Czech Republic

Whoever produces, imports, exports, transports, offers, makes publicly accessible, mediates, puts into circulation, sells or otherwise supplies to another a photographic, film, computer, electronic or other pornographic work depicting or otherwise using a person the offender knows did not consent to that depiction or use, faces up to two years' imprisonment, a ban on activity, or forfeiture of property; the offence does not require the image to be a photograph of a real event and reaches a synthetic or digitally altered depiction of a real person's likeness made without consent.

The penalty rises to six months to three years where the act causes significant harm, is committed by a member of an organized group, is committed through the press, film, radio, television, a publicly accessible computer network or a similarly effective means, or is committed to obtain a significant benefit. It rises further to one to five years where it causes large-scale harm, is committed by a group operating across multiple states, or is committed to obtain a large-scale benefit.

Whoever possesses a photographic, film, computer, electronic or other pornographic work depicting or otherwise using a child or a person who appears to be a child faces up to two years' imprisonment, and the same penalty applies to gaining access to child pornography through information or communication technology; the offence's own text extends to a person who merely appears to be a child, so an entirely AI-generated or synthetic depiction with no real child victim is reached the same way as an authentic image.

Producing, importing, exporting, transporting, offering, making publicly accessible, mediating, putting into circulation, selling, or otherwise supplying such a work, or profiting from it, carries six months to three years. That rises to two to six years or forfeiture of property where committed by an organized group, through the press, film, radio, television, a publicly accessible computer network or a similarly effective means, or to obtain a significant benefit.

It rises further to three to eight years where committed by a group operating across multiple states or to obtain a large-scale benefit.

A controller must notify UOOU within 72 hours of becoming aware of a personal-data breach, and notify the affected individual without undue delay where the breach is likely to result in a high risk. One commentary source (CMS) states Czech controllers may report a breach in limited scope or with delay in circumstances protecting Czech national interests; Act 110/2019 does not contain such a clause, so it is reported here as an unverified commentary claim rather than a confirmed derogation.

The Czech Republic gives the General Data Protection Regulation (GDPR) domestic effect through Act No. 110/2019 Coll., in force since 24 April 2019, replacing the pre-GDPR Act No. 101/2000 Coll. Read via the Office for Personal Data Protection's own English translation, it is predominantly procedural: it establishes the supervisory authority's powers, administrative-offense and fine procedures, and processing by competent authorities for criminal-law purposes transposing Directive (EU) 2016/680. It adds no substantive lawful-basis or controller and processor rules beyond GDPR.

A transfer of personal data outside the EEA requires an adequacy decision, appropriate safeguards such as Standard Contractual Clauses or Binding Corporate Rules, or a narrow Article 49 derogation, backed by the Article 83(5)(c) top fine tier. Commentary sources confirm the Czech Republic has adopted no further domestic derogation.

General Data Protection Regulation (GDPR) Articles 12-22 (access, rectification, erasure, restriction, portability, objection, and Article 22 automated-decision rights) apply directly; Act 110/2019 adds no distinct national rights found, exercisable against the controller within GDPR's own one-month (extendable to three-month) response window.

UOOU (Office for Personal Data Protection) is the Czech Republic's supervisory authority, empowered under Act 110/2019 to impose General Data Protection Regulation (GDPR) Article 83 fines. GDPR Article 82 arms an individual with a direct private right of action.

The Czech Republic's genuine national addition beyond that baseline is Act No. 179/2024 Coll. on Collective Civil Court Proceeding, together with the accompanying Act No. 180/2024 Coll., in force 1 July 2024, transposing Directive (EU) 2020/1828 on representative actions; only registered qualified entities may bring such an action.

The act's title, in-force date of 1 July 2024, and structure are confirmed through zakonyprolidi.cz, a widely used private legal database rather than the official gazette; as of an October 2025 commentary report only two entities were registered and one unrelated action had been filed.

General Data Protection Regulation (GDPR) Article 9(1) treats biometric data processed for unique identification as a special category, prohibited absent an Article 9(2) ground. Act 110/2019 has no biometric-specific provision narrowing or elaborating this, consistent with two independent commentary sources describing no distinct Czech biometric restriction beyond the general EU-law enabling clause.

General employee monitoring sits in the Labour Code (zakonik prace, Act No. 262/2006 Coll.), but that Act's text is not independently confirmed here, and no specific employment-biometric consent or works-council provision appears in commentary; this is a genuine gap, not a confirmed absence.

Whoever overcomes a security measure and thereby gains unauthorized access to a computer system or part of it faces up to two years' imprisonment, a ban on activity, or forfeiture of property; authorization under Czech criminal law therefore turns on whether a technical security measure was circumvented, not merely on whether a website's terms of use were violated.

A separate paragraph reaches unauthorized use, deletion, alteration, forgery, insertion or transmission of data, or another interference with a computer system's software or hardware, carrying up to three years.

The penalty rises to six months to four years where the act is committed with intent to cause damage or gain an unauthorized benefit, or to restrict a computer system's functionality; to one to five years where committed by an organized group, causes significant damage, targets a computer system whose disruption would seriously affect the state, public health, safety, the economy, or the population's basic needs, secures a significant benefit, or seriously disrupts a business; and to three to eight years for large-scale damage or a large-scale benefit.

A person does not infringe copyright by reproducing a lawfully accessed work for the purpose of automated textual and data analysis carried out to obtain information such as patterns, trends and correlations, and may keep the resulting copy only for as long as the analysis requires, per Section 39c(1).

That general licence does not apply where the rightholder has expressly reserved the use in a suitable way, including, for a work made available online, a machine-readable reservation, per Section 39c(2); a scraper mining a work so reserved needs the rightholder's authorization.

A separate, non-waivable exception in Section 39d lets a university carrying out scientific research, or a legal person whose main purpose is scientific research or education including research, mine a lawfully accessed work regardless of any rightholder reservation.

A database is a collection of independent works, data or other elements, systematically or methodically arranged and individually accessible by electronic or other means, per Section 88.

Its maker, the person who at their own responsibility obtained, verified or presented its content with a qualitatively or quantitatively substantial investment, holds the exclusive right to use the whole content or a qualitatively or quantitatively substantial part of it and to authorize another to do so, per Sections 88a and 90.

Repeated and systematic extraction or re-utilization of insubstantial parts is also prohibited where it conflicts with the normal exploitation of the database or unreasonably prejudices the maker's legitimate interests. The right lasts fifteen years from the database's making, or from its first making available to the public if that occurs within that period, per Section 93, and a fresh substantial investment in the database restarts the term.

An authorized user who uses the database lawfully made available to the public does not infringe the right by using a qualitatively or quantitatively insubstantial part for any purpose, provided that use is normal, proportionate and not systematic or repeated.

Unauthorized use of a database is an administrative offence a natural person may be fined up to CZK 150,000 for, and a legal person or a natural person acting in business up to CZK 150,000, before the municipal authority with extended competence in whose district the offence was committed.

Section 13 requires a provider of a regulated service, within the scope it determines for its own assets, to adopt and implement organisational and technical security measures adequate to secure the regulated service's proper provision and the cybersecurity of its assets.

Section 14(1) sets at least 14 organisational measure categories for a provider in the higher-obligations (essential-entity) regime, including an information security management system, top-management requirements, security roles, security-policy and documentation management, asset, risk, supplier and change management, human-resources security, acquisition and development security, access management, incident handling, business-continuity management and cybersecurity auditing, plus at least 11 technical measure categories including physical security, communications-network security, identity and access-rights administration, event detection, logging and evaluation, application security, cryptographic algorithms, availability assurance, and security of industrial or control-system assets.

Section 14(2) sets a reduced 13-category combined list for a provider in the lower-obligations (important-entity) regime. Section 18 extends this duty expressly to a provider of DNS resolution, trust, top-level-domain registry, cloud computing, data-centre, content-delivery-network, online-marketplace, internet-search-engine, social-networking-platform, managed-service or managed-security-service offerings, transposing NIS2 Article 21.

Section 15 requires a provider in the higher-obligations regime to report a qualifying cybersecurity incident directly to NÚKIB, and a provider in the lower-obligations regime to report to the Národní CERT. Section 16 sets a graduated notification clock, transposing NIS2 Article 23.

An initial report is due no later than 24 hours after detecting the incident, giving the provider's identifying details, basic incident data, and whether the provider believes the incident was caused by an unlawful intervention or could have a cross-border impact.

For an incident with significant impact, a follow-up report is due no later than 72 hours after detection, updating that assessment and giving an initial evaluation of the incident's impact and, where available, indicators of compromise.

An interim report is due on NÚKIB's or the Národní CERT's request, and a final report is due no later than 30 days after the 72-hour report; if the incident is still ongoing at that point, a progress report is due instead, followed by a final report within 30 days of resolution. A provider reports through NÚKIB's Portál Úřadu where possible; a higher-obligations provider otherwise emails NÚKIB or uses its data-box address, and a lower-obligations provider does the same with the Národní CERT.

A provider of an audiovisual media service on demand must choose suitable measures so that a programme capable of disrupting a minor's physical, psychological or moral development, such as pornography or gross gratuitous violence, cannot ordinarily be seen or heard by a minor; those measures include age-verification tools or other technical measures that prevent a minor from accessing the programme.

The provider must also give sufficient, freely and easily accessible information about the potentially harmful content a programme carries. Personal data of minors collected for this purpose may not be processed for commercial ends such as direct marketing, profiling or behaviourally targeted advertising. A breach of this duty is an administrative offence the Council for Radio and Television Broadcasting may fine up to CZK 2,000,000.

A provider of a video-sharing platform service must adopt measures protecting minors from programmes, user-uploaded videos and commercial communications capable of harming their physical, psychological or moral development, and content of that kind may not be made available so that a minor could ordinarily see or hear it; the measures must include, among others, the introduction and operation of an age-verification system for platform users confronting such content, together with easily usable content-rating tools, parental-control systems, and a transparent notice-and-complaint procedure.

The most harmful content, such as pornography or gross gratuitous violence, must be subject to the strictest access-control measures. A provider that fails to introduce these protection measures commits an administrative offence the Council for Radio and Television Broadcasting may fine up to CZK 500,000.

A press publisher established in an EU or EEA member state holds the exclusive right to reproduce its press publication and make it available online, and an information-society service provider needs the publisher's authorization before using it, per Section 87b(3)-(4). The right does not reach an individual private user's non-commercial use, a bare hyperlink, or the use of single words or very short, insignificant extracts, per Section 87b(8).

It lasts two years from the publication's release, per Section 87b(6). A service provider negotiating the required authorization must deal with the publisher in good faith on equal and non-discriminatory terms and pay a reasonable fee, per Section 87b(9); if the parties cannot agree a fee within 60 days of the start of negotiations, either side may ask the Ministry of Culture to set it, per Section 87b(11)-(12).

A service provider that fails to negotiate in good faith or refuses to supply the data the Ministry needs to set the fee commits an administrative offence the competent municipal authority may fine up to CZK 500,000 or 1 percent of the offender's total annual worldwide turnover, whichever is higher.

A person does not infringe copyright by reproducing a work, including a press publication, for the purpose of automated textual and data analysis carried out to obtain information such as patterns, trends and correlations, and may keep the copy only for as long as that analysis requires, per Section 39c(1).

That general licence does not apply to a work whose author has expressly reserved the analysis in a suitable way, including through machine-readable means for a work made available online, per Section 39c(2); a news aggregator indexing text so reserved therefore needs the rightholder's authorization.

A separate, non-waivable exception in Section 39d lets a university carrying out scientific research, or a legal person whose main purpose is scientific research or education including research, mine a lawfully accessed work without regard to any rightholder reservation.