GDPR Articles 33-34, Breach Notification

Regulation (EU) 2016/679, Arts. 33-34

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 25 May 2018.

A breach notification rule binding public and private bodies.

As of 24 August 2026.

What it requires

Notify UOOU within 72 hours of becoming aware of a personal-data breach affecting a person in the Czech Republic, and notify affected individuals without undue delay where the breach is likely to result in a high risk to them.

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

A controller must notify UOOU within 72 hours of becoming aware of a personal-data breach, and notify the affected individual without undue delay where the breach is likely to result in a high risk. One commentary source (CMS) states Czech controllers may report a breach in limited scope or with delay in circumstances protecting Czech national interests; Act 110/2019 does not contain such a clause, so it is reported here as an unverified commentary claim rather than a confirmed derogation.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
processes_biometrics

Read the law

GDPR Arts. 33-34
CMS commentary (unverified against Act 110/2019's own text)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app