---
title: "Czech Republic Data Protection & Privacy Regulation | Data Protection Monitor"
canonical: https://dataprotection.gi/jurisdictions/czech-republic/
source_html: /jurisdictions/czech-republic/index.html
description: "Czech Republic data protection and privacy regulation: 10 categories, 56 claims, updated 2026-10-25."
generated_at: 2026-11-07T14:58:19Z
content_sha256: 6ee4fcae08e2d86048f5c4ad5a6f106ffa1e8ce64a4697f05fb8026718a2c409
generator: "fe-fleet/md-twin@1.0"
---
# Czech Republic Data Protection & Privacy Regulation

schema gdpri-v2
trajectory: not yet assessed regulated (omnibus) overlaps: artificial-intelligence

Last updated 2026-10-25 · 10 categories · 56
claims · 34 sources in the cumulative register

Download report (PDF) Expand all

The Czech data-protection authority, the ÚOOÚ, has been designated as the competent authority for fundamental-rights oversight of high-risk artificial-intelligence systems falling under Annex III of the EU AI Act, coordinating in that role with the Public Defender of Rights.

Data collected 2026-10-25 · Data published 2026-10-25

AI-assembled from cited sources

Not fully checked this cycle: Controller/Processor Duties, Sectoral Watch, Algorithmic, Biometric & Surveillance Governance, Enforcement & Redress (4 open gaps).

Evidence re-verified: 2026-10-25 · Position last changed: 2026-10-25 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently.

Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26

[Open in Co-Pilot ↗](/reports/?type=copilot&j=CZECH-REPUBLIC)[Build Report](/reports/?j=CZECH-REPUBLIC)[Compare](/compare/?j=CZECH-REPUBLIC)

Framework posture Regulated (omnibus) 10 of 10 modules populated · AI-synthesised · Tier-1/2 verified

Lead supervisory authority Úřad pro ochranu osobních údajů (Office for Personal Data Protection, ÚOOÚ) Primary statutory & supervisory perimeter

Next milestone (> 2026-10-26) 2027-04-02 Regulation (EU) 2025/2518 (cross-border GDPR enforcement procedural rules) becomes applicable

Module coverage & confidence 10 / 10 modules assessed 0 Confirmed · 10 Probable · 0 Uncertain

10 Categories

0 Red categories 57 Sub-modules

56 Claims

4 Tier-1 sources

Traffic-light mix 7 green 3 amber
(sums to 10 rendered categories; click to filter)

No red categories; 15 sub-modules are flagged red.

Law made at European Economic Area (Bloc) level that applies in Czech Republic is covered once, on the [European Economic Area (Bloc)](/jurisdictions/european-economic-area-bloc/) page. This page covers Czech Republic’s own layer: implementation, national authorities, national options and local enforcement.

## Jurisdiction brief

Jurisdiction lead brief 1,154 Full executive summary 271

###### Latest update · 25 October 2026

#### Lead Signal

Two adjacent regulatory implementation gaps have been confirmed as live issues for operators in the Czech Republic. The European Union's Data Act access-by-design duty for connected products has applied directly as European law since 12 September 2026, yet the Czech implementing legislation that would fix penalties and enforcement mechanisms for that duty had not been adopted as of the sources reviewed, despite the transposition deadline having already elapsed. A parallel gap exists for artificial-intelligence governance: the European Union's AI Act high-risk requirements became directly enforceable across Czechia from 2 August 2026, while the Czech Adaptation Act, which would formally designate the Office for Personal Data Protection, the Czech Telecommunication Office, and the central bank in their respective enforcement roles and set sandbox and sanction rules, remains in draft form with no confirmed enactment date.

Both gaps share the same structural shape: a European obligation is binding and enforceable in its own right, while the national machinery intended to operationalise penalties, designated authorities, and procedural detail has not caught up. This is relevant to any connected-product manufacturer or high-risk-AI operator assessing their compliance exposure in this jurisdiction, since the underlying substantive duties already bind them even where the national enforcement architecture is incomplete.

#### Other Developments

Data Act duty applies without a settled national penalty regime. The access-by-design obligation under the Data Act requires manufacturers and providers of connected products to make product-generated data accessible to users by design. That duty is directly applicable European law and has applied since 12 September 2026. The Czech legislation intended to fix the penalty and enforcement regime for breaches of this duty remains unadopted, leaving a gap between the substantive obligation and its national enforcement machinery.

AI Act Adaptation Act remains in draft. The Czech Adaptation Act is understood to be the instrument that would designate the Office for Personal Data Protection, the Czech Telecommunication Office, and the Czech National Bank in their respective supervisory roles under the AI Act, and would establish sandbox arrangements and sanction rules for compliance failures. Its status was re-verified and confirmed still draft, with no confirmed enactment date, even though the underlying AI Act high-risk requirements have applied directly since 2 August 2026.

#### Cross-Monitor Connections

The Data Act implementation gap is relevant to the digital-asset and payments monitors insofar as connected-product data-access duties increasingly intersect with Internet-of-Things-enabled financial and payment devices, though no specific crossover finding is being advanced. The AI Act Adaptation Act gap is relevant to financial-sector supervision more broadly, since the central bank is named among the authorities that would receive a formal AI Act enforcement role once the Adaptation Act is finalised; until then, the precise division of supervisory responsibility for AI systems used in financial services remains unsettled at the national level.

#### Outlook

Both implementation gaps are overdue relative to their respective trigger dates, and resolution timing for each remains uncertain, with current expectations pointing toward adoption in 2027. Until the Czech Data Act implementing legislation and the AI Act Adaptation Act are each finalised, operators subject to the underlying European obligations face a national enforcement and penalty landscape that is less settled than the substantive duties themselves, a condition that is expected to persist until the respective Czech legislative processes conclude.

2 earlier updates not shown here.

###### Standing brief · as of 23 August 2026

Written before the update above. Where they differ, the update is the more recent position.

#### Lead Signal

The Czech data-protection authority, the ÚOOÚ, has been designated as the competent authority for fundamental-rights oversight of high-risk artificial-intelligence systems falling under Annex III of the EU AI Act, coordinating in that role with the Public Defender of Rights. A complementary national Czech AI Act is expected during 2026, meaning the institutional designation is now settled even though the domestic statute giving it fuller effect remains pending. This is the most structurally significant Czech data-protection development this cycle, since it extends the ÚOOÚ's institutional remit beyond its existing GDPR supervisory mandate into algorithmic and biometric governance territory for the first time.

#### Other Developments

The ÚOOÚ's largest fine to date remains the roughly EUR 13.9 million penalty against Avast Software s.r.o. , imposed for unlawful data transfers in which browsing-history data was only pseudonymised rather than genuinely anonymised, a standing enforcement benchmark that continues to anchor the Czech regulator's headline enforcement record.

The ÚOOÚ's 2025 enforcement-activity figures show a moderate but active regulator : 27 inspections initiated, 13 completed, 23 administrative proceedings commenced, 19 administrative decisions issued, and fines totalling CZK 14.6 million, approximately EUR 602,000, imposed over the year.

In 2026, the ÚOOÚ will take part in a coordinated enforcement action with other European data-protection authorities focused on GDPR transparency and information-obligation compliance under Articles 12 to 14, signalling a near-term enforcement focus that sits alongside the regulator's own domestic 2026 inspection plan.

That domestic 2026 inspection plan specifically targets commercial-communications practices, with particular attention to customer-satisfaction surveys , continuing a historical Czech enforcement pattern of higher sanctions for unsolicited commercial communications. The same 2026 plan also includes a review of the role and positioning of Data Protection Officers within the public sector.

On breach notification, Czech law permits a controller to report a breach to affected data subjects in limited scope or with delay where necessary and proportionate to protect defence or security interests or ongoing investigations, with no other GDPR derogation identified as applying nationally beyond this specific carve-out.

A new EU procedural instrument, Regulation (EU) 2025/2518, lays down additional procedural rules for cross-border GDPR enforcement and will apply from April 2027, adding a further layer of cross-border enforcement mechanics on top of the existing GDPR cooperation and consistency framework.

#### Cross-Monitor Connections

The ÚOOÚ's new institutional role under the EU AI Act connects directly to the artificial-intelligence monitor's tracking of Annex III high-risk system oversight: the competent-authority designation settled this cycle determines which Czech body carries fundamental-rights oversight responsibility for high-risk AI systems, a structural fact the artificial-intelligence monitor's own Czech coverage should reflect once the complementary national AI Act is finalised. No other cross-monitor linkage is evidenced in this cycle's Czech data-protection findings.

#### Outlook

The ÚOOÚ's 2026 forward programme, the coordinated EU transparency sweep, the domestic focus on commercial-communications practices and customer-satisfaction surveys, and the review of public-sector Data Protection Officer positioning, points toward an intensifying near-term enforcement focus even though the regulator's overall enforcement volume remains moderate relative to larger EU data-protection authorities. The pending complementary national Czech AI Act is the item most likely to convert this cycle's institutional designation into a fuller operative framework, and its eventual text will determine how far the ÚOOÚ's new AI Act oversight role extends in practice. Regulation (EU) 2025/2518's April 2027 application date remains distant enough that its practical effect on Czech cross-border enforcement casework is not yet observable, but it is a structural addition to the enforcement-cooperation architecture worth tracking as that date approaches.

Read full brief · 1154 words

Standing brief, as of 23 August 2026.

#### Regulatory Status

The Czech Republic's data-protection regime shows several converging developments this cycle. The ÚOOÚ has been designated as the competent authority for fundamental-rights oversight of Annex III high-risk artificial-intelligence systems under the EU AI Act, coordinating with the Public Defender of Rights, with a complementary national Czech AI Act expected during 2026. The ÚOOÚ's largest fine to date remains the approximately EUR 13.9 million penalty against Avast Software s.r.o. for unlawful data transfers involving only pseudonymised rather than genuinely anonymised browsing-history data, against a 2025 enforcement backdrop of 27 inspections, 23 administrative proceedings, and CZK 14.6 million in aggregate fines. For 2026, the ÚOOÚ has a defined forward programme: participation in a coordinated EU-wide enforcement sweep on GDPR transparency and information obligations, a domestic inspection focus on commercial-communications practices including customer-satisfaction surveys, and a review of Data Protection Officer positioning within the public sector. On cross-border matters, Regulation (EU) 2025/2518 will add further procedural rules for cross-border GDPR enforcement from April 2027, while domestically, Czech law permits limited-scope or delayed breach notification to affected data subjects where necessary to protect defence or security interests or ongoing investigations.

#### Outlook

The Czech Republic's data-protection trajectory this cycle is one of institutional consolidation rather than legislative overhaul: the AI Act oversight role is now settled even though the underlying national AI Act remains pending, and the ÚOOÚ's 2026 programme suggests a more forward-planned, programmatic enforcement posture than in prior periods. The pending national AI Act and the 2026 coordinated transparency sweep are the two items most likely to generate fresh, concrete findings in an upcoming cycle.

Read full brief · 271 words

Key regulatory facts for Czech Republic Regulatory Dimension Czech Republic Standing Position

Jurisdiction Czech Republic (CZ)

Regulatory Scope Data Protection & Privacy Regulation (10 modules, 56 sourced findings)

Regulator & Framework Full GDPR direct effect plus a settled, in-force national implementing Act and an operational, EDPB-member supervisory authority.

Lawful Processing & Special Data Direct GDPR effect confirmed plus ÚOOÚ consent guidance; special-category specifics not separately verified this pass.

Data Subject Rights Direct GDPR effect confirmed via official guidance notes; a documented national carve-out exists for law-enforcement/security processing.

Controller/Processor Duties Well-documented national DPIA and DPO provisions plus an active breach-notification regime evidenced by ÚOOÚ annual-report statistics; ROPA/joint-controller/retention specifics not separately verified this pass.

Primary Instruments Cited EDPB, IAPP, EUR-Lex, EDPB / ÚOOÚ, Úřad pro ochranu osobních údajů

Last Confirmed / Updated 2026-10-25 (34 sources in cumulative register)

10 of 10 categories

Signal
Red
Amber
Green

Density
Comfortable
Compact

Expand all sources
Reset all

Selections OR within a group, AND across groups. Press / to search.

### Czech Republic: D1 Regulator & Framework5 sub-modulesGreenEnacted in forceModule confidence: Probable▾

Full GDPR direct effect plus a settled, in-force national implementing Act and an operational, EDPB-member supervisory authority.

Primary framework Regulation (EU) 2016/679 (GDPR), as implemented by Act No. 110/2019 Coll. on Personal Data Processing

Supervisory authority [Úřad pro ochranu osobních údajů (Office for Personal Data Protection, ÚOOÚ)](https://www.uoou.cz)

Traffic-light rationale — Green Full GDPR direct effect plus a settled, in-force national implementing Act and an operational, EDPB-member supervisory authority.

#### Sub-modules (5)

#### Regulator And AuthorityGreen

ÚOOÚ, seated at Pplk. Sochora 27, Prague 7, is the Czech GDPR supervisory authority and a voting member of the EDPB.

Claims (4):

- The Office for Personal Data Protection (ÚOOÚ), seated at Pplk. Sochora 27, Prague 7, is the Czech Republic's GDPR supervisory authority and a full voting member of the European Data Protection Board.
- ÚOOÚ participates in the EU-wide Coordinated Enforcement Framework 2026, with DPO independence/effectiveness a stated focus.
- ÚOOÚ's own newsroom reports EDPB has harmonised fining methodology and approved guidelines on the interplay between the Digital Services Act and GDPR.
- Úřad pro ochranu osobních údajů (ÚOOÚ) — Czechia's single national data-protection supervisory authority with no federated (Länder-style) structure.

#### Act And InstrumentsGreen

Act No. 110/2019 Coll. is the core national instrument; it replaced the prior Data Protection Act and transposes the Law Enforcement Directive.

Claims (3):

- Act No. 110/2019 Coll. on Personal Data Processing fully replaces the prior Czech Data Protection Act, establishes the constitution and powers of the Czech Data Protection Office, and transposes Directive (EU) 2016/680 governing processing of personal data for crime prevention/investigation and defense/security purposes.
- CZ-specific designation of a national Data Act competent authority/data coordinator was not located this cycle.
- Act No. 110/2019 Coll. on the Processing of Personal Data is Czechia's national GDPR-implementing/derogating instrument.

#### Material ScopeGreen

The Act carries local derogations mainly benefiting public authorities and triggered amendment of over 30 other Czech statutes.

Claims (1):

- The Data Protection Act includes local derogations and exceptions primarily for public authorities, and its Accompanying Act amends more than 30 other Czech laws in connection with GDPR and Directive 2016/680 implementation.

#### Territorial ScopeGreen

GDPR's extraterritorial rule (targeting/monitoring of EU data subjects) applies directly to non-EU controllers vis-à-vis Czech data subjects.

Claims (1):

- Companies not established in the EU must comply with GDPR rules, including as applied by Czech supervisory authority, when they offer goods/services to or monitor the behaviour of individuals in the EU.

#### Regulator Registration And FilingAmber

No general controller registration/notification-fee regime (analogous to the UK ICO fee system) was identified for Czech Republic in this research pass; GDPR abolished the EU-wide prior-notification requirement that existed under the pre-2018 regime.

Claims (1):

- No distinct Czech controller-registration or filing-fee regime was confirmed in this research pass; GDPR's harmonised approach removed the general prior-notification obligation that existed under the pre-2018 Czech data protection regime.

Czech Republic is an EU Member State operating under the direct-effect GDPR, implemented and supplemented nationally by Act No. 110/2019 Coll. on Personal Data Processing, which establishes the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ) as the supervisory authority, includes local derogations (chiefly for public authorities), and transposes Directive (EU) 2016/680 for law-enforcement/security processing.

Sources and claims (10)
- [EDPB](https://www.edpb.europa.eu/about-edpb/our-members_en) — The Office for Personal Data Protection (ÚOOÚ), seated at Pplk. Sochora 27, Prague 7, is the Czech Republic's GDPR supervisory authority and a full voting member of the European Data Protection Board.
- [IAPP](https://iapp.org/news/a/czech-parliament-approves-bills-implementing-gdpr) — Act No. 110/2019 Coll. on Personal Data Processing fully replaces the prior Czech Data Protection Act, establishes the constitution and powers of the Czech Data Protection Office, and transposes Directive (EU) 2016/680 governing processing of personal data for crime prevention/investigation and defense/security purposes.
- [IAPP](https://iapp.org/news/a/czech-parliament-approves-bills-implementing-gdpr) — The Data Protection Act includes local derogations and exceptions primarily for public authorities, and its Accompanying Act amends more than 30 other Czech laws in connection with GDPR and Directive 2016/680 implementation.
- [EUR-Lex](https://eur-lex.europa.eu/CS/legal-content/summary/general-data-protection-regulation-gdpr.html) — Companies not established in the EU must comply with GDPR rules, including as applied by Czech supervisory authority, when they offer goods/services to or monitor the behaviour of individuals in the EU.
- [EDPB / ÚOOÚ](https://www.edpb.europa.eu/sites/default/files/article-60-final-decisions/publishable_cz_2019-07_lawfulnessoftheprocessing_decisionpublic.pdf) — No distinct Czech controller-registration or filing-fee regime was confirmed in this research pass; GDPR's harmonised approach removed the general prior-notification obligation that existed under the pre-2018 Czech data protection regime.
- [Úřad pro ochranu osobních údajů](https://uoou.gov.cz/index.php/novinky/vse?strana=1-32) — ÚOOÚ participates in the EU-wide Coordinated Enforcement Framework 2026, with DPO independence/effectiveness a stated focus.
- [Úřad pro ochranu osobních údajů](https://uoou.gov.cz/index.php/novinky/vse?strana=1-32) — ÚOOÚ's own newsroom reports EDPB has harmonised fining methodology and approved guidelines on the interplay between the Digital Services Act and GDPR.
- [rulecalc.com](https://rulecalc.com/sk/spotrebitel/gdpr-pokuta) — CZ-specific designation of a national Data Act competent authority/data coordinator was not located this cycle.
- [CMS GDPR Enforcement Tracker Report 2024](https://cms.law/en/int/publication/gdpr-enforcement-tracker-report-2024/czech-republic) — Úřad pro ochranu osobních údajů (ÚOOÚ) — Czechia's single national data-protection supervisory authority with no federated (Länder-style) structure.
- [CMS Expert Guide](https://cms.law/en/int/expert-guides/cms-expert-guide-to-data-protection-and-cyber-security-laws/czech-republic) — Act No. 110/2019 Coll. on the Processing of Personal Data is Czechia's national GDPR-implementing/derogating instrument.

### Czech Republic: D2 Lawful Processing & Special Data4 sub-modulesGreenEnacted in forceModule confidence: Probable▾

Direct GDPR effect confirmed plus ÚOOÚ consent guidance; special-category specifics not separately verified this pass.

Primary framework Regulation (EU) 2016/679 (GDPR) Arts 6, 7, 9

Supervisory authority [Úřad pro ochranu osobních údajů (ÚOOÚ)](https://www.uoou.cz)

Traffic-light rationale — Green Direct GDPR effect confirmed plus ÚOOÚ consent guidance; special-category specifics not separately verified this pass.

D2 · Lawful Processing — Full Module Record 4 sub-modules · 35 words · 5 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

### Czech Republic: D3 Data Subject Rights5 sub-modulesGreenEnacted in forceModule confidence: Probable▾

Direct GDPR effect confirmed via official guidance notes; a documented national carve-out exists for law-enforcement/security processing.

Primary framework Regulation (EU) 2016/679 (GDPR) Arts 12-22; Act No. 110/2019 Coll. Title III

Supervisory authority [Úřad pro ochranu osobních údajů (ÚOOÚ)](https://www.uoou.cz)

Traffic-light rationale — Green Direct GDPR effect confirmed via official guidance notes; a documented national carve-out exists for law-enforcement/security processing.

#### Sub-modules (5)

#### Access RightGreen

GDPR governs the subject-access request framework directly in Czechia.

Claims (2):

- The General Data Protection Regulation governs data subject rights in Czechia, directly conferring rights of access, rectification, erasure, restriction, objection and portability, as supplemented by Act No. 110/2019 Coll. on Personal Data Processing.
- GDPR Art 83(4)-(6) two-tier fine caps apply directly in CZ; Act No. 110/2019 Sb. §62 is the national procedural implementing provision.

#### Rectification And ErasureGreen

GDPR's rectification/erasure rights apply directly; no CZ-specific derogation identified beyond the Title III carve-out.

Claims (1):

- The General Data Protection Regulation governs data subject rights in Czechia, directly conferring rights of access, rectification, erasure, restriction, objection and portability, as supplemented by Act No. 110/2019 Coll. on Personal Data Processing.

#### Restriction And ObjectionGreen

GDPR's restriction and objection rights (including profiling opt-out) apply directly in Czechia.

Claims (1):

- The General Data Protection Regulation governs data subject rights in Czechia, directly conferring rights of access, rectification, erasure, restriction, objection and portability, as supplemented by Act No. 110/2019 Coll. on Personal Data Processing.

#### Data PortabilityAmber

GDPR's portability right applies directly; no distinct Czech implementation detail was separately verified.

Claims (1):

- The General Data Protection Regulation governs data subject rights in Czechia, directly conferring rights of access, rectification, erasure, restriction, objection and portability, as supplemented by Act No. 110/2019 Coll. on Personal Data Processing.

#### Deadlines And Response WindowsGreen

Title III of Act No. 110/2019 Coll. restricts ordinary data-subject-rights deadlines/response obligations for criminal-matters and national-security processing by competent authorities.

Claims (1):

- Title III of Act No. 110/2019 Coll. governs the processing of personal data in relation to criminal matters and national security by competent Czech public authorities and provides restrictions on the rights of data subjects in that context.

GDPR governs data subject rights directly in Czechia (access, rectification, erasure, restriction, objection, portability), supplemented by Act No. 110/2019 Coll., whose Title III carves out restrictions for criminal-matters/national-security processing by competent public authorities.

Sources and claims (3)
- [DataGuidance](https://www.dataguidance.com/notes/czech-republic-data-subject-rights) — The General Data Protection Regulation governs data subject rights in Czechia, directly conferring rights of access, rectification, erasure, restriction, objection and portability, as supplemented by Act No. 110/2019 Coll. on Personal Data Processing.
- [DataGuidance](https://www.dataguidance.com/notes/czech-republic-data-subject-rights) — Title III of Act No. 110/2019 Coll. governs the processing of personal data in relation to criminal matters and national security by competent Czech public authorities and provides restrictions on the rights of data subjects in that context.
- [VLO Law Firm](https://vlolawfirm.com/legal-updates/czech-republic-2025-q4-data-protection) — GDPR Art 83(4)-(6) two-tier fine caps apply directly in CZ; Act No. 110/2019 Sb. §62 is the national procedural implementing provision.

### Czech Republic: D4 Controller/Processor Duties7 sub-modulesGreenEnacted in forceModule confidence: Probable▾

Well-documented national DPIA and DPO provisions plus an active breach-notification regime evidenced by ÚOOÚ annual-report statistics; ROPA/joint-controller/retention specifics not separately verified this pass.

Primary framework Regulation (EU) 2016/679 (GDPR) Arts 24-39; Act No. 110/2019 Coll. §§10, 14, 16(1)(d)

Supervisory authority [Úřad pro ochranu osobních údajů (ÚOOÚ)](https://www.uoou.cz)

Traffic-light rationale — Green Well-documented national DPIA and DPO provisions plus an active breach-notification regime evidenced by ÚOOÚ annual-report statistics; ROPA/joint-controller/retention specifics not separately verified this pass.

D4 · Controller & Processor — Full Module Record 7 sub-modules · 37 words · 6 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

### Czech Republic: D5 Cross-Border & Adequacy6 sub-modulesGreenEnacted in forceModule confidence: Probable▾

GDPR transfer toolkit applies directly; the EU's new cross-border enforcement procedural regulation is confirmed adopted and published.

Primary framework Regulation (EU) 2016/679 (GDPR) Arts 44-49; Regulation (EU) 2025/2518 (procedural rules)

Supervisory authority [Úřad pro ochranu osobních údajů (ÚOOÚ)](https://www.uoou.cz)

Traffic-light rationale — Green GDPR transfer toolkit applies directly; the EU's new cross-border enforcement procedural regulation is confirmed adopted and published.

D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 38 words · 4 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

### Czech Republic: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾

One sectoral overlay (telecoms/e-privacy) is well evidenced; other sector modules lack dedicated Czech sectoral sourcing this pass.

Primary framework Act No. 127/2005 Coll. (Electronic Communications Act), as amended by Act No. 374/2021 Coll.

Supervisory authority [Úřad pro ochranu osobních údajů (ÚOOÚ)](https://www.uoou.cz)

Traffic-light rationale — Amber One sectoral overlay (telecoms/e-privacy) is well evidenced; other sector modules lack dedicated Czech sectoral sourcing this pass.

Periodic update · new data 2026-10-25

#### Sectoral Watch

The European Union's Data Act establishes an access-by-design duty requiring manufacturers and providers of connected products to make the data those products generate accessible to users by design and by default. This duty, found in Regulation (EU) 2023/2854, is directly applicable European law and has applied in the Czech Republic, as everywhere else in the Union, since 12 September 2026. What has not yet materialised is the Czech national legislation intended to fix the penalty and enforcement regime for breaches of this duty. As of the sources reviewed, that implementing legislation remained unadopted despite the transposition deadline having already elapsed, leaving a confirmed gap between a binding substantive obligation and the national machinery that would give it enforcement teeth.

This gap is structurally significant rather than merely administrative. The underlying duty binds connected-product manufacturers and providers directly, regardless of whether Czech penalty legislation exists, because the Data Act is a directly applicable regulation rather than a directive requiring transposition for its substantive content to take effect. What the missing national legislation would supply is the penalty and enforcement framework specific to the Czech jurisdiction, the mechanism by which breaches of the access-by-design duty would actually be sanctioned domestically. Until that legislation is adopted, the practical enforcement pathway for Data Act breaches in the Czech Republic remains less defined than the underlying duty itself.

For operators of connected products sold or operated in the Czech market, this means the substantive compliance obligation is already live and already binding, even though the domestic penalty architecture that would attach to non-compliance has not yet been finalised. This is not a basis for treating the obligation as unenforceable; European-level enforcement mechanisms and the general applicability of the regulation remain in place regardless of the national penalty-legislation gap. It does mean that the specific Czech penalty figures and enforcement procedure that would apply to a breach occurring in this jurisdiction cannot yet be stated with confidence, because that legislation has not been finalised.

#### Outlook

Resolution of this gap depends on the Czech legislative process completing adoption of the implementing and penalty legislation for the Data Act's access-by-design duty, with current indications pointing toward resolution in the first quarter of 2027, though this remains an estimate rather than a confirmed date. Until that legislation is adopted, connected-product manufacturers and providers operating in the Czech market face a substantive duty that is already binding under directly applicable European law, paired with a domestic enforcement and penalty framework that has not yet caught up to that duty's effective date.

D6 · Sectoral Watch — Full Module Record 7 sub-modules · 60 words · 3 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

### Czech Republic: D7 AdTech & Commercial Privacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾

Cookie and direct-marketing regimes are well evidenced; other adtech sub-areas lack dedicated CZ sourcing.

Primary framework Act No. 127/2005 Coll. (Electronic Communications Act); Act No. 480/2004 Coll. on Certain Information Society Services

Supervisory authority [Úřad pro ochranu osobních údajů (ÚOOÚ)](https://www.uoou.cz)

Traffic-light rationale — Amber Cookie and direct-marketing regimes are well evidenced; other adtech sub-areas lack dedicated CZ sourcing.

D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 56 words · 4 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

### Czech Republic: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾

Core GDPR Art 22 and state-surveillance carve-out are well evidenced; AI-specific risk-assessment and genetic-data regimes are not yet settled or separately confirmed for CZ.

Primary framework Regulation (EU) 2016/679 (GDPR) Art 22; Act No. 110/2019 Coll. Title III (transposing Directive (EU) 2016/680)

Supervisory authority [Úřad pro ochranu osobních údajů (ÚOOÚ)](https://www.uoou.cz)

Traffic-light rationale — Amber Core GDPR Art 22 and state-surveillance carve-out are well evidenced; AI-specific risk-assessment and genetic-data regimes are not yet settled or separately confirmed for CZ.

Periodic update · new data 2026-10-25

#### Algorithmic, Biometric & Surveillance Governance

The European Union's AI Act high-risk requirements became directly enforceable across the Czech Republic, as across the rest of the Union, from 2 August 2026. The Czech national instrument intended to operationalise this regime domestically, referred to as the Adaptation Act, would formally designate the Office for Personal Data Protection, the Czech Telecommunication Office, and the Czech National Bank in their respective supervisory and enforcement roles under the AI Act, and would establish regulatory sandbox arrangements along with sanction rules for compliance failures. As re-verified, that Adaptation Act remains in draft form, with no confirmed enactment date identified.

The structural shape of this gap mirrors the one affecting connected-product data-access duties: a European-level substantive obligation, in this case the AI Act's high-risk system requirements, is already directly enforceable, while the national legislation that would clarify which domestic authority holds which enforcement power, and under what sandbox or sanction terms, has not yet been finalised. For high-risk-AI operators in the Czech Republic, the practical consequence is that compliance obligations under the AI Act itself are not in question, but the specific domestic institutional architecture, which body enforces what, under which sandbox provisions, and with what sanction exposure, remains unsettled pending the Adaptation Act's enactment.

The naming of the Czech National Bank among the authorities that would receive a formal AI Act role under the draft Adaptation Act is a detail with particular relevance to financial-sector AI governance: it signals an intended division of supervisory labour between data-protection, telecommunications, and financial-sector regulators for AI systems used in or adjacent to financial services, but that division remains provisional and unconfirmed while the Adaptation Act sits in draft. Operators of high-risk AI systems in financial services should accordingly treat the question of which specific Czech authority will exercise enforcement powers over their systems as currently unresolved, notwithstanding the underlying AI Act obligations already being in force.

#### Outlook

The Adaptation Act's path to enactment remains unconfirmed, with current indications pointing toward possible resolution in the first quarter of 2027, though this is an estimate rather than a settled date. Until the Adaptation Act is enacted, the designated roles of the Office for Personal Data Protection, the Czech Telecommunication Office, and the Czech National Bank under the AI Act remain in draft form rather than settled law, and high-risk-AI operators in the Czech Republic should expect continued uncertainty over the precise domestic enforcement architecture even as the underlying European obligations remain fully binding.

D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 65 words · 8 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

### Czech Republic: D9 Children & Vulnerable Groups5 sub-modulesGreenEnacted in forceModule confidence: Probable▾

The core age-of-consent threshold is well confirmed via primary legislative reporting; other sub-areas lack dedicated CZ sourcing.

Primary framework Regulation (EU) 2016/679 (GDPR) Art 8; Act No. 110/2019 Coll.

Supervisory authority [Úřad pro ochranu osobních údajů (ÚOOÚ)](https://www.uoou.cz)

Traffic-light rationale — Green The core age-of-consent threshold is well confirmed via primary legislative reporting; other sub-areas lack dedicated CZ sourcing.

D9 · Children's Privacy — Full Module Record 5 sub-modules · 45 words · 2 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

### Czech Republic: D10 Enforcement & Redress6 sub-modulesGreenEnacted in forceModule confidence: Probable▾

Well-documented enforcement powers, a landmark cross-border fine decision, and recent (within-180-day) reporting on regulator capacity strain.

Primary framework Regulation (EU) 2016/679 (GDPR) Arts 58, 77-84; Act No. 110/2019 Coll.

Supervisory authority [Úřad pro ochranu osobních údajů (ÚOOÚ)](https://www.uoou.cz)

Traffic-light rationale — Green Well-documented enforcement powers, a landmark cross-border fine decision, and recent (within-180-day) reporting on regulator capacity strain.

Periodic update · new data 2026-10-18

#### Enforcement & Redress

ÚOOÚ's enforcement record remains anchored by its largest fine to date, a CZK 351 million penalty imposed on Avast Software s.r.o. for unauthorised processing and transfer of antivirus and browser-extension user data. The decision is final, and given the cross-border nature of Avast's processing it was handled through the EU One-Stop-Shop cooperation mechanism, which coordinates enforcement across the supervisory authorities of the member states where the controller's processing has effect. This fine continues to stand as the high-water mark of Czech GDPR enforcement, and no larger or comparable penalty was identified this cycle.

Separately, a Czech court corrected the authority's reasoning in a case concerning the adequacy of security measures. The court found that ÚOOÚ had focused too narrowly on the hashing algorithm used by the controller and on a general assessment of that algorithm, without adequately weighing the broader security context in which it was deployed, the technological standards prevailing at the relevant time, or the specific risk profile of the processing activity at issue. This is reported as a correction of the authority's analytical approach to assessing technical security measures under Article 32 GDPR, though the exact court, its level, and the date of the ruling were not confirmed in the material reaching this cycle; it is attributed via secondary commentary rather than a primary judicial source.

The statutory basis for ÚOOÚ's fining power remains Section 62 of Act No. 110/2019 Sb., the national procedural implementing provision giving effect to the two-tier fine caps set directly by Article 83(4) to (6) of the GDPR: a lower tier capped at the higher of EUR 10 million or 2 percent of annual worldwide turnover, and an upper tier capped at the higher of EUR 20 million or 4 percent of annual worldwide turnover, both converted to Czech crowns for domestic application. No amendment to this provision was identified this cycle.

At the EU level, the European Data Protection Board has approved a harmonised methodology for the calculation of administrative fines and has adopted guidelines on the interplay between the Digital Services Act and the GDPR, as reported via ÚOOÚ's own newsroom. This is a standing convergence development affecting how national authorities, including ÚOOÚ, approach fine calculation going forward, though no domestic Czech instrument implementing or responding to it was identified this cycle.

#### Outlook

Confirmation of the court, its level, and the date of the ruling in the hashing-algorithm security-measures case would allow a fuller assessment of how binding or persuasive that correction is for ÚOOÚ's future enforcement practice. The EDPB's harmonised fining methodology is worth watching for whether it produces a visible shift in the size or structure of future ÚOOÚ penalties relative to the Avast benchmark.

Periodic update · new data 2026-10-11

#### Enforcement & Redress

The Avast Software s.r.o. GDPR enforcement matter has progressed at the appellate level. In a judgment dated 30 September 2025, in case 5 A 56/2024, the Prague Municipal Court annulled the fine imposed on Avast as to the amount, a fine reported at CZK 351 million (approximately EUR 13.9 million) over unlawful data transfers to Jumpshot, while upholding the underlying finding of liability. The case is now on cassation before the Supreme Administrative Court, and a successful cassation outcome on the amount issue could see the matter return to the ÚOOÚ for the fine to be re-quantified. The precise current procedural status of the cassation, including whether a hearing or decision date has been set, was not confirmed in evidence available this cycle.

#### Outlook

The Supreme Administrative Court's disposition of the cassation is the development to track. If the court affirms the Municipal Court's annulment of the fine amount while the liability finding stands, the matter would most likely return to the ÚOOÚ for re-quantification, which would itself constitute a further dated development in this enforcement history.

D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 66 words · 11 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

## GDPR article map

Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped).

Show article map GDPR article to category mapping Article Category Sub-module

Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia

Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases

Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds

Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories

Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) access right

Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) access right

Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right

Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure

Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure

Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection

Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure

Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability

Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection

Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency

Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia

Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements

Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements

Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures

Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification

Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification

Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia

Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements

Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements

Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements

Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms

Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received

Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs

Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs

Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms

Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms

Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action

Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action

Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action

Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties

Art. 81 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties

Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action

Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties

Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties