Czechia

The national top-up law is Act No. 110/2019 Sb. on personal data processing. It does not narrow the territorial reach of the European Regulation; it adds Czech-specific detail such as the age of a child's consent, the journalistic and academic exemption, the status of the Office for Personal Data Protection, and the separate regime for police and national security processing. The cybersecurity layer is different and narrower: the Cybersecurity Act No. 264/2025 Sb. attaches to the provision of a listed service in Czechia rather than to the company's nationality, and a foreign provider caught by it must register on the national cyber agency's portal like anyone else. Over 4,800 organisations had registered by early February 2026, which is a useful sign of how wide the net is drawn in practice.

Sector by sector, checked on 18 August 2026. GAMBLING — the hardest wall. The Gambling Act requires that the server for an internet game, and the server for technical games, be located on the territory of a European Union member state. Rated data must stay in the country at the European border rather than the Czech border. GOVERNMENT CLOUD — a real wall with a published escape hatch. To be listed in the state's cloud catalogue at the 'high' security grade, a provider must store customer data and certain operational data at rest only in European Union or European Free Trade Association countries. The national cyber agency publishes a list of services that fail this test but are catalogued anyway under an exemption, which currently includes services from Microsoft Ireland Operations Limited and Amazon Web Services EMEA SARL. Rated data must stay in the country with a case-by-case exemption route. TELECOMS — no storage location rule, but a six-month duty to keep traffic and location records, discussed under Q7. BANKING, PAYMENTS, INSURANCE, SECURITIES — no localisation rule found, checked 18 August 2026. The Czech National Bank's published position on banking secrecy allows a bank to hand customer data to an outsourcing provider without customer consent, provided the contract imposes secrecy duties matching the bank's own. The Bank's cloud guidance adopts the European supervisors' outsourcing guidelines and does not name a country. Europe's Digital Operational Resilience Regulation has applied since 17 January 2025 and requires the location of data processing to be written into supplier contracts, but it does not require a location. HEALTH — no localisation rule found, checked 18 August 2026, confidence medium. Czech health records law sets long retention periods but we found no territorial requirement on the health ministry's own sites. DEFENCE AND CLASSIFIED — any information system that handles classified information must be certified by the national cyber agency before it is switched on. That is an approval gate rather than a stated border, but in practice it blocks ordinary foreign cloud. MAPPING AND GEOSPATIAL — no localisation rule found, checked 18 August 2026. The land survey office publishes conditions for supplying spatial data and treats much of it as open data. EDUCATION AND E-COMMERCE — no localisation rule found, checked 18 August 2026.

The model is a European allowlist. Approved destinations as at 18 August 2026: Andorra, Argentina, Brazil (new, 26 January 2026, mutual), Canada for commercial organisations only, the Faroe Islands, Guernsey, the Isle of Man, Israel, Japan, Jersey, New Zealand, South Korea (first review confirmed 23 July 2026), Switzerland, the United Kingdom (renewed 19 December 2025, running to 2031), Uruguay, the United States but only for companies that have signed up to the European Union-United States Data Privacy Framework, and the European Patent Organisation. None has been withdrawn or suspended. The 2021 standard contractual clauses remain the operative set and have not been amended; the promised new clauses for importers already directly caught by the European Regulation have still not been adopted, so market practice is to use the 2021 clauses and switch off the duplicated terms. Binding corporate rules remain available. The narrow one-off exceptions, such as the individual's explicit consent, are not a basis for routine bulk transfers. A separate point that catches people: European guidance finalised in June 2025 confirms that an order from a foreign authority is not by itself a lawful reason to hand data over. The list is populated and it is the same list for every European Union country, so there is no Czech-specific advantage or trap here. The Czech regulator's own legal framework page points straight at the European Regulation as the operative instrument.

Four bodies matter. The Office for Personal Data Protection is the general privacy regulator. Its president serves a five-year term, appointed by the President of the Republic on the Senate's proposal, and may serve at most two consecutive terms. Its 2025 annual report records 2,514 complaints and 1,340 notifications, a 68 percent year-on-year rise and the highest since the European Regulation started; 392 personal data breach notifications; 27 inspections opened, 13 completed; 7 fines totalling 14,671,000 Czech koruna; and a largest single fine of 7,500,000 Czech koruna, about 350,000 US dollars, for a private company misusing national identification numbers. It also closed an inspection into facial recognition at Prague's Václav Havel Airport, which was switched off on 1 August 2025. Its published 2026 inspection plan targets data protection officers in the public sector, debt registers, marketing messages disguised as satisfaction surveys, the gambling exclusion database, passenger name records, and the European asylum, visa and Schengen systems. That is an active regulator with modest fine levels, not an aggressive one. The National Cyber and Information Security Agency, known as NÚKIB, runs the Cybersecurity Act. It stood up a registration portal, took 4,825 registrations by 8 February 2026, publishes its own decrees, and maintains the public exemption list for the government cloud catalogue. The Czech Telecommunication Office is the country's Digital Services Coordinator for the European platform rules. Here there is a real gap: its own annual report for 2025 says that because the national enabling law had not been adopted it could not certify out-of-court dispute bodies, trusted flaggers or vetted researchers, and could not carry out inspections or impose penalties. It handled 98 complaints in 2025 anyway. So on platform regulation specifically, Czechia is closer to dormant than active. The Czech National Bank supervises banks, insurers, investment firms and payment providers, and is the competent authority for Europe's financial resilience rules, which have applied since 17 January 2025.

Floors we verified from official sources: six months for telecoms traffic and location data under the Electronic Communications Act, with the detailed scope set by Decree No. 357/2012 Sb.; ten years for customer registration and identity data and for gaming-token transaction records under the Gambling Act; two years for betting records; one year for recordings of live betting. Under the Cybersecurity Act the agency's decrees set logging and record-keeping duties for registered organisations, and the supplier-reporting duty for strategically significant services runs to one year from designation. Accounting and tax floors exist but we could not pin exact periods to a Czech government page during this run, so treat them at medium confidence: the Accounting Act is being completely rewritten and the Ministry of Finance says a long lead-in is needed because roughly 150 other laws are affected, with 1 January 2027 the date most often mentioned. Do not plan a deletion schedule on that assumption without checking. On the ceiling side, Czechia adds no national deletion deadline of its own. The general European storage limitation principle applies unchanged, and the Czech regulator's 2026 inspection plan explicitly targets how long debt registers keep consumer data, which tells you where it expects to find over-retention.

Clock one, privacy: 72 hours from becoming aware, to the Office for Personal Data Protection, under the European Regulation. The Office received 392 such notifications in 2025. Clock two, cybersecurity: under Act No. 264/2025 Sb., in force since 1 November 2025, an organisation in the higher regime reports within 24 hours of detection, and the agency then decides on significance; the lower regime reports detailed information within 72 hours, with a final report within 30 days. Clock three, finance: Europe's Digital Operational Resilience Regulation has applied since 17 January 2025 and sets its own major-incident reporting chain to the Czech National Bank. The overlap is the operational failure point. A registered bank suffering a ransomware attack that exposes customer records is running all three clocks from the same moment, with three different recipients, three different forms and three different definitions of what counts. Build the decision tree before the incident, not during it.

One. Act No. 110/2019 Sb. sets the age at which a child can consent to an information society service at fifteen. The European default is sixteen, and other member states range from thirteen to sixteen. If your age gate is hard-coded to a single European number you are wrong in Czechia. Two. Section 180 of the Czech Criminal Code makes unauthorised handling of personal data a criminal offence, carrying imprisonment. This sits alongside, not instead of, the administrative fine. Individual managers, not just the company, are exposed. We were unable to open an official copy of the section text during this run, so the prison ranges are marked unconfirmed. Three. Section 62(5) of Act No. 110/2019 Sb. prevents the Office for Personal Data Protection from imposing an administrative penalty on a public authority or public body. The Office has publicly said this is why it could not fine a ministry. Corrective orders remain available, fines do not. Practical effect: if your data sits with a Czech public authority, financial deterrence is absent and your leverage is the corrective order and a compensation claim. Four. The six-month telecoms retention duty was upheld as constitutional in 2019 by the Constitutional Court in case Pl. ÚS 45/17. On 8 January 2026 the Supreme Court, in case 30 Cdo 2556/2025, held that blanket and undifferentiated retention conflicts with European Union law and ordered the state to apologise to a journalist whose data had been kept. The Supreme Court cannot strike a law down. So the duty remains binding on operators while the state is simultaneously liable for imposing it. That is an unstable position and it is the single most likely thing to change in the next year. Five. The Czech Telecommunication Office is the designated Digital Services Coordinator for the European platform rules but, on its own account for 2025, lacked the national statutory authorisation to run inspections or impose sanctions, or to certify dispute bodies, trusted flaggers and vetted researchers. Do not read a Czech postal address for a platform regulator as a Czech enforcement risk yet. Bonus trap for banks: Czech banking secrecy under the Act on Banks is a separate duty from privacy law. Outsourcing is allowed without customer consent, but the contract must impose secrecy obligations equivalent to the bank's own. A standard European processor contract alone does not satisfy this.

Dated items. 12 January 2027 — under Europe's Data Act, which has applied since 12 September 2025, all cloud switching charges and data egress fees must be zero. This is a hard commercial deadline, not a filing obligation, and it lands on providers selling into Czechia like everywhere else. The Czech national law naming a competent authority is still pending; the telecoms regulator expects to be named data coordinator. 1 January 2028 and 1 January 2029 — Act No. 60/2026 Sb. on data management and controlled access to data, signed on 28 April 2026, phases in a national data catalogue and central registration of public bodies' datasets. Unknown date, 2026 or 2027 — the digital economy bill, which would give the Czech Telecommunication Office inspection and sanction powers under the European platform rules. It was moving through the Chamber of Deputies in March 2026. Until it passes, the coordinator has no teeth. Unknown date — a legislative response to the Supreme Court's data retention ruling. A draft amendment to Decree No. 357/2012 Sb. was in the government's consultation system. Nothing is repealed yet. DORMANT SWITCHES, which matter more than bills. First: under the Cybersecurity Act the government can issue a warning about, or ban, a named supplier of security-critical components for strategically significant services. That power can be exercised without a new law and would remove a vendor from your architecture overnight. Second: the national cyber agency controls the exemption list for the government cloud catalogue and can, in principle, stop publishing an exemption for a named service, which would force public-sector customers off it. Third: the cyber agency issues its own decrees setting security measures, so the technical bar can rise without parliament.