Slovenian IT gets interesting when the same data is simultaneously personal data, health data, archival material and part of a regulated information system. This talk explores the magical combination of ZVDAGA, ZAGOPP, ZInfV-1 and Article 23 of ZVOP-2: what must be preserved, where it may be stored, when its physical location must be known, which security and incident-reporting obligations apply, and what all of this means for modern cloud architectures. Using realistic public-sector and healthcare scenarios, we will follow a single piece of data through the regulatory maze and discover why “legal approved it”, “security approved it” and “the cloud vendor supports it” are three very different statements. And because this is 2026, we will finally ask the obvious question: what happens when somebody decides to feed all of it into AI?