Czech Republic

Regulator And AuthorityGreen

ÚOOÚ, seated at Pplk. Sochora 27, Prague 7, is the Czech GDPR supervisory authority and a voting member of the EDPB.

Claims (1):

• The Office for Personal Data Protection (ÚOOÚ), seated at Pplk. Sochora 27, Prague 7, is the Czech Republic's GDPR supervisory authority and a full voting member of the European Data Protection Board.

Act And InstrumentsGreen

Act No. 110/2019 Coll. is the core national instrument; it replaced the prior Data Protection Act and transposes the Law Enforcement Directive.

Claims (1):

• Act No. 110/2019 Coll. on Personal Data Processing fully replaces the prior Czech Data Protection Act, establishes the constitution and powers of the Czech Data Protection Office, and transposes Directive (EU) 2016/680 governing processing of personal data for crime prevention/investigation and defense/security purposes.

Material ScopeGreen

The Act carries local derogations mainly benefiting public authorities and triggered amendment of over 30 other Czech statutes.

Claims (1):

• The Data Protection Act includes local derogations and exceptions primarily for public authorities, and its Accompanying Act amends more than 30 other Czech laws in connection with GDPR and Directive 2016/680 implementation.

Territorial ScopeGreen

GDPR's extraterritorial rule (targeting/monitoring of EU data subjects) applies directly to non-EU controllers vis-à-vis Czech data subjects.

Claims (1):

• Companies not established in the EU must comply with GDPR rules, including as applied by Czech supervisory authority, when they offer goods/services to or monitor the behaviour of individuals in the EU.

Regulator Registration And FilingAmber

No general controller registration/notification-fee regime (analogous to the UK ICO fee system) was identified for Czech Republic in this research pass; GDPR abolished the EU-wide prior-notification requirement that existed under the pre-2018 regime.

Claims (1):

• No distinct Czech controller-registration or filing-fee regime was confirmed in this research pass; GDPR's harmonised approach removed the general prior-notification obligation that existed under the pre-2018 Czech data protection regime.

Lawful BasesGreen

GDPR Article 6's enumerated lawful bases apply directly, EU-wide, without a substitute Czech list.

Claims (1):

• GDPR establishes a single EU-wide rulebook for data protection, including its Article 6 lawful bases, applicable directly and uniformly in the Czech Republic as an EU Member State.

Consent ThresholdsGreen

ÚOOÚ has issued national guidance on GDPR-compliant consent, emphasising clear, distinguishable, plain-language requests and the Article 7(4) bundling test.

Claims (1):

• ÚOOÚ guidance issued in March 2018 requires that requests for consent be presented in a manner clearly distinguishable from other matters, in intelligible and easily accessible form using clear and plain language, and highlights GDPR Article 7(4) on whether consent is improperly bundled with contract performance.

Special CategoriesAmber

No Czech-specific derogation to GDPR Article 9 special-category rules was identified in this research pass; Article 9 is presumed to apply directly.

Claims (1):

• GDPR Article 9's special-category regime (health, biometric, genetic, ethnic, political, sexual, criminal data) is presumed to apply directly in Czech Republic absent an identified national derogation.

Pseudonymisation And AnonymisationGreen

GDPR's technology-neutral safe-harbours (pseudonymisation, encryption) apply directly in Czech Republic as an EU Member State.

Claims (1):

• GDPR promotes privacy-enhancing techniques such as pseudonymisation (replacing identifying fields with identification codes) and encryption as recognised safeguards, applicable directly in the Czech Republic.

Access RightGreen

GDPR governs the subject-access request framework directly in Czechia.

Claims (1):

• The General Data Protection Regulation governs data subject rights in Czechia, directly conferring rights of access, rectification, erasure, restriction, objection and portability, as supplemented by Act No. 110/2019 Coll. on Personal Data Processing.

Rectification And ErasureGreen

GDPR's rectification/erasure rights apply directly; no CZ-specific derogation identified beyond the Title III carve-out.

Claims (1):

• The General Data Protection Regulation governs data subject rights in Czechia, directly conferring rights of access, rectification, erasure, restriction, objection and portability, as supplemented by Act No. 110/2019 Coll. on Personal Data Processing.

Restriction And ObjectionGreen

GDPR's restriction and objection rights (including profiling opt-out) apply directly in Czechia.

Claims (1):

• The General Data Protection Regulation governs data subject rights in Czechia, directly conferring rights of access, rectification, erasure, restriction, objection and portability, as supplemented by Act No. 110/2019 Coll. on Personal Data Processing.

Data PortabilityAmber

GDPR's portability right applies directly; no distinct Czech implementation detail was separately verified.

Claims (1):

• The General Data Protection Regulation governs data subject rights in Czechia, directly conferring rights of access, rectification, erasure, restriction, objection and portability, as supplemented by Act No. 110/2019 Coll. on Personal Data Processing.

Deadlines And Response WindowsGreen

Title III of Act No. 110/2019 Coll. restricts ordinary data-subject-rights deadlines/response obligations for criminal-matters and national-security processing by competent authorities.

Claims (1):

• Title III of Act No. 110/2019 Coll. governs the processing of personal data in relation to criminal matters and national security by competent Czech public authorities and provides restrictions on the rights of data subjects in that context.

Accountability And DpiaGreen

Section 10 of Act No. 110/2019 Coll. introduces a 'legislative DPIA' for all legislative proposals affecting personal data, effective 1 April 2023, replacing the standard Article 35 DPIA for that measure.

Claims (1):

• Since 1 April 2023, Section 10 of Act No. 110/2019 Coll. requires a 'legislative DPIA' for every legislative proposal, including subsidiary regulations such as government decrees or ordinances, which under GDPR Article 35(10) replaces the standard Article 35(1) DPIA for that specific legislative measure.

Dpo RequirementsGreen

Sections 14 and 16(1)(d) of Act No. 110/2019 Coll., alongside GDPR Arts 37-39, govern DPO appointment; ÚOOÚ requires email notification of DPO appointments with controller and DPO contact details.

Claims (1):

• Sections 14 and 16(1)(d) of Act No. 110/2019 Coll., read with GDPR Articles 37-39, govern DPO appointment in the Czech Republic; ÚOOÚ requires notification of DPO appointments by the controller/processor (not the DPO), including the DPO's contact details.

Ropa RequirementsAmber

GDPR Article 30 ROPA obligations apply directly; no CZ-specific derogation identified in this pass.

Joint Controller ArrangementsAmber

GDPR Article 26 joint-controller rules apply directly; no CZ-specific derogation identified.

Security MeasuresAmber

GDPR Article 32 security-of-processing obligations apply directly; no CZ-specific technical standard was separately verified.

Breach NotificationGreen

ÚOOÚ operates an active breach-notification regime; in 2019 it recorded 416 personal-data-breach notifications.

Claims (1):

• ÚOOÚ's 2019 annual report recorded 2,600 queries, 2,482 complaints, and 416 notifications of personal data breaches, evidencing an operative breach-notification regime.

Retention And DisposalAmber

GDPR's storage-limitation principle applies directly; no CZ-specific retention schedule was identified in this pass.

Transfer MechanismsGreen

GDPR offers a modern toolkit for international transfers — adequacy decisions, SCCs, BCRs, codes of conduct and certification — applicable directly in Czech Republic.

Claims (1):

• GDPR offers a modern toolkit for international data transfers outside the EU, including European Commission adequacy decisions, pre-approved standard contractual clauses, binding corporate rules, codes of conduct and certification, all directly applicable in the Czech Republic.

Adequacy ReceivedGreen

Adequacy is an EU-Commission-level competence; Czech Republic does not operate a separate national adequacy-reception process.

Claims (1):

• Adequacy decisions under GDPR Article 45 are adopted by the European Commission and apply uniformly across all EU Member States, including the Czech Republic, without a separate Czech national adequacy process.

Adequacy GrantedGreen

Adequacy decisions granted to third countries are adopted at EU-Commission level and apply uniformly across all Member States including Czech Republic; no separate CZ national adequacy-granting process exists.

Claims (1):

• Adequacy decisions under GDPR Article 45 are adopted by the European Commission and apply uniformly across all EU Member States, including the Czech Republic, without a separate Czech national adequacy process.

Sccs And BcrsGreen

SCCs and BCRs are available as GDPR transfer mechanisms directly applicable in Czech Republic.

Claims (1):

• GDPR offers a modern toolkit for international data transfers outside the EU, including European Commission adequacy decisions, pre-approved standard contractual clauses, binding corporate rules, codes of conduct and certification, all directly applicable in the Czech Republic.

Transfer Impact AssessmentAmber

The EU-wide post-Schrems II transfer-impact-assessment expectation is presumed to apply in Czech Republic; not separately confirmed via CZ-specific ÚOOÚ guidance in this pass.

Data LocalisationAmber

No CZ-specific data-localisation mandate was identified in this research pass.

Financial Sector OverlayRed

No dedicated Czech financial-sector data-protection overlay was identified in this pass beyond direct GDPR application.

Health Sector OverlayRed

No dedicated Czech health-sector data-protection overlay was identified in this pass beyond direct GDPR application.

Telecoms And EprivacyGreen

The Electronic Communications Act, as amended, requires opt-in cookie consent and was subject to 2022 ÚOOÚ compliance checks; it was also amended in consultations to transpose the EU Electronic Communications Code.

Claims (2):

• The Czech Electronic Communications Act (Act No. 127/2005 Coll.), as amended by Act No. 374/2021 Coll., requires opt-in consent for cookies, and ÚOOÚ's 2022 control plan specifically targeted compliance checks on this opt-in cookie-consent requirement.
• ÚOOÚ participated in 2020 consultations to amend the Electronic Communications Act transposing the European Electronic Communications Code (Directive (EU) 2018/1972) and proposed a Criminal Code amendment criminalising misuse of personal data.

Employment DataRed

No dedicated Czech employment-data sectoral overlay was identified in this pass beyond direct GDPR application.

Credit And ScoringRed

No dedicated Czech credit-scoring sectoral overlay was identified in this pass.

EducationRed

No dedicated Czech education-sector data-protection overlay was identified in this pass.

InsuranceRed

No dedicated Czech insurance-sector data-protection overlay was identified in this pass.

Cookies And TrackersAmber

Opt-in cookie consent is required under the amended Electronic Communications Act; ÚOOÚ has also published cookie-consent FAQ guidance (content not independently verified in this pass).

Claims (1):

• The Czech Electronic Communications Act (Act No. 127/2005 Coll.), as amended by Act No. 374/2021 Coll., requires opt-in consent for cookies, and ÚOOÚ's 2022 control plan specifically targeted compliance checks on this opt-in cookie-consent requirement.

Dark PatternsRed

No dedicated Czech dark-pattern prohibition distinct from GDPR fairness/transparency principles was identified.

Opt Out SignalsRed

No Czech-specific recognition of technical opt-out signals (e.g., GPC) was identified in this pass.

Clean Rooms And DcrRed

No Czech-specific clean-room/data-collaboration-room rules were identified.

Cross Context AdvertisingRed

The CPRA 'sale'/'share' concept is a US state-law construct with no direct Czech/GDPR equivalent; GDPR's consent/legitimate-interest framework applies instead.

Direct MarketingGreen

Act No. 480/2004 Coll. governs unsolicited commercial electronic communications, enforced by ÚOOÚ; this remains one of the most common complaint categories.

Claims (1):

• Under Act No. 480/2004 Coll. on Certain Information Society Services, ÚOOÚ monitors and enforces against unsolicited commercial electronic communications; in 2022 there were 906 complaints about such communications, a very similar figure to 2021, making it one of the most common complaint categories after personal-data-security breaches.

Profiling RestrictionsAmber

GDPR Article 22 profiling restrictions apply directly in Czech Republic as an EU Member State.

Claims (1):

• GDPR's single EU rulebook, including its Article 22 restrictions on solely-automated decision-making with legal or similarly significant effects, applies directly and uniformly in the Czech Republic.

Automated Decision Making TransparencyAmber

GDPR Article 22 ADM transparency/explanation rights apply directly; no CZ-specific elaboration was separately confirmed.

Claims (1):

• GDPR's single EU rulebook, including its Article 22 restrictions on solely-automated decision-making with legal or similarly significant effects, applies directly and uniformly in the Czech Republic.

Ai Risk AssessmentsAmber

The EU-level Digital Omnibus Regulation proposal, which intersects with GDPR personal-data and profiling concepts, remains in the EU legislative process as of mid-2026, with no binding Czech-specific AI-risk-assessment obligation confirmed yet.

Claims (1):

• As of mid-2026, the EU's Digital Omnibus Regulation proposal — which intersects with GDPR concepts including personal data and profiling — remains in the EU legislative process, with potential future implications for AI-governance obligations applicable to Czech controllers.

Biometric RegimeGreen

ÚOOÚ has flagged systematic supervisory attention to biometric data and CCTV systems as a recurring priority.

Claims (1):

• ÚOOÚ's 2019 annual report states the Office has paid systematic attention to the use of biometric data and CCTV systems, among other supervisory priorities.

Genetic DataRed

No Czech-specific genetic-data regime distinct from GDPR Article 9 was identified in this pass.

State Surveillance CarveoutsGreen

Act No. 110/2019 Coll. Title III, transposing Directive (EU) 2016/680, establishes a distinct regime with restricted data-subject rights for law-enforcement and national-security processing.

Claims (1):

• Act No. 110/2019 Coll. transposes Directive (EU) 2016/680, establishing a separate Title III regime for processing of personal data by competent Czech authorities for prevention, investigation, detection or prosecution of criminal offences and for national defense/security, restricting ordinary data-subject rights in that context.

Age VerificationAmber

No distinct Czech age-verification mechanism/standard was identified in this research pass beyond the GDPR Article 8 age threshold.

Parental ConsentGreen

The age of consent for a child's own consent to information-society-service processing is set at 15 years under the Czech GDPR-implementing legislation, following rejection of a proposal to lower it to 13.

Claims (1):

• The Czech GDPR-implementing legislative process set the age of a child's own valid consent for information-society-service data processing at 15 years, following parliamentary rejection of a proposal to lower this threshold to 13.

Minor Profiling BansRed

No Czech-specific minor-profiling ban distinct from GDPR general principles was identified.

Education SettingsRed

No Czech education-setting-specific data-protection rule was identified in this pass.

Dependent AdultsRed

No Czech-specific dependent-adult data-protection provision was identified in this pass.

Regulator Powers And PenaltiesGreen

Act No. 110/2019 Coll. abolished fines for public authorities/bodies and permits ÚOOÚ to drop minor offenses informally.

Claims (1):

• Act No. 110/2019 Coll. abolished administrative fines for all public authorities and bodies (governmental bodies, ministries, municipalities, schools, public hospitals and similar public-interest controllers/processors), and empowers ÚOOÚ to drop minor offenses without initiating formal proceedings and without notifying the person concerned.

Enforcement Activity IndexGreen

The Avast case (EUR ~13.9M fine, April 2024 appellate decision) is the standout recent CZ enforcement action; complaint volumes run in the low thousands annually.

Claims (1):

• In the Avast antivirus case, the Czech supervisory authority, acting as Lead Supervisory Authority, issued an administrative appellate decision on 10 April 2024 imposing a fine of approximately EUR 13.9 million for infringement of GDPR Articles 6 and 13, concerning the transfer of pseudonymized browsing-history data of roughly 100 million users to a sister company without a valid legal basis, while misinforming users that the data were anonymized.

Regulator Funding And CapacityAmber

ÚOOÚ's 2025 annual report notes growing strain on its workforce due to increasing case complexity.

Claims (1):

• In its 2025 annual report, ÚOOÚ noted growing strain on its workforce due to the increasing complexity of cases handled.

Collective Redress And Class ActionsRed

No Czech-specific collective-redress/class-action mechanism for data protection claims was identified in this pass.

Private Right Of ActionAmber

GDPR Articles 79 and 82 grant a direct judicial-remedy and compensation right, applicable in Czech Republic as directly-effective EU law.

Claims (1):

• GDPR Articles 79 and 82 grant data subjects in the Czech Republic a direct right to an effective judicial remedy against controllers/processors and a right to compensation for material or non-material damage, applicable directly as EU Regulation provisions.

Recent Developments 180DGreen

An IAPP analysis published 28 May 2026 reports ÚOOÚ's 2025 annual report noting workforce strain, situating Czech trends within record European DPA fines and breach-notification volumes around GDPR's 10th anniversary.

Claims (1):

• An IAPP analysis published 28 May 2026 reports that ÚOOÚ's 2025 annual report highlighted growing workforce strain from increasingly complex cases, situating Czech enforcement trends within the broader wave of record European DPA fines and breach-notification volumes reported around GDPR's tenth anniversary in May 2026.