Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
Czechia applies GDPR through the Personal Data Processing Act, enforced by the ÚOOÚ. Its NIS2 transposition, the Act on Cybersecurity (Act No. 264/2025 Coll.), has been fully in force since 1 November 2025, ahead of several larger EU member states still finalizing their own laws.
Content reviewed 2026-09-08 , informational, not legal advice. Confirm current requirements with the authority linked below or your own counsel.
EU-wide regulation on personal data processing, directly applicable in Czechia without transposition.
SourceCzechia's national data protection act, in force since 24 April 2019. Uses GDPR's opening clauses to, among other things, lower the digital age of consent to 15 and cap certain fines related to crime-prevention/national-security processing at CZK 10,000,000.
SourceCzechia's NIS2 transposition act, approved 26 June 2025, published 4 August 2025, in force since 1 November 2025, replacing the prior Act No. 181/2014 Coll. Regulated entities must notify NÚKIB within 60 days of meeting scope criteria.
Source72 hours
GDPR Article 33 applies uniformly: notify the ÚOOÚ without undue delay and, where feasible, within 72 hours of becoming aware of a breach. Separate from Act No. 264/2025 Coll.'s own cybersecurity-incident reporting regime (24-hour initial notification / 72-hour initial assessment to NÚKIB), which applies to regulated NIS2 entities' significant cyber incidents rather than personal-data breaches.
Notify: ÚOOÚ
SourcePublished legal maximums, not a personalized estimate, not legal advice.
GDPR Article 83(5)
Up to €20,000,000 or 4% of total worldwide annual turnover of the preceding financial year, whichever is higher
SourceAct No. 264/2025 Coll. (Cybersecurity Act / NIS2)
Up to CZK 250,000,000 or 2% of worldwide annual turnover for higher-obligations (essential) entities, whichever is higher; up to CZK 175,000,000 or 1.4% for lower-obligations (important) entities. Procedural breaches capped separately at CZK 100,000
The CZK figures function as floors rather than absolute ceilings for very large multinational turnovers, since the percentage calculation can exceed them.
SourceApplicable , as of 2026-09-08
Fully transposed and in force. Act No. 264/2025 Coll. was approved 26 June 2025, published 4 August 2025, entered into force 1 November 2025, replacing the prior Act No. 181/2014 Coll., following a European Commission reasoned opinion issued 7 May 2025 for the missed October 2024 deadline. NÚKIB (National Cyber and Information Security Agency) supervises; regulated entities self-identify and must notify NÚKIB within 60 days of meeting scope criteria.
SourceOffice for Personal Data Protection(ÚOOÚ)
Visit authority siteYes. The Act on Cybersecurity (Act No. 264/2025 Coll.) entered into force on 1 November 2025, replacing the earlier Act No. 181/2014 Coll. Regulated entities have 60 days from meeting scope criteria to notify NÚKIB and be registered.
The Office for Personal Data Protection (ÚOOÚ), based in Prague, is the national GDPR supervisory authority.
Regulated entities must submit an initial notification within 24 hours of detecting an incident, an initial assessment within 72 hours for incidents with significant impact, and a status or final report within 30 days of that assessment.
Talk to us about scoping an engagement around your specific regulatory context.
