Czech data protection and GDPR for small business

Small Czech businesses tend to treat GDPR as something that happened to them in May 2018 and was dealt with by a cookie banner and a privacy page. The regulator sees a continuing set of duties that apply to any firm with customers, staff or a mailing list. The gap between those views is where complaints and inspections begin.

This is a plain-language overview, not legal advice. The regulation is long, and a firm handling unusual data, such as health or children's data, should take specialist advice.

The legal framework

The General Data Protection Regulation (EU) 2016/679 applies directly in every member state and has since 25 May 2018. Czechia supplements it with Act no. 110/2019 Coll. on personal data processing, which covers matters the regulation leaves to national law. Electronic marketing and cookies fall under separate national rules implementing EU ePrivacy requirements: the Act on Certain Information Society Services (no. 480/2004 Coll.) for marketing e-mails and the Electronic Communications Act (no. 127/2005 Coll.) for cookies.

The supervisory authority is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ). It handles complaints, carries out inspections, publishes guidance in Czech and partly in English, and can impose fines.

What counts as personal data

Personal data is any information relating to an identified or identifiable person: a name, email address, phone number, IP address, photograph, customer record, CCTV image. Your employees' records and your clients' contact details are personal data, and so is what appears on a sole trader's invoice.

GDPR applies if you process such data in the course of an establishment in the EU, which a Prague firm plainly has. It covers paper files as well as databases.

The core duties

Know why you hold data. Every use needs a lawful basis under Article 6: consent, a contract, a legal obligation, a vital interest, a public task or legitimate interests. Choose the one that really fits. Consent is often the weakest, because it must be freely given and can be withdrawn. Sending an invoice rests on contract and legal obligation, not consent.

Tell people what you do. A privacy notice should say who you are, what you collect, why, on what basis, how long you keep it, who receives it and what rights people have. It should be in language the reader understands, which for Czech customers means Czech.

Collect only what you need, and keep it only as long as you need it. A newsletter signup does not need a date of birth. A job applicant's CV should not sit in a drawer for years after the post was filled.

Secure it. The regulation requires appropriate technical and organisational measures. For a small firm that means access controls, backups, device encryption, strong passwords and limited staff access. Most reported breaches are lost laptops, misdirected emails and phishing.

Use processors properly. If an outside supplier handles data for you, such as an accountant, payroll bureau or cloud tool, you will in most cases need a processing agreement under Article 28. Transfers of data outside the EU carry extra requirements.

Rights of individuals

People may ask to see their data, correct it, have it deleted in certain cases, restrict processing, move it to another provider and object to some uses. You normally have one month to respond, with limited extensions (as of 2026; check the official source). Set up a simple route, such as a dedicated email address, and decide who answers. A request that arrives must not be ignored.

Records, officers and impact assessments

The regulation requires a record of processing activities. Article 30 exempts organisations with fewer than 250 employees, but not where processing is more than occasional, is likely to risk people's rights, or involves special categories of data. Regular processing of staff and customer data is usually not occasional, so many small firms keep a record anyway. A simple spreadsheet will do.

A data protection officer is needed only in specific cases, such as public authorities or organisations whose core activities involve large-scale monitoring or special-category data. A small shop, café or consultancy normally does not need one. A data protection impact assessment is required where processing is likely to result in a high risk, and the ÚOOÚ publishes lists of such cases (check the current lists).

Breaches

A personal data breach must be reported to the ÚOOÚ within 72 hours of becoming aware of it, unless it is unlikely to risk people's rights and freedoms (as of 2026; check the official source). If the risk is high, the people affected must be told as well. Keep an internal log of every incident, including those you decide not to report, with your reasoning.

Cookies, marketing and CCTV

A website that uses non-essential cookies or trackers needs the visitor's consent before they are set. A banner that nudges people towards "accept" is a common source of complaints. Marketing emails to individuals generally need prior consent, with a narrow exception for existing customers and similar products.

CCTV at a shop or office needs a clear purpose, signage, restricted access and a retention period. Employee monitoring faces extra limits under labour law. See how to hire your first employee and payroll duties for the staff side.

Fines

The regulation allows fines of up to EUR 20 million or 4 per cent of worldwide annual turnover for the most serious breaches, with lower maxima for others (as of 2026; check the official source). Enforcement against small businesses usually starts with a complaint, a warning or an instruction to correct. A firm that can show it has documented its decisions is in a far stronger position.

Today, write down on one page what personal data you hold, where it sits and who can see it. That page is the start of compliance, and it usually turns up a forgotten spreadsheet or two.

This is a general explainer, not legal or tax advice.