Data Protection Update in Czech Republic: Q4 2025

Czech Republic data protection law continued to evolve through the final quarter of the year, with the Office for Personal Data Protection stepping up enforcement activity and new guidance reshaping compliance expectations for businesses of all sizes. Companies operating in the Czech Republic - whether locally incorporated or serving Czech residents from abroad - face a more demanding regulatory environment than at any point since the General Data Protection Regulation came into force. This guide covers the key legislative and regulatory developments from Q4, the most significant enforcement decisions, practical implications for data controllers and processors, and the steps businesses should take to stay compliant.

The Czech Republic';s primary data protection framework rests on the GDPR as directly applicable EU law, supplemented by Act No. 110/2019 Coll. on Personal Data Processing, which adapts the regulation to the national context and governs areas where member states retain discretion. During the final quarter of the year, the Czech legislature and the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, or UOOU) issued several updates that businesses need to absorb.

The most consequential development was the UOOU';s updated guidance on legitimate interest as a legal basis under Article 6(1)(f) GDPR. The guidance clarifies that controllers relying on legitimate interest must conduct and document a three-part balancing test - identifying the interest, assessing necessity, and weighing the impact on data subjects - before processing begins, not retrospectively. This is a stricter interpretation than many Czech businesses had been applying in practice, particularly in direct marketing and employee monitoring contexts.

A second area of change concerns the transposition of the EU';s updated standard contractual clauses framework into Czech domestic practice. The UOOU published a supplementary note confirming that controllers and processors established in the Czech Republic must use the current modular SCCs for all new international data transfer arrangements, and must have completed the transition for legacy arrangements. Controllers who have not yet audited their transfer mechanisms are now at material risk of enforcement.

Third, the Czech Republic continued to implement the NIS2 Directive through amendments to Act No. 181/2014 Coll. on Cyber Security. While NIS2 is primarily a cybersecurity instrument, its overlap with data protection obligations - particularly around incident reporting timelines and security measures - means that organisations subject to NIS2 must align their data protection and cybersecurity programmes. The National Cyber and Information Security Agency (NÚKIB) and the UOOU have signalled an intention to coordinate inspections in sectors such as energy, healthcare, and digital infrastructure.

The UOOU published several enforcement decisions during the quarter that reveal the authority';s current priorities and the practical risks facing non-compliant organisations.

One notable case involved a mid-sized Czech e-commerce operator fined for failing to honour data subject access requests within the statutory one-month period under Article 12 GDPR. The UOOU found that the company had no documented process for routing access requests from its customer service team to its data protection officer, resulting in systematic delays. The decision emphasised that procedural failures - not just technical breaches - attract sanctions, and that the absence of internal workflows is itself evidence of non-compliance with the accountability principle under Article 5(2) GDPR.

A second decision targeted a healthcare provider that had shared patient data with a third-party analytics vendor without a valid data processing agreement meeting the requirements of Article 28 GDPR. The UOOU noted that the vendor';s standard terms did not include the mandatory clauses on sub-processing, audit rights, or deletion obligations. This case is a reminder that procurement teams, not just legal or IT departments, must be trained to identify data processing relationships and escalate them for proper contracting.

The UOOU also issued a formal reprimand to a Czech subsidiary of a multinational group for failing to maintain records of processing activities under Article 30 GDPR. The subsidiary had assumed that its parent company';s group-level records of processing were sufficient. The UOOU clarified that each legal entity established in the Czech Republic must maintain its own records, reflecting the processing it actually carries out, regardless of group-level documentation.

Across these cases, a clear pattern emerges: the UOOU is focusing on accountability infrastructure - the internal systems, contracts, and documentation that demonstrate compliance - rather than exclusively on data breaches or large-scale misuse. Businesses that have invested in technical security but neglected governance documentation are particularly exposed.

The Q4 developments have direct operational consequences for businesses established in or targeting the Czech Republic. Controllers and processors should treat the following areas as immediate priorities.

Legitimate interest assessments. Any organisation relying on legitimate interest as a legal basis - whether for marketing, fraud prevention, network security, or employee monitoring - should review and update its legitimate interest assessments in line with the UOOU';s new guidance. Assessments must be documented, dated, and retained as evidence of the balancing exercise. A common mistake is to treat legitimate interest as a catch-all basis when consent or contract would be more appropriate and easier to demonstrate.

Data subject request workflows. The one-month response deadline under Article 12 GDPR is absolute in the Czech regulatory context. Controllers should map the internal journey of a data subject request from first receipt to final response, identify handoff points where delays are likely, and assign clear ownership. Many underestimate the operational burden of handling access, rectification, and erasure requests at scale, particularly when data is spread across legacy systems.

Vendor and processor contracts. Every arrangement under which a third party processes personal data on behalf of a Czech controller must be governed by a written agreement meeting the Article 28 requirements. Controllers should audit their vendor base, prioritising high-risk processors such as cloud providers, HR platforms, payroll services, and analytics tools. Where agreements are missing or deficient, remediation should be treated as urgent.

Records of processing activities. Each Czech legal entity must maintain its own Article 30 records, even within a multinational group. Records should reflect actual processing activities, not aspirational or group-level descriptions. They should be reviewed at least annually and updated whenever a new processing activity is introduced or an existing one changes materially.

International data transfers. Controllers and processors that transfer personal data outside the European Economic Area must verify that each transfer is covered by an adequate safeguard - typically the current modular SCCs, an adequacy decision, or binding corporate rules. The UOOU has indicated that transfer impact assessments are expected where transfers go to jurisdictions without an adequacy decision, particularly where the recipient country';s laws permit broad government access to data.

If your organisation is uncertain about its current compliance posture across any of these areas, a structured gap assessment is the most efficient starting point. Contact info@vlolawfirm.com - we can help structure the setup correctly the first time.

Several developments during the quarter have particular relevance for specific sectors and for businesses operating across borders.

Healthcare and clinical research. The intersection of GDPR with Act No. 372/2011 Coll. on Health Services creates a complex framework for processing health data in the Czech Republic. The UOOU and the Ministry of Health have been developing joint guidance on the use of health data for secondary purposes, including research and public health analytics. Organisations in this sector should monitor the guidance closely, as it is expected to clarify when explicit consent is required and when processing can rely on the public interest basis under Article 9(2)(j) GDPR.

Employment and HR data. Czech employment law, particularly the Labour Code (Act No. 262/2006 Coll.), interacts with GDPR in ways that frequently surprise foreign employers. Employee monitoring - including email monitoring, GPS tracking of company vehicles, and biometric access systems - requires a documented legal basis, prior information to employees, and in many cases consultation with employee representatives. The UOOU has received an increasing number of complaints in this area, and enforcement is likely to intensify.

Financial services and fintech. Organisations subject to AML obligations under Act No. 253/2008 Coll. on Certain Measures against Legalisation of Proceeds of Crime must balance their data retention obligations under that act with the data minimisation and storage limitation principles of GDPR. In practice, this means maintaining clear retention schedules that distinguish between data held for AML compliance purposes and data held for other purposes, with different retention periods and deletion triggers for each category.

Scenario one - a foreign SaaS provider serving Czech customers. A software-as-a-service company established outside the EU but offering services to Czech residents is subject to GDPR by virtue of Article 3(2). It must designate an EU representative, maintain records of processing, and appoint a data protection officer if it carries out large-scale systematic monitoring of individuals. Failure to designate an EU representative is itself a sanctionable breach, and the UOOU has the power to impose fines on non-EU controllers through cooperation with the lead supervisory authority.

Scenario two - a Czech company acquiring a business with legacy data. Corporate acquisitions frequently involve the transfer of customer, employee, and supplier data. Under Czech law and GDPR, the acquiring entity must assess whether the data was collected on a legal basis that survives the transaction, whether data subjects were informed of the possibility of transfer, and whether any consents need to be refreshed. Due diligence checklists that do not include a data protection workstream are increasingly seen as inadequate by both regulators and sophisticated counterparties.

Looking ahead from Q4, businesses operating in the Czech Republic should be aware of several forthcoming obligations and deadlines that will shape their compliance programmes in the near term.

The EU AI Act is beginning to impose obligations on providers and deployers of AI systems, with the highest-risk categories already subject to requirements. Many AI applications process personal data, and Czech controllers deploying AI tools must assess whether their data protection impact assessments under Article 35 GDPR adequately address AI-specific risks such as automated decision-making, profiling, and model training on personal data.

The ePrivacy framework remains in transition at the EU level, but Czech businesses operating websites, apps, and electronic communications services should review their cookie consent mechanisms and electronic marketing practices against the current requirements of Act No. 127/2005 Coll. on Electronic Communications and the UOOU';s published guidance. Consent banners that do not meet the GDPR standard for freely given, specific, informed, and unambiguous consent remain a common source of complaints.

Organisations that have not yet conducted a formal data protection audit should treat this as a priority. An audit should cover the legal bases for all significant processing activities, the completeness and accuracy of Article 30 records, the status of processor agreements, the adequacy of data subject request handling procedures, and the organisation';s breach notification readiness under Articles 33 and 34 GDPR.

In practice, founders and compliance managers should consider building a rolling compliance calendar that tracks recurring obligations - annual record reviews, DPO reporting cycles, training refreshes, and vendor reassessments - alongside event-triggered obligations such as new product launches, system changes, and acquisitions.

What are the most common GDPR compliance failures the UOOU is currently targeting in Czech Republic?

Based on recent enforcement decisions, the UOOU is focusing on accountability infrastructure rather than purely on data breaches. The most frequently cited failures include inadequate or missing records of processing activities under Article 30, deficient data processing agreements with vendors, failure to respond to data subject requests within the one-month statutory deadline, and insufficient documentation of the legal basis for processing. Organisations that have invested in technical security but neglected governance documentation - policies, contracts, records, and training - are at the greatest risk. The UOOU has also signalled increased attention to international data transfers and the adequacy of transfer impact assessments.

How long does it typically take to remediate a data protection compliance gap in Czech Republic, and what does it cost?

The timeline and cost depend heavily on the size of the organisation and the scope of the gaps identified. A focused remediation covering records of processing, processor agreements, and data subject request procedures for a small to medium-sized business can typically be completed within six to twelve weeks with appropriate legal and operational support. Larger organisations with complex processing activities, multiple legal entities, or significant international transfer arrangements should budget for a longer programme. Professional fees for a structured gap assessment and remediation project generally start from the low thousands of EUR for smaller engagements and scale with complexity. Investing in remediation before an inspection or complaint is materially less costly than responding to enforcement proceedings.

Does a Czech subsidiary of a foreign group need its own data protection officer, or can it share the group DPO?

A Czech subsidiary can share a group DPO, provided the DPO is accessible to data subjects and supervisory authorities in the Czech Republic, has sufficient resources to perform the role across all entities, and is not subject to conflicts of interest. Under Article 37(2) GDPR, a group of undertakings may designate a single DPO, but the DPO must be easily reachable from each establishment. In practice, this means the DPO must be able to communicate in Czech or have adequate local support, must be familiar with the Czech regulatory environment and the UOOU';s guidance, and must be formally designated in the records of each Czech entity. A DPO who is effectively inaccessible to Czech operations does not satisfy the legal requirement.

The Q4 developments confirm that Czech Republic data protection enforcement is maturing, with the UOOU moving beyond reactive breach response toward proactive scrutiny of compliance infrastructure. Businesses that treat GDPR compliance as a one-time project rather than an ongoing programme face growing exposure. Prioritising documentation, vendor governance, and data subject request handling is the most effective way to reduce regulatory risk in the current environment.

VLO Law Firms advises international clients on data protection matters in the Czech Republic. We can assist with compliance gap assessments, records of processing, data processing agreements, DPO support, and regulatory response. To request a consultation, contact: info@vlolawfirm.com