Czechia

The Czech add-on law is Act No. 110/2019 Sb. on personal data processing. It does not narrow the reach of the European Regulation. It adds Czech-specific detail. That covers the age of a child's consent and the exemption for journalism and academic work. It also covers the status of the Office for Personal Data Protection, and separate rules for police and national security work. The cybersecurity layer is different and narrower. The Cybersecurity Act No. 264/2025 Sb. applies where you supply a listed service in Czechia. It does not depend on where your company is based. A foreign provider caught by it must register on the national cyber agency's portal like anyone else. Over 4,800 organisations had registered by early February 2026. That gives you a sense of how wide the net is drawn.

Industry by industry, checked on 18 August 2026. GAMBLING. The strictest rule. Under the Gambling Act, the server for an internet game must sit on the territory of a European Union member state. The same goes for the server for technical games. We rate this closed at the European border, not the Czech border. GOVERNMENT CLOUD. A real wall, with a published way out. You may want to be listed in the state's cloud catalogue at the 'high' security grade. Then you must store customer data and certain operational data only in European Union or European Free Trade Association countries. The national cyber agency publishes a list of services that fail this test but stay in the catalogue under an exemption. That list currently includes services from Microsoft Ireland Operations Limited and Amazon Web Services EMEA SARL. We rate this closed, with a case-by-case exemption route. TELECOMS. No rule on where data must sit. But there is a six-month duty to keep traffic and location records. See question seven. BANKING, PAYMENTS, INSURANCE, SECURITIES. We found no rule requiring data to stay in the country, checked 18 August 2026. The Czech National Bank's published position on banking secrecy lets a bank hand customer data to an outsourcing provider without customer consent. The contract must impose secrecy duties matching the bank's own. The Bank's cloud guidance follows the European supervisors' outsourcing guidelines and names no country. Europe's Digital Operational Resilience Regulation has applied since 17 January 2025. It requires supplier contracts to say where data is handled. It does not require any particular location. HEALTH. We found no rule requiring data to stay in the country, checked 18 August 2026, confidence medium. Czech health records law sets long keeping periods. We found no location requirement on the health ministry's own sites. DEFENCE AND CLASSIFIED. Any information system handling classified information must be certified by the national cyber agency before it is switched on. That is an approval step rather than a stated border. It still blocks ordinary foreign cloud. MAPPING AND GEOSPATIAL. We found no rule requiring data to stay in the country, checked 18 August 2026. The land survey office publishes conditions for supplying spatial data and treats much of it as open data. EDUCATION AND E-COMMERCE. We found no rule requiring data to stay in the country, checked 18 August 2026.

Europe uses an approved-country list. Approved destinations as at 18 August 2026 are as follows. Andorra, Argentina and Brazil (new, 26 January 2026, mutual). Canada, for commercial organisations only. The Faroe Islands, Guernsey, the Isle of Man, Israel and Japan. Jersey, New Zealand and South Korea (first review confirmed 23 July 2026). Switzerland and the United Kingdom (renewed 19 December 2025, running to 2031). Uruguay and the European Patent Organisation. It covers the United States too, but only for companies signed up to the European Union-United States Data Privacy Framework. None has been withdrawn or suspended. The 2021 standard contractual clauses are still the set to use, and they have not been amended. The promised new clauses, for recipients already directly caught by the European Regulation, have still not been adopted. So most companies use the 2021 clauses and switch off the duplicated terms. Binding corporate rules are still available. The narrow one-off exceptions, such as the person's explicit consent, are not a basis for routine bulk transfers. One point catches people out. European guidance finalised in June 2025 confirms that an order from a foreign authority is not by itself a lawful reason to hand data over. The list is full, and it is the same list for every European Union country. So there is no Czech-specific advantage or trap here. The Czech regulator's own legal page points straight at the European Regulation as the rule that governs.

Four bodies matter. The Office for Personal Data Protection is the general privacy regulator. Its president serves a five-year term. The President of the Republic appoints them on the Senate's proposal. They may serve at most two terms in a row. Its 2025 annual report records 2,514 complaints and 1,340 notifications. That is a 68 percent rise on the year before, and the highest since the European Regulation started. It also records 392 personal data breach reports, 27 inspections opened and 13 completed, and 7 fines totalling 14,671,000 Czech koruna. The largest single fine was 7,500,000 Czech koruna, about 350,000 US dollars, against a private company that misused national identification numbers. It also closed an inspection into facial recognition at Prague's Václav Havel Airport, which was switched off on 1 August 2025. Its published 2026 inspection plan targets several areas. Data protection officers in the public sector. Debt registers. Marketing messages disguised as satisfaction surveys. The gambling exclusion database. Passenger name records. And the European asylum, visa and Schengen systems. That is an active regulator with modest fines, not an aggressive one. The National Cyber and Information Security Agency, known as NÚKIB, runs the Cybersecurity Act. It set up a registration portal and took 4,825 registrations by 8 February 2026. It publishes its own decrees. It keeps the public exemption list for the government cloud catalogue. The Czech Telecommunication Office is the country's Digital Services Coordinator for the European platform rules. There is a real gap here. Its own 2025 annual report says the national enabling law had not been adopted. So it could not certify out-of-court dispute bodies, trusted flaggers or vetted researchers. It could not carry out inspections or impose penalties. It handled 98 complaints in 2025 anyway. So on platform regulation, Czechia is closer to dormant than active. The Czech National Bank supervises banks, insurers, investment firms and payment providers. It is the competent authority for Europe's financial resilience rules, which have applied since 17 January 2025.

Minimums we confirmed from official sources. Six months for telecoms traffic and location data under the Electronic Communications Act, with the detail set by Decree No. 357/2012 Sb. Ten years for customer registration and identity data, and for gaming-token transaction records, under the Gambling Act. Two years for betting records. One year for recordings of live betting. Under the Cybersecurity Act, the agency's decrees set logging and record-keeping duties for registered organisations. The supplier-reporting duty for strategically significant services runs to one year from designation. Accounting and tax minimums exist, but we could not tie exact periods to a Czech government page. Treat them as medium confidence. The Accounting Act is being completely rewritten. The Ministry of Finance says a long lead-in is needed, because roughly 150 other laws are affected. The date most often mentioned is 1 January 2027. Do not build a deletion schedule on that assumption without checking. On the maximum side, Czechia adds no national deletion deadline of its own. The general European storage limitation principle applies unchanged. The Czech regulator's 2026 inspection plan targets how long debt registers keep consumer data. That tells you where it expects to find data kept too long.

Deadline one, privacy. You have 72 hours from becoming aware, reporting to the Office for Personal Data Protection under the European Regulation. The Office received 392 such reports in 2025. Deadline two, cybersecurity. Act No. 264/2025 Sb. has applied since 1 November 2025. An organisation in the higher tier reports within 24 hours of detection. The agency then decides how significant it is. The lower tier reports detailed information within 72 hours, with a final report within 30 days. Deadline three, finance. Europe's Digital Operational Resilience Regulation has applied since 17 January 2025. It sets its own reporting chain for major incidents, running to the Czech National Bank. The overlap is where things go wrong. A registered bank hit by ransomware that exposes customer records is running all three deadlines from the same moment. There are three different recipients, three different forms and three different definitions of what counts. Build the decision tree before the incident, not during it.

One. Act No. 110/2019 Sb. sets the age at which a child can consent to an online service at fifteen. The European default is sixteen. Other member states range from thirteen to sixteen. If your age gate is hard-coded to a single European number, you are wrong in Czechia. Two. Section 180 of the Czech Criminal Code makes unauthorised handling of personal data a crime, carrying a prison sentence. This sits alongside the administrative fine, not instead of it. Individual managers are exposed, not just the company. We could not open an official copy of the section text, so we have marked the prison ranges as unconfirmed. Three. Section 62(5) of Act No. 110/2019 Sb. stops the Office for Personal Data Protection from fining a public authority or public body. The Office has publicly said this is why it could not fine a ministry. It can still issue corrective orders. It cannot fine. So if your data sits with a Czech public authority, there is no financial deterrent. Your leverage is the corrective order and a compensation claim. Four. The Constitutional Court upheld the six-month telecoms retention duty as constitutional in 2019, in case Pl. ÚS 45/17. On 8 January 2026 the Supreme Court ruled in case 30 Cdo 2556/2025. It held that blanket, undifferentiated retention conflicts with European Union law. It ordered the state to apologise to a journalist whose data had been kept. The Supreme Court cannot strike a law down. So the duty still binds operators, while the state is liable for imposing it. That is unstable, and it is the most likely thing to change in the next year. Five. The Czech Telecommunication Office is the named Digital Services Coordinator for the European platform rules. But on its own account for 2025, it lacked the national legal authority to run inspections or impose penalties. It also could not certify dispute bodies, trusted flaggers or vetted researchers. Do not treat a Czech postal address for a platform regulator as a Czech enforcement risk yet. One more trap, for banks. Czech banking secrecy under the Act on Banks is a separate duty from privacy law. Outsourcing is allowed without customer consent. But the contract must impose secrecy duties equal to the bank's own. A standard European supplier contract alone does not meet this.

Dated items. 12 January 2027. Under Europe's Data Act, which has applied since 12 September 2025, all cloud switching charges and data egress fees must be zero. This is a commercial deadline, not a filing deadline. It lands on providers selling into Czechia like everywhere else. The Czech national law naming a competent authority is still pending. The telecoms regulator expects to be named data coordinator. 1 January 2028 and 1 January 2029. Act No. 60/2026 Sb. on data management and controlled access to data was signed on 28 April 2026. It phases in a national data catalogue and central registration of public bodies' datasets. Unknown date, 2026 or 2027. The digital economy bill would give the Czech Telecommunication Office powers to inspect and penalise under the European platform rules. It was moving through the Chamber of Deputies in March 2026. Until it passes, the coordinator has no power to act. Unknown date. A legislative answer to the Supreme Court's data retention ruling. A draft amendment to Decree No. 357/2012 Sb. was in the government's consultation system. Nothing is repealed yet. POWERS THAT CAN BE USED WITHOUT A NEW LAW. These matter more than the bills. First, under the Cybersecurity Act the government can issue a warning about a named supplier of security-critical components for strategically significant services. It can also ban that supplier. This needs no new law and could remove a vendor from your systems overnight. Second, the national cyber agency controls the exemption list for the government cloud catalogue. It could stop publishing an exemption for a named service, which would force public sector customers off it. Third, the cyber agency issues its own decrees setting security measures. So the technical bar can rise without parliament.