross-refers. The criminal exposure, by contrast, is much narrower than the folklore, needing unlawful capture and disclosure or other use and serious harm to another's rights, all three together.

What your company needs to do

7 items, in the order you will need them.

Decide whether you need the audio at all, and decide it firstSlovakia-specificThis is the Slovak question and everything else is easier once it is answered. If you do intend to record, take the specific point of whether the labour code notice supplies the civil code permission to Slovak counsel rather than assuming the notice does double duty. A programme designed not to retain audio never reaches the question.
Do both duties, because the sentence imposes twoSlovakia-specificConsult the employee representatives on the scope of the control, the manner of its execution and its duration. Then inform the employees of the same three points. Doing the consultation is not doing the information, and the second duty is owed to the staff themselves whether or not any representative body exists.
Write down the serious reasons resting in the special nature of your activitiesSlovakia-specificThe gateway is not a balancing test and it does not ask about your threat model. It asks what kind of business you are. Draft that statement before the campaign rather than after a question about it, because it is the sentence the whole Slovak position rests on and the one hardest to write afterwards.
Work out who your counterparty is before you plan the consultationSlovakia-specificEmployee participation runs through a trade union body, a works council or an employee trustee, and the monitoring provision simply does not say what happens when none of the three exists. Establish which you have, or that you have none, at the start of the plan rather than a week before the campaign.
Disclose that the voice is generatedThe European transparency duty binds a deployer of a system generating audio constituting a deep fake directly, at the latest at first exposure, and its two carve-outs are authorisation by law for criminal law purposes and evidently artistic work. There is no security-testing exception. The debrief that closes the call is where the disclosure belongs.
Keep the credential out of the systemMeasure the behaviour and discard what the pretext asked for. It shortens the proportionality half of the gateway argument, and it means the material the exercise leaves behind is an outcome record rather than the kind of object the civil code provision is written about.
Score outcomes, not feelingsThe European prohibition on inferring emotions of a person in the workplace has been in force since February 2025 at up to seven per cent of worldwide turnover, gated on inference from biometric data. Counting who complied and who reported the call is outside it. Ranking employees by how frightened they sounded is a fight at that ceiling.

The controls that do the work

How Callstrike is configured, and which provision in Slovakia each choice answers.

Auto-hangup before disclosure

The bot ends the call at the moment an employee starts to give up a credential or a piece of personal data, so the thing the pretext asked for is never spoken into the system and never stored.

Both of the Slovak constraints attach to what the exercise captures rather than to the fact of the call. The civil code provision is written about recordings concerning a natural person or of their expressions of a personal nature; the labour code gateway asks you to justify an intrusion whose size is exactly what you collect. The call ends the instant an employee begins to give up a credential, so what remains is a record that a call happened and what the person did, not a capture of what they said. That is a materially smaller thing to justify, and a materially smaller thing for the civil provision to reach.

In-call debrief and follow-up

A second voice breaks character as soon as the call ends, explains what just happened and why it worked, and a follow-up email repeats it in writing while the moment is still sharp.

The remedies on the civil side are the real ones here, and they are shaped around dignity: an order to desist, removal of the consequences, adequate satisfaction, and where that would not suffice because the person's dignity or standing in society was considerably reduced, monetary compensation the court fixes. A second voice that breaks character as the call ends, and vishing training in writing the same day, is the design that keeps the exercise a long way from that description.

Consent Management

Two modes: collect consent now, over email, Slack or Teams with a full audit trail per employee; or record that your organisation already has this covered, by uploading the policy, handbook clause or agreement and confirming the scope it applies to. The document is hashed, the attestation is signed and timestamped, and an audit email is issued. Included on every plan.

Slovakia uses two different words for two different things and neither of them is a processing ground. The labour code wants notice and consultation; the civil code wants the person's permission before a recording of their personal expressions is made or used. What this produces is the dated evidence that the notice was given and the consultation held, before the campaign rather than assembled after somebody asks, plus a hashed copy of the policy or agreement you are relying on with a signed attestation of the scope it covers.

SCORM module

An interactive web presentation on voice-phishing risk, delivered through your own LMS, which then invites the learner to opt into a web call with the bot. A call the person starts themselves in a browser is not a telephone call, so telephony rules do not reach it.

Where the recording question is one you would rather not answer, this is the delivery that does not raise it. Callstrike's vishing simulator can deliver the same deepfake voice through a web call the learner starts themselves after working through the module. The labour code limb is written about recordings of telephone calls conducted using the employer's technical work equipment, and a session a learner opens in their own browser is neither of those things. Be precise about the limit: it removes the telephone limb, and the civil code provision still governs any audio you choose to keep.

Consent Management is included on every plan. See AI voice phishing simulation and human-in-the-loop voice phishing for how each is delivered.

The sourced position

Everything above, with the instruments behind it. Every claim cites the statute or the regulator it comes from, so your counsel can verify it rather than rely on our summary.

The provision everyone cites is about the mass media

Start with a correction, because getting this wrong feels like getting it right. The Slovak data protection act is cited everywhere for an employee-monitoring rule at a particular section. That section is about something else entirely: it permits a controller to process personal data without consent where the processing is necessary for the purposes of informing the public through the mass media, and where the controller's objects of activity give rise to that, subject to the data subject's rights to protection of personality and privacy.

The trap is that the content usually described alongside that citation is real Slovak law. There genuinely is a rule about serious reasons resting in the special nature of the employer's activity, about consulting employee representatives and about informing employees. It is just in the labour code. A researcher who finds the right rule under the wrong number feels confirmed rather than corrected, which is why we established the negative positively: the phrases for special nature and for employee representatives return nothing across the whole data protection act, in the current text and in the original 2018 text alike, so it was never there to be moved.

What the data protection act does contain about employment is narrow and is a permission to disclose rather than a permission to watch: an employer-controller may provide or publish an employee's title, name, surname, job classification, telephone number, workplace email address and the employer's identification data, where necessary in connection with the performance of work duties.

So the legal basis for a Slovak security test is the Regulation's own, and the domestic conditions come from the labour code provision described in the consultation section below. We searched the data protection authority's site for guidance on employee monitoring and on consent in employment and could not reach any; two obvious paths return errors and the site's index surfaces a methodologies section without document links. Nothing is claimed here about what the Slovak authority says, because we could not read it.

Criminal law is narrower than the folklore, civil law is not

Slovak recording law is misdescribed in two directions at once, and the corrections run opposite ways.

The section numbers usually given for interception are both wrong. One of them is the offence of unauthorised access to a computer system, committed by overcoming a security measure and thereby obtaining unauthorised access. The other is confined to postal items: it reaches a person who intentionally violates the secrecy of a letter by spying out or opening a closed letter or other writing transported by a postal undertaking or in another customary way.

The correct criminal provision is the offence of violating the confidentiality of oral expression and of other expression of a personal nature, and its elements are cumulative rather than alternative. It is committed by a person who violates that confidentiality by unlawfully capturing the words with a recording device, and makes the recording so produced available to a third person or otherwise uses it, and thereby causes another serious harm to their rights. All three limbs, joined by and. Up to two years, rising to between six months and three years where committed as a member of an organised group, causing considerable damage, or with intent to obtain considerable benefit, and to between six months and five years for a public official or damage of large extent.

Read that structure against a simulation whose recordings stay inside the authorised programme. Recording alone does not complete the offence, and neither does recording plus internal use unless serious harm to rights results. The criminal exposure is materially narrower than the section-number folklore suggests.

Then the rule that actually decides the question, and it is civil. Writings of a personal nature, portraits, images, and audio and audio-visual recordings concerning a natural person or their expressions of a personal nature may be made or used only with that person's permission. Made or used: two separate acts, both gated on permission.

Its exceptions are a closed list of three and none of them is available here. Permission is not required where the material is made or used for official purposes on the basis of a statute, nor where it is made or used in an adequate manner for scientific and artistic purposes and for press, film, radio and television news reporting, and even that last use must not conflict with the person's legitimate interests. On the basis of a statute means on the basis of an Act, not on the basis of the employer's own written authorisation, and conflating those two senses of authorised is the same error the European transparency rule invites elsewhere.

The remedies are civil and real: an order to desist from unjustified interference, removal of its consequences, adequate satisfaction, and where satisfaction would not suffice, in particular because the person's dignity or standing in society was considerably reduced, monetary compensation for non-pecuniary harm in an amount the court determines.

One question we are leaving open because nothing in either instrument answers it: whether the prior notice the labour code requires supplies the permission the civil code demands. The two provisions use different words and neither cross-refers to the other. A Slovak programme that intends to record should take that specific point to Slovak counsel rather than assume the notice does double duty.

Every operative sentence opens with the words for direct marketing

The Slovak transposition of the European rule on unsolicited communications is more explicitly scoped than most, because the qualifier opens each operative paragraph individually rather than sitting once at the top.

Direct marketing is defined in the act itself as any form of presentation of goods or services, in written or oral form, sent or presented through a publicly available service directly to one or more subscribers or users, including obtaining information about goods and services from them. For the purposes of direct marketing, the use of automatic calling and communication systems without human intervention, fax, electronic mail and text and multimedia messages is permitted only with the person's prior demonstrable consent obtained before contacting them. For the purpose of obtaining that prior consent, calling and the use of such systems is itself prohibited, which closes the loop that would otherwise let a marketer call to ask permission to call. And for the purposes of direct marketing, any call is prohibited where the subscriber has entered the number on the objection list.

An internal security test presents no goods or services, so it is outside the trigger of each of those paragraphs. That is a reading of the definition rather than advice, and it is the same reading the definition compels in every European country in this cluster.

The penalty is worth knowing because of its ceiling. The regulator imposes, on a legal person or a natural-person entrepreneur that breaches the relevant paragraphs, a fine from two hundred euros to five per cent of turnover for the preceding accounting period. A percentage-of-turnover ceiling on a marketing-calls provision is unusual.

Article 50 of the EU AI Act applies here directly, with no Slovak instrument in between. Since 2 August 2026 a provider must design a system intended to interact directly with people so that they are informed they are interacting with an AI system, and a deployer of a system generating or manipulating audio constituting a deep fake must disclose that the content is artificially generated, in each case at the latest at the first interaction or exposure. Its two carve-outs are authorisation by law for criminal law purposes, and evidently artistic work which merely limits rather than removes the duty. There is no security-testing exception.

The other provision to read before shipping analytics is the prohibition on using AI systems to infer emotions of a natural person in the workplace, in force since 2 February 2025 at up to thirty-five million euros or seven per cent of worldwide turnover. Its exception for medical or safety reasons uses a phrase that appears exactly once in the whole Regulation, inside the exception itself, and is defined nowhere. What gates the prohibition is the definition of an emotion recognition system, confined to inference from biometric data, and the definition of biometric data reaches physical, physiological or behavioural characteristics on a non-exhaustive list. Whether inferring a caller's stress from call audio is inside that gate is not resolved by the operative text, and if it is inside, it is prohibited outright rather than merely high-risk.

We could not establish that Slovakia has designated a national authority under that Regulation in binding law. No enacted instrument was located, a secondary tracker refers to draft legislation under which a digital-integrity office would take the role, and drafts are not law. Reported as not established rather than as absent.

The operator may block you, and nothing says you may not try

Slovakia has no rule against presenting a number you do not hold, and we searched for one properly before saying so. The electronic communications act returns nothing for the words for spoofing and for falsification, and every hit for calling line identification and for the numbering plan was read individually.

What exists is a permission addressed to the operator rather than a prohibition addressed to the caller. Where an undertaking offers the calling line identification presentation service, it is entitled, in justified cases, to block presentation of the calling line identity for the purpose of protecting users against fraudulent calls.

The choice of verb is the whole point, and it is the sharpest contrast with Latvia in this pair of countries. Slovakia says the operator is entitled to block. Latvia's regulator says the operator shall immediately stop routing the traffic once fraud is established. Same European framework, same year, opposite operational consequence for a campaign that presents a number it does not hold.

A second duty runs alongside and is worth knowing because it involves the police. Undertakings must cooperate with the police force and with the authorities active in criminal proceedings in detecting fraudulent calls, malicious calls and the spreading of false alarms, and must for that purpose supply information about the network from which a fraudulent call was received into the undertaking's network.

Underneath sits the ordinary numbering machinery: the regulator compiles, issues and administers the national numbering plan, which is laid down by a generally binding legal regulation it issues, and individual rights of use are granted by individual authorisation. We found no provision making it an offence for a caller to present a number outside its own rights of use, and we are reporting that as not established rather than inferring a prohibition from the administration provisions.

Practically, that means the Slovak constraint on caller identity is contractual and discretionary rather than statutory. Your originating operator decides. Use a number you hold and the question does not arise.

Zákon č. 452/2021 Z. z. o elektronických komunikáciách, §§ 114, 116, 117 and 124 (effective 18.08.2026)

What the country matrix holds for Slovakia

Number types:: Local
Restricted for automated outbound:: None recorded

Generated from the same country matrix the platform enforces at dispatch, so it cannot drift from what you can actually buy.

A statute that names your product, and two duties in one sentence

This is the section that decides a Slovak programme, and the provision is unusually direct about the activity.

The employer may not, without serious reasons resting in the special nature of the employer's activities, intrude upon the employee's privacy at the workplace and in the employer's common premises by monitoring the employee, by making recordings of telephone calls conducted using the employer's technical work equipment, and by checking electronic mail sent from and delivered to a work email address, without having given the employee prior notice of this. If the employer introduces a control mechanism, it is obliged to consult with the employee representatives the scope of the control, the manner of its execution and its duration, and to inform the employees of the scope, the manner and the duration.

Three things follow and they are worth separating. First, the recording of employees' telephone calls is named in the text, so a recorded simulation is inside the provision on its face and does not have to be argued in by analogy from cameras or email, which is how most European monitoring provisions have to be handled. Second, the gateway is not a balancing test: the default is that the employer may not do it, and the gateway asks for serious reasons resting in the special nature of the employer's own activities, which points at what kind of business the employer is rather than at how good the threat model looks. Third, the sentence imposes two distinct duties, and programmes routinely do one and think they have done both.

The consultation duty is consultation and not agreement, and the act defines both. Consultation is an exchange of views and dialogue between the employee representatives and the employer, carried out in a comprehensible manner and at an appropriate time, with adequate content and with the aim of reaching an agreement unless a special regulation provides otherwise. Informing is the provision of data by the employer to the representatives for the purpose of their becoming acquainted with its content. The clause that settles the mode is the one requiring the employer to provide the necessary information, consultations and documents and to take the representatives' positions into account within its possibilities. Within its possibilities is not a veto.

The act sets out the four modes of employee participation and names them: co-decision, consultation, the right to information, and supervisory activity. Monitoring attaches to consultation, not to co-decision. That distinction is on the face of the statute and should not be blurred either way.

One thing the act does not answer, and we are not going to answer it for you: what happens where the employer has no trade union body, no works council and no employee trustee. The participation article contemplates employees participating directly or through one of those three, and the monitoring provision simply does not say who the consultation is with when none exists. The information duty to employees is unaffected and is owed regardless.

Zákonník práce (311/2001 Z. z.), § 13 ods. 4 and §§ 229, 237, 238 (time-version effective 01.09.2026)

Zero for testing, zero for exercises, and the detail is delegated

Slovakia transposed the European network and information security directive by amending its 2018 cybersecurity act with effect from 1 January 2025, which is after the European deadline of October 2024. The act has been amended twice more since, most recently with effect from April 2026, so the text to read is the current time-version.

The term counts here are the starkest in this cluster and they are worth stating in full. Across the consolidated Slovak text: phishing zero, social engineering zero, simulation zero, imitation zero, and testing zero in any form. Training in the sense of a course returns zero and exercise returns zero as well; what does appear is education, six times, and awareness, five times. As a sanity check on the extraction, the word cybersecurity itself appears four hundred and one times in the same file, so the zeros are real zeros rather than a truncated fetch.

So nothing in the Slovak cybersecurity act mandates, mentions or contemplates a vishing simulation, or any simulation, exercise or test at all. What exists is education and the building of security awareness in the field of cybersecurity.

One gap is worth naming because it is the most consequential thing we could not close. The act itself delegates the detail of education and the building of security awareness to an implementing decree of the national security authority, and we did not count that decree through. The act's zeros are established. The decree's are not, and if a control requiring simulated phishing exists anywhere in the Slovak regime, that decree is the only place left it could be.

For financial entities the act defers explicitly to the European digital operational resilience Regulation, providing that where an operator of an essential service is a supervised financial market entity supervised by the national bank or by the European Central Bank, the competent-authority duties under that Regulation are discharged accordingly. The Regulation requires compulsory awareness and resilience training modules for all employees and senior management, and threat-led penetration testing on live production systems for identified entities, and names neither phishing nor social engineering anywhere in its text.

Take this further

Research prompt for your own AI assistant

Paste into Claude, Harvey or your firm's tool to pressure-test the position above.

You are advising on an authorised internal security exercise in SLOVAKIA. Our own employees receive a simulated voice-phishing call, placed by our vendor on our instruction, to measure susceptibility. No credential is captured or stored. The workforce is informed in advance at the programme level.

Verify or correct each proposition below against primary Slovak sources, and tell me specifically whether we may record the calls:

1. ⚠⚠ The employee-monitoring rule is ZÁKONNÍK PRÁCE § 13 ods. 4, NOT zákon č. 18/2018 Z. z. § 78(2) (which is about «informovania verejnosti masovokomunikačnými prostriedkami»). Confirm, and confirm § 13(4) names «záznam telefonických hovorov» expressly.
2. § 13(4) imposes TWO duties: prerokovať with the employee representatives the scope, manner and duration, AND informovať the employees of the same three. Confirm both, and confirm consultation is not agreement (§§ 229, 237, 238; «v rámci svojich možností»).
3. What happens under § 13(4) where there is NO trade union body, works council or employee trustee? Is the consultation duty simply unaddressed?
4. ⚠⚠ Občiansky zákonník § 12(1): recordings of a natural person or of «prejavy osobnej povahy» may be «vyhotovené alebo použité len s jej privolením», with three licences in § 12(2) and (3). Does the § 13(4) notice supply privolenie? Supply Slovak case law or doctrine either way.
5. ⚠ The criminal provision is Trestný zákon § 377 (not § 247, which is unauthorised computer access, nor § 196, which is postal). Its elements are CONJUNCTIVE: unlawful capture AND disclosure or other use AND «vážnu ujmu na právach». Confirm.
6. Zákon č. 452/2021 Z. z. § 116 scopes each operative paragraph to «priamy marketing», so an internal test is outside it.
7. ⚠ § 114(4) is an operator PERMISSION («je oprávnený» to block), not a prohibition on the caller. Is there any Slovak provision prohibiting a caller from presenting a number outside its own rights of use?
8. AI Act Art 50 binds us directly as deployer. Has Slovakia designated a national authority in ENACTED law yet, or is it still a draft on the digital-integrity office?
9. ⚠ THE GAP WE COULD NOT CLOSE: zákon č. 69/2018 Z. z. delegates «podrobnosti o vzdelávaní a budovaní bezpečnostného povedomia» to an NBÚ vyhláška. Count that decree for simulated phishing or social-engineering testing; the act's own count is zero.

Flag anything that has changed since September 2026, and identify any obligation in our own kolektívna zmluva that this analysis omits.

Common questions

Does Slovak law mention recording employees' calls?: Yes, in terms. The labour code prohibits the employer, without serious reasons resting in the special nature of its activities, from intruding on employee privacy by making recordings of telephone calls conducted using the employer's technical work equipment, without prior notice.
What exactly does the employer owe before starting?: Two separate things in one sentence: consult the employee representatives on the scope of the control, the manner of its execution and its duration, and inform the employees of the same three points. Doing one is not doing the other, and consultation is not agreement.
Is the criminal risk from recording as bad as it sounds?: Narrower than the folklore. The offence needs unlawful capture and disclosure or other use and serious harm to another's rights, all three. The real exposure is civil: recordings of a person's personal expressions may be made or used only with their permission, and no statutory licence covers an employer's test.
Will a Slovak operator block a spoofed number?: It may, not it must. Slovak law says an operator offering caller identification is entitled, in justified cases, to block presentation in order to protect users against fraudulent calls. Latvia's equivalent obliges the operator to stop routing immediately. No Slovak provision prohibits the caller.

Elsewhere in Central and Eastern Europe

The rules differ by country even inside one region. These are the nearest guides to this one, each showing how phone numbers are obtained there.