Czech Republic Data Protection & Privacy Regulation

Sectoral Watch

The European Union's Data Act establishes an access-by-design duty requiring manufacturers and providers of connected products to make the data those products generate accessible to users by design and by default. This duty, found in Regulation (EU) 2023/2854, is directly applicable European law and has applied in the Czech Republic, as everywhere else in the Union, since 12 September 2026. What has not yet materialised is the Czech national legislation intended to fix the penalty and enforcement regime for breaches of this duty. As of the sources reviewed, that implementing legislation remained unadopted despite the transposition deadline having already elapsed, leaving a confirmed gap between a binding substantive obligation and the national machinery that would give it enforcement teeth.

This gap is structurally significant rather than merely administrative. The underlying duty binds connected-product manufacturers and providers directly, regardless of whether Czech penalty legislation exists, because the Data Act is a directly applicable regulation rather than a directive requiring transposition for its substantive content to take effect. What the missing national legislation would supply is the penalty and enforcement framework specific to the Czech jurisdiction, the mechanism by which breaches of the access-by-design duty would actually be sanctioned domestically. Until that legislation is adopted, the practical enforcement pathway for Data Act breaches in the Czech Republic remains less defined than the underlying duty itself.

For operators of connected products sold or operated in the Czech market, this means the substantive compliance obligation is already live and already binding, even though the domestic penalty architecture that would attach to non-compliance has not yet been finalised. This is not a basis for treating the obligation as unenforceable; European-level enforcement mechanisms and the general applicability of the regulation remain in place regardless of the national penalty-legislation gap. It does mean that the specific Czech penalty figures and enforcement procedure that would apply to a breach occurring in this jurisdiction cannot yet be stated with confidence, because that legislation has not been finalised.

Outlook

Resolution of this gap depends on the Czech legislative process completing adoption of the implementing and penalty legislation for the Data Act's access-by-design duty, with current indications pointing toward resolution in the first quarter of 2027, though this remains an estimate rather than a confirmed date. Until that legislation is adopted, connected-product manufacturers and providers operating in the Czech market face a substantive duty that is already binding under directly applicable European law, paired with a domestic enforcement and penalty framework that has not yet caught up to that duty's effective date.

Algorithmic, Biometric & Surveillance Governance

The European Union's AI Act high-risk requirements became directly enforceable across the Czech Republic, as across the rest of the Union, from 2 August 2026. The Czech national instrument intended to operationalise this regime domestically, referred to as the Adaptation Act, would formally designate the Office for Personal Data Protection, the Czech Telecommunication Office, and the Czech National Bank in their respective supervisory and enforcement roles under the AI Act, and would establish regulatory sandbox arrangements along with sanction rules for compliance failures. As re-verified, that Adaptation Act remains in draft form, with no confirmed enactment date identified.

The structural shape of this gap mirrors the one affecting connected-product data-access duties: a European-level substantive obligation, in this case the AI Act's high-risk system requirements, is already directly enforceable, while the national legislation that would clarify which domestic authority holds which enforcement power, and under what sandbox or sanction terms, has not yet been finalised. For high-risk-AI operators in the Czech Republic, the practical consequence is that compliance obligations under the AI Act itself are not in question, but the specific domestic institutional architecture, which body enforces what, under which sandbox provisions, and with what sanction exposure, remains unsettled pending the Adaptation Act's enactment.

The naming of the Czech National Bank among the authorities that would receive a formal AI Act role under the draft Adaptation Act is a detail with particular relevance to financial-sector AI governance: it signals an intended division of supervisory labour between data-protection, telecommunications, and financial-sector regulators for AI systems used in or adjacent to financial services, but that division remains provisional and unconfirmed while the Adaptation Act sits in draft. Operators of high-risk AI systems in financial services should accordingly treat the question of which specific Czech authority will exercise enforcement powers over their systems as currently unresolved, notwithstanding the underlying AI Act obligations already being in force.

Outlook

The Adaptation Act's path to enactment remains unconfirmed, with current indications pointing toward possible resolution in the first quarter of 2027, though this is an estimate rather than a settled date. Until the Adaptation Act is enacted, the designated roles of the Office for Personal Data Protection, the Czech Telecommunication Office, and the Czech National Bank under the AI Act remain in draft form rather than settled law, and high-risk-AI operators in the Czech Republic should expect continued uncertainty over the precise domestic enforcement architecture even as the underlying European obligations remain fully binding.

Enforcement & Redress

ÚOOÚ's enforcement record remains anchored by its largest fine to date, a CZK 351 million penalty imposed on Avast Software s.r.o. for unauthorised processing and transfer of antivirus and browser-extension user data. The decision is final, and given the cross-border nature of Avast's processing it was handled through the EU One-Stop-Shop cooperation mechanism, which coordinates enforcement across the supervisory authorities of the member states where the controller's processing has effect. This fine continues to stand as the high-water mark of Czech GDPR enforcement, and no larger or comparable penalty was identified this cycle.

Separately, a Czech court corrected the authority's reasoning in a case concerning the adequacy of security measures. The court found that ÚOOÚ had focused too narrowly on the hashing algorithm used by the controller and on a general assessment of that algorithm, without adequately weighing the broader security context in which it was deployed, the technological standards prevailing at the relevant time, or the specific risk profile of the processing activity at issue. This is reported as a correction of the authority's analytical approach to assessing technical security measures under Article 32 GDPR, though the exact court, its level, and the date of the ruling were not confirmed in the material reaching this cycle; it is attributed via secondary commentary rather than a primary judicial source.

The statutory basis for ÚOOÚ's fining power remains Section 62 of Act No. 110/2019 Sb., the national procedural implementing provision giving effect to the two-tier fine caps set directly by Article 83(4) to (6) of the GDPR: a lower tier capped at the higher of EUR 10 million or 2 percent of annual worldwide turnover, and an upper tier capped at the higher of EUR 20 million or 4 percent of annual worldwide turnover, both converted to Czech crowns for domestic application. No amendment to this provision was identified this cycle.

At the EU level, the European Data Protection Board has approved a harmonised methodology for the calculation of administrative fines and has adopted guidelines on the interplay between the Digital Services Act and the GDPR, as reported via ÚOOÚ's own newsroom. This is a standing convergence development affecting how national authorities, including ÚOOÚ, approach fine calculation going forward, though no domestic Czech instrument implementing or responding to it was identified this cycle.

Outlook

Confirmation of the court, its level, and the date of the ruling in the hashing-algorithm security-measures case would allow a fuller assessment of how binding or persuasive that correction is for ÚOOÚ's future enforcement practice. The EDPB's harmonised fining methodology is worth watching for whether it produces a visible shift in the size or structure of future ÚOOÚ penalties relative to the Avast benchmark.

Enforcement & Redress

The Avast Software s.r.o. GDPR enforcement matter has progressed at the appellate level. In a judgment dated 30 September 2025, in case 5 A 56/2024, the Prague Municipal Court annulled the fine imposed on Avast as to the amount, a fine reported at CZK 351 million (approximately EUR 13.9 million) over unlawful data transfers to Jumpshot, while upholding the underlying finding of liability. The case is now on cassation before the Supreme Administrative Court, and a successful cassation outcome on the amount issue could see the matter return to the ÚOOÚ for the fine to be re-quantified. The precise current procedural status of the cassation, including whether a hearing or decision date has been set, was not confirmed in evidence available this cycle.

Outlook

The Supreme Administrative Court's disposition of the cassation is the development to track. If the court affirms the Municipal Court's annulment of the fine amount while the liability finding stands, the matter would most likely return to the ÚOOÚ for re-quantification, which would itself constitute a further dated development in this enforcement history.