Operates a social platform, in the Czech Republic

Act on Certain Information Society Services (Zákon č. 480/2004 Sb., o některých službách informační společnosti), Sections 3 to 6 · Read the law's page

• To stay free of liability for information users store on your service, act promptly once you demonstrably learn that the content or the user's conduct is unlawful: take every step that can be required of you to remove or block access to the information.
• Do not exercise a direct or indirect decisive influence on the user's activity, because a hosting provider that does so is always liable for the stored content.
• To keep the caching exemption, act at once to remove or block the cached information once you learn that it was removed or blocked at its original source or that a court ordered its withdrawal or blocking.

Video-Sharing Platform Services Act (Zákon č. 242/2022 Sb., o službách platforem pro sdílení videonahrávek), Sections 7(1)(b) and (c), 8, 11 and 13 · Read the law's page

• If you provide a video-sharing platform service established in Czechia, adopt measures that protect the general public from content containing incitement to violence or hatred against a group of persons, and from content whose dissemination is a criminal offence, such as public incitement to commit a terrorist offence, child pornography offences and racism and xenophobia offences, without filtering uploads or checking them in advance.
• Where appropriate, run a transparent, user-friendly mechanism that lets users report or flag such content on your platform, tell the user how the report or flag was handled without undue delay and no later than 60 days after it, and run an effective complaints procedure for users about how these measures are carried out.
• Send the Council for Radio and Television Broadcasting any change to your protection measures at least 15 days before you make it.

Zakon c. 242/2022 Sb., o sluzbach platforem pro sdileni videonahravek, Sec. 7, Sec. 8 and Sec. 11 · Read the law's page

• Applies to providers of video-sharing platform services established or deemed established in the Czech Republic (an information-society service whose main purpose, or an essential function, is to make programmes or user-generated videos available to the public without the provider bearing editorial responsibility).
• Adopt measures protecting minors from programmes, user-uploaded videos and commercial communications capable of harming their physical, psychological or moral development, and do not make such content available so that a minor could ordinarily see or hear it.
• Where appropriate, introduce and operate an age-verification system for platform users confronting such content, together with easily usable content-rating tools, parental-control systems and a transparent notice-and-complaint procedure.
• Apply the strictest access-control measures to the most harmful content, such as pornography or gross gratuitous violence.

Act No. 264/2025 Coll., Cybersecurity Act, Sections 13-14 · Read the law's page

• Adopt and implement organisational and technical security measures adequate and proportionate to securing the regulated service's proper provision and the cybersecurity of the assets you use to provide it, within a scope you determine and must regularly review.
• If you are in the higher-obligations regime and do not provide a service listed in Section 18(1), cover at least: an information security management system, top-management requirements, security roles, security-policy and documentation management, asset management, risk management, supplier management, human-resources security, change management, acquisition and development security, access management, handling of cybersecurity events and incidents, business-continuity management and cybersecurity auditing, plus physical security, communications-network security, identity administration and access-rights management, detection, logging and evaluation of cybersecurity events, application security, cryptographic algorithms, availability assurance, and, where applicable, security of industrial, control or similarly specific technical assets.
• If you are in the lower-obligations regime and do not provide a service listed in Section 18(1), a reduced set applies: a minimum cybersecurity assurance system, top-management requirements, asset management, risk management, human-resources security, business-continuity management, access management, identity and authorisation management, detection and logging of cybersecurity events, incident handling, communications-network security, application security, and cryptographic algorithms.
• If you provide a DNS resolution, trust, top-level-domain registry, cloud computing, data-centre, content-delivery-network, online-marketplace, internet-search-engine, social-networking-platform, managed or managed-security service, adopt appropriate and proportionate measures covering at least risk management, security-policy and documentation management, incident handling, business continuity, supplier management, secure acquisition, development and maintenance, application security, human-resources security, cryptography, access management and identity administration, to the extent and in the manner the Commission's NIS2 implementing regulation sets; Section 13(2) does not apply to that service.
• Where a supplier implements a security measure on your behalf, select that supplier consistent with the measure's requirements and write those requirements into your contract with the supplier.
• This binds a poskytovatel regulované služby (provider of a regulated service) under Sections 3 to 5, drawn from 15 named sectors, where you are a medium or large enterprise under Commission Recommendation 2003/361/EC or are otherwise significant for essential social, economic or security functions regardless of size; Section 18 names an online marketplace, an internet search engine and a social-networking-platform provider among the digital-infrastructure-and-services sector's regulated services. The wider sector classes this binds (public administration, energy, manufacturing, food, chemicals, water, waste, transport, financial markets, healthcare, science and education, postal and courier services, defence, and space) are reached too, by declaring that you are an essential or important entity.

Act No. 264/2025 Coll., Cybersecurity Act, Sections 15-16 · Read the law's page

• If you are in the higher-obligations regime, notify NÚKIB no later than 24 hours after detecting a qualifying cybersecurity incident, with an initial report giving your identifying details, basic incident data, and whether you believe the incident was caused by an unlawful intervention or could have a cross-border impact.
• If you are in the lower-obligations regime, notify the Národní CERT on the same 24-hour clock instead, for a qualifying incident with significant impact on your service's provision.
• For an incident with significant impact, follow with a report no later than 72 hours after detection that updates your initial assessment and gives the incident's impact and, where available, indicators of compromise.
• If you provide a trust service under the directly applicable EU regulation, submit the notification of an incident with significant impact within 24 hours after detection, not 72.
• Submit an interim report on request, and a final report no later than 30 days after submitting the notification under Section 16(3)(a) (the 72-hour notification, or the 24-hour one for a trust-service provider), or, if the incident is still ongoing at that point, a progress report followed by a final report within 30 days of resolution.
• If you provide a DNS resolution, top-level-domain registry, cloud computing, data-centre, content-delivery-network, online-marketplace, internet-search-engine, social-networking-platform, managed or managed-security service, report every incident with significant impact on that service, with significance set by the Commission's NIS2 implementing regulation; the procedure in Sections 15 and 16 still applies unless that regulation sets a special one.
• Report through NÚKIB's Portál Úřadu where you can; otherwise a higher-obligations provider emails NÚKIB or uses its data-box address, and a lower-obligations provider does the same with the Národní CERT.
• This binds a poskytovatel regulované služby under Sections 3 to 5, which Section 18 extends by name to an online marketplace, an internet search engine and a social-networking-platform provider among other digital-infrastructure-and-services roles; the wider sector classes are reached as on this jurisdiction's companion security-measures row.

Decree No. 408/2025 Coll., on Regulated Services, Sections 2 and 3 and the Annex · Read the law's page

• When you assess the significance conditions, convert the euro amounts in Commission Recommendation 2003/361/EC at the Czech National Bank's rate for the last day before the assessed calendar year (Section 2(2)).
• If you provide a service listed in the Annex to Decree No. 408/2025 and meet its significance conditions, you are a provider of a regulated service under Section 4 of the Cybersecurity Act, in the higher-obligations or lower-obligations regime the Annex assigns; the sector classes the Annex covers are reached by declaring that you are an essential or important entity.

Decree No. 409/2025 Coll., on Security Measures of a Higher-Obligations Provider, Sections 3 to 26 · Read the law's page

• Run an information security management system: set its objectives, manage risks under Section 8, and adopt security measures proportionate to the cybersecurity needs of the regulated service (Section 3).
• Have your statutory body or equivalent top management complete the training under Section 10(3)(a) and see that the security policy and the objectives of the management system are set (Section 4).
• Adopt measures on security roles, security policy and documentation, risk management, suppliers, human-resources security, change management, acquisition, development and maintenance, access management, handling of events and incidents, cybersecurity audit, identity administration, detection, logging and evaluation of events, application security, cryptographic algorithms and availability of the regulated service (Sections 5 to 26).
• Set a plan for cybersecurity audits and audit whether the measures the Act and this decree require are in place and comply with law, internal rules, contracts and best practice (Section 16).
• If you are a provider of a regulated service in the higher-obligations regime under the Cybersecurity Act, matching NIS2's essential entities, this decree sets what the security measures required by Section 13 of the Act must contain; the sector classes of Decree No. 408/2025 are reached by declaring that you are an essential entity.

Decree No. 410/2025 Coll., on Security Measures of a Lower-Obligations Provider, Sections 3 to 14 · Read the law's page

• Introduce and carry out security measures proportionate to your security needs, and at least those in Section 3(2) to (6) and Sections 4 to 6 and 10 (Section 3(1)).
• Keep an overview of the security measures you have introduced, will introduce with deadlines, priority and a responsible person, and have not introduced with reasons; update it and evaluate the measures' effectiveness at least once a year; keep each version for at least four years (Section 3(2)).
• Set the tolerable level of harm from a cybersecurity incident and the areas for assessing the significance of an incident's impact on the regulated service (Section 14).
• If you are a provider of a regulated service in the lower-obligations regime under the Cybersecurity Act, matching NIS2's important entities, this decree sets what the security measures required by Section 13 of the Act must contain; the sector classes of Decree No. 408/2025 are reached by declaring that you are an important entity.