Skip to content
World Watch

Data protection & privacy law in Czechia (2026)

Data protection in Czechia: comprehensive law.

Czechia operates under the EU's GDPR as directly applicable law, with Act No. 110/2019 Coll. serving as the national adaptation statute that replaced the former Act No. 101/2000 Coll. and implements GDPR derogations, the Law Enforcement Directive (2016/680), and the PNRD. The independent supervisory authority is the UOOU (uoou.gov.cz), which is a full member of the European Data Protection Board and carries active enforcement powers including significant fines.

Last verified Official sources first · MethodologyCompare Czechia with other countries

Legal framework

GDPR (Regulation (EU) 2016/679) directly applicable, supplemented by Act No. 110/2019 Coll. on Personal Data Processing (national adaptation law); supervised by the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, UOOU)

GDPR & data protection in Czechia

In Czechia, data protection is governed by the EU General Data Protection Regulation (GDPR), which applies directly and is enforced by the Office for Personal Data Protection (ÚOOÚ).

Framework
the GDPR (Regulation (EU) 2016/679) plus the national data-protection act
Supervisory authority
the Office for Personal Data Protection (ÚOOÚ)
Applies to
any organisation processing the personal data of people in Czechia, wherever the organisation is based
Maximum fine
€20 million or 4% of global annual turnover, whichever is higher
Breach notification
within 72 hours of becoming aware, to the supervisory authority
DPO
required for large-scale monitoring or large-scale special-category processing

The GDPR is bloc-wide; Czechia supplements it with a national data-protection act and its own supervisory authority.

Key points: data & privacy in Czechia

  1. Primary legislation

    Act No. 110/2019 Coll. on Personal Data Processing entered into force on 24 April 2019, replacing Act No. 101/2000 Coll. It adapts GDPR at the national level and also implements Directive (EU) 2016/680 (LED) for law-enforcement processing of personal data.

    uoou.gov.cz ecovislegal.cz

  2. Supervisory authority

    The Office for Personal Data Protection (UOOU), based in Prague, is the independent national DPA. It is a member of the EDPB, cooperates with the EDPS on Schengen-related supervisory matters, and publishes binding decisions and annual enforcement plans.

    uoou.gov.cz uoou.gov.cz

  3. Child consent age

    Section 7 of Act No. 110/2019 lowers the age of valid consent for information-society services to 15 years (below the GDPR default of 16), the minimum permitted under GDPR Article 8. This covers social networks, apps, streaming, and marketing newsletters.

    linklaters.com arws.cz

  4. Public-authority fine exemption

    Czech national law opts out of GDPR administrative fines for public authorities and bodies; these entities cannot be fined for GDPR or Act No. 110/2019 infringements, though other corrective powers of the UOOU still apply.

    dlapiperdataprotection.com cms.law

  5. Enforcement, Avast fine (2024)

    In April 2024 the UOOU issued a final binding appellate decision fining Avast Software s.r.o. CZK 351 million (approx. EUR 13.9 million) for transferring pseudonymised browsing history of ~100 million users to a sister company without a valid legal basis, violating GDPR Articles 6 and 13.

    uoou.gov.cz edpb.europa.eu

  6. 2025 enforcement priorities

    The UOOU's 2025 control plan targets retailers conditioning discounts on loyalty-programme enrolment (lawfulness of processing) and CCTV systems in public transport, applying its updated CCTV methodology to assess proportionality and transparency obligations.

    uoou.gov.cz iclg.com

GDPR in Czechia: FAQ

Does the GDPR apply in Czechia?

Yes. As an EU/EEA member, Czechia applies the GDPR (Regulation (EU) 2016/679) directly, enforced by the Office for Personal Data Protection (ÚOOÚ).

Who enforces data protection law in Czechia?

The Office for Personal Data Protection (ÚOOÚ).

What are the GDPR fines in Czechia?

Up to €20 million or 4% of global annual turnover, whichever is higher.

Do you need a Data Protection Officer in Czechia?

A DPO is required where you carry out large-scale monitoring or process special-category data at scale.

How quickly must a data breach be reported in Czechia?

Personal-data breaches must be notified to the supervisory authority within 72 hours of becoming aware.

Timeline of decisions

  1. Decision
    Prague Municipal Court Partially Annuls Record Avast GDPR Fine

    The Municipal Court in Prague (case 5 A 56/2024) upheld Avast's liability for unlawful data processing but annulled the CZK 351M penalty amount; UOOU filed a cassation appeal to the Czech Supreme Administrative Court, leaving the penalty quantum unresolved.

    Linklaters

  2. Enforcement · official
    UOOU Issues Record CZK 351M GDPR Fine Against Avast

    The Czech DPA's largest-ever penalty — CZK 351 million (~€13.9M) — was made final against Avast Software for transferring pseudonymised browsing data of approximately 100 million antivirus users to subsidiary Jumpshot Inc. in 2019 without a valid legal basis and while misleading users, violating GDPR Articles 6 and 13.

    UOOU (Czech DPA)

  3. Enforcement
    UOOU Fines Healthcare Company for Failure to Notify Personal Data Breach

    UOOU imposed a CZK 309,000 (~€12,000) fine on a company for failing to report a personal data breach affecting ~247,000 patients to the supervisory authority, signalling active enforcement of GDPR Article 33 breach-notification obligations in the healthcare sector.

    CMS GDPR Enforcement Tracker

  4. Law
    Mandatory Cookie Opt-In Consent Enters into Force Under Electronic Communications Amendment

    An amendment to the Electronic Communications Act (adopted by the Chamber of Deputies on 15 September 2021) took effect, replacing the previous opt-out cookie model with a strict opt-in requirement: websites must obtain free, specific, informed, and unambiguous user consent before storing any non-essential cookies, aligning Czech law with the EU ePrivacy Directive and the GDPR framework enforced by ÚOOÚ.

    Library of Congress – Global Legal Monitor

  5. Law · official
    Act No. 110/2019 Coll. on Personal Data Processing Enters into Force

    Czech GDPR adaptation statute replaced Act 101/2000, adding Czech-specific rules on processing by public authorities and intelligence services, setting child consent age at 15 (below GDPR's default 16), and fully exempting public bodies from GDPR administrative fines — the current primary national data-protection law.

    UOOU / Czech Collection of Laws

  6. Decision · official
    Czech Republic Accedes to the EU; EU Data Protection Acquis Fully Binding

    Upon EU accession, all EU data protection law — including Directive 95/46/EC and its supervisory cooperation mechanisms — became binding on Czechia; UOOU joined the Article 29 Working Party (predecessor to the EDPB), integrating Czech oversight into the EU-wide framework.

    UOOU

Sources

  1. uoou.gov.cz/en/about-the-czech-dpa
  2. uoou.gov.cz/en
  3. uoou.gov.cz/en/news/business-communication/czech-dpa-imposed-fine-of-351-million-
  4. edpb.europa.eu/news/news/2024/czech-sa-imposed-fine-139-million-eur-infringement-art
  5. ecovislegal.cz/en/other-legal-areas/new-czech-personal-data-processing-act-2019/
  6. dlapiperdataprotection.com/index.html?t=law&c=CZ
  7. cms.law/en/int/expert-guides/cms-expert-guide-to-data-protection-and-cyber-se
  8. linklaters.com/insights/data-protected/data-protected---czech-republic
  9. iclg.com/practice-areas/cybersecurity-laws-and-regulations/czech-republic
  10. arws.cz/news-at-arrows/compliance-with-the-requirements-of-the-office-for-per

Next for Czechia: Digital Payments & FintechLicensing regime

Next topic

Orientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026