Skip to main content
Czechia · Reviewed August 2026

What Is Act No. 110/2019 Coll., "Zákon o zpracování osobních údajů" (Act on Personal Data Processing)?

Czechia is an EU member state, so the GDPR applies directly alongside Act No. 110/2019 Coll., the Act on Personal Data Processing. The current consolidated text is version 4, effective 1 August 2025, and reflects amendments effective in 2025; no later version was shown in the portal's displayed history. The Act creates conditional national layers for information duties, access, restriction, recipient notification, research, journalism, expression, and automated processing. Its journalism and expression provisions create substantial but conditional derogations only where necessary for the expressive purpose and subject to statutory safeguards. Scientific, historical, and statistical research must use minimization, access restriction, pseudonymization, encryption, and non-identifying forms where achievable. No statutory route expressly named for "data brokers" was located — a "not located," not "confirmed nonexistent," finding. UOOU nevertheless provides directly relevant guidance for private online databases built from public-register data: public availability does not permit unlimited further processing, and a person may first object to the database operator and then complain to UOOU if the objection is rejected or unanswered after roughly 30 days.

Rahul Kandoriya
Written byRahul Kandoriya·Founder, OfflistMe·Last updated August 28, 2026

At a glance

Full name
Act No. 110/2019 Coll., "Zákon o zpracování osobních údajů" (Act on Personal Data Processing)
Short code
Act No. 110/2019 Coll.
Jurisdiction
Czechia
Enacted
2019
Last major update
Current consolidated text version 4 effective 1 August 2025, reflecting Act No. 448/2024 effective 1 January 2025, Act No. 218/2025 effective 1 July 2025, and Act No. 230/2025 effective 1 August 2025
Regulator
Office for Personal Data Protection (UOOU)
Private right of action
Limited

Scope, who Act No. 110/2019 Coll. covers

The GDPR applies directly in Czechia. Act No. 110/2019 Coll. covers GDPR processing, separate criminal-law-enforcement processing, defense and security processing, certain outside-EU-law-scope automated or filing-system processing, and UOOU’s status and powers. Section 4(2) extends Title II and GDPR rules to certain automated or filing-system processing outside EU-law scope or within TEU Title V Chapter 2 activities, excluding the Act’s separate criminal-enforcement and defense-security titles.

Protected data

Personal data protected by the GDPR and the Act’s information, access, correction, erasure, restriction, objection, portability, automated-decision, security, and complaint rules. Scientific, historical, and statistical processing is subject to minimization, pseudonymization, encryption, access restriction, and non-identifying-form safeguards. Czech birth numbers are personal data but are not GDPR Article 9 special-category data and are principally regulated by separate Act No. 133/2000 Coll.

Data subject rights

Right to information under GDPR Articles 12–14, with Section 8 permitting remote-publication delivery for legally required processing and Section 11 restrictions potentially applying

Right of access under Article 15, subject to Section 11 restrictions and proportionate or delayed application for research under Section 16

Right to rectification under Article 16, with research and expression-related qualifications

Right to erasure under Article 17, with journalism and expression requests directed to other applicable rules under Section 20

Right to restriction under Article 18; Section 13 does not allow restriction to override a statutory transfer or disclosure duty, and restricted data must be marked

Right to data portability under Article 20, subject to possible restriction or proportionate application for journalism and expression purposes

Right to object under Article 21, including a narrower journalism objection requiring concrete reasons that the subject’s interest outweighs the publication interest

Protection against solely automated decisions under Article 22, subject to the conditional journalism and expression rules

Right to complain to UOOU with the suspected controller or processor, processing activity, alleged violation, data categories, supporting documents, source links, and complainant identity and contact details

Right to judicial remedy when three months pass without progress or outcome information from UOOU

Right to object to a private online database using personal data copied from a public register; an operator may request additional identity information where reasonably necessary but cannot require a notarized signature or an ID-card copy

Notable features

Czechia combines directly applicable GDPR rights with substantial but conditional national rules for journalism, academic, artistic, and literary expression, plus proportionate research safeguards. UOOU’s public-register guidance states that public availability does not permit unlimited private-database processing and that an objection cannot be conditioned on a notarized signature or an ID-card copy.

Enforcement & penalties

Regulator: Office for Personal Data Protection (UOOU)

Penalties: GDPR Article 83 structure applies generally. No separate Czech fine schedule was located that replaces Article 83 for ordinary GDPR Title II controllers; Section 62 classifies GDPR and rights violations as offenses but states no Czech maximum there. Narrow Czech-specific figures include CZK 1 million or CZK 5 million for listed publication-prohibition violations under Section 61, CZK 10 million for specified criminal-law-enforcement offenses under Section 63, CZK 1 million or CZK 10 million for legal-person birth-number violations under Act 133/2000, and up to CZK 100,000 for a natural-person birth-number violation.

Private right of action: UOOU complaints and judicial remedies, including the three-month GDPR Article 78(2) trigger when no progress or outcome information is provided, are the identified mechanisms. A general private damages route was not located in the report.

Relevance to data brokers

No statutory route expressly named for "data brokers" was located — a "not located," not "confirmed nonexistent," finding. UOOU provides a strong public-register/private-database analog: first object to the private database operator, usually under GDPR Article 21 where legitimate interest is relied on, then complain to UOOU if there is no response or a rejection after a reasonable period, which UOOU cites as roughly 30 days. This is not an automatic right to delete the originating government register or a guaranteed downstream-database removal.

Generate requests in under 60 seconds

Generate removal requests for 1,034 US/global profiles, $9

OfflistMe helps draft opt-out requests using the details you choose. Review the provider route and legal basis, then send from your own inbox. The tool is not legal advice and does not guarantee a broker's response.

FAQ

What is Czechia’s current national data-protection act?+

Act No. 110/2019 Coll., the Act on Personal Data Processing, enacted 12 March 2019 and effective 24 April 2019. The current consolidated text shown in the report is version 4, effective 1 August 2025.

Can I object to a private database copied from a public register?+

Yes, according to UOOU guidance. Public availability does not permit unlimited further processing. A person should first object to the private database operator; if the operator does not respond or rejects the objection after a reasonable period, roughly 30 days, the person may complain to UOOU with the objection and response or non-response evidence.

Does Czechia have a dedicated data-broker removal route?+

No statutory route expressly named for "data brokers" was located — a "not located," not "confirmed nonexistent," finding. UOOU’s public-register/private-database objection guidance is a directly relevant analog, but it is not an automatic right to delete the originating government register or a guaranteed downstream-database removal.

Official sources & citations

Other international privacy regimes

Act No. 110/2019 Coll. sits in a global ecosystem of data-protection laws. Compare with other jurisdictions that shape cross-border data flows:

United Kingdom · enacted 2018What is UK GDPR?Canada · enacted 2000What is PIPEDA?Brazil · enacted 2018What is LGPD?India · enacted 2023What is DPDP Act?Australia · enacted 1988What is Privacy Act 1988?Japan · enacted 2003What is APPI?China · enacted 2021What is PIPL?France · enacted 1978What is Loi Informatique et Libertés?Germany · enacted 2018What is BDSG?Argentina · enacted 2000What is Law 25.326?Philippines · enacted 2012What is RA 10173?South Africa · enacted 2013What is POPIA?Malaysia · enacted 2010What is Malaysia PDPA?United Arab Emirates · enacted 2021What is UAE PDPL?Republic of Korea · enacted 2011What is Korea PIPA?Netherlands · enacted 2018What is UAVG?Nigeria · enacted 2023What is NDPA?Pakistan · enacted 2016What is PECA + Art. 14?Peru · enacted 2011What is Law 29733?Saudi Arabia · enacted 2021What is PDPL?Thailand · enacted 2019What is Thai PDPA?Türkiye · enacted 2016What is KVKK?Viet Nam · enacted 2025What is Law No. 91/2025?Poland · enacted 2018What is Poland GDPR + UODO Act?Portugal · enacted 2019What is Portugal GDPR + Lei 58/2019?Romania · enacted 2018What is Romania GDPR + Law 190/2018?Bangladesh · enacted 2026What is Act No. 63 of 2026?Chile · enacted 2024What is Law 21.719?Colombia · enacted 2012What is Law 1581?Egypt · enacted 2020What is Law No. 151 of 2020?Indonesia · enacted 2022What is UU PDP?Israel · enacted 1981What is Privacy Law 5741-1981?Kazakhstan · enacted 2013What is Law No. 94-V?Mexico · enacted 2025What is LFPDPPP (2025)?Albania · enacted 2024What is Law 124/2024?Armenia · enacted 2015What is HO-49-N?Azerbaijan · enacted 2010What is Law 998-IIIQ?Bosnia and Herzegovina · enacted 2025What is Law 12/25?Hungary · enacted 2011What is Info tv. + GDPR?Iceland · enacted 2018What is Act No. 90/2018 + GDPR?Jamaica · enacted 2020What is Data Protection Act 2020?Kenya · enacted 2019What is Data Protection Act 2019?Kyrgyzstan · enacted 2025What is Digital Code?Latvia · enacted 2018What is PDL?Luxembourg · enacted 2018What is Law of 1 August 2018?Malta · enacted 2018What is Chapter 586?Republic of Moldova · enacted 2024What is Law no. 195/2024?Mongolia · enacted 2021What is Law on Personal Data Protection?Montenegro · enacted 2008What is Law on Personal Data Protection?Morocco · enacted 2009What is Law 09-08?Estonia · enacted 2018What is IKS?Georgia · enacted 2023What is Law No. 3144?Ghana · enacted 2012What is Act 843?Greece · enacted 2019What is Law 4624/2019?North Macedonia · enacted 2020What is Law 42/2020?Russian Federation · enacted 2006What is 152-FZ?Senegal · enacted 2008What is Law No. 2008-12?Serbia · enacted 2018What is Law 87/2018?Slovakia · enacted 2018What is Act No. 18/2018 Coll.?Slovenia · enacted 2022What is ZVOP-2?Sri Lanka · enacted 2022What is PDPA?Tunisia · enacted 2004What is Organic Law No. 2004-63?Ukraine · enacted 2010What is Law No. 2297-VI?Bulgaria · enacted 2001What is PDPA?Croatia · enacted 2018What is Act on the Implementation of the GDPR?Cyprus · enacted 2018What is Law 125(I)/2018?Austria · enacted 1999What is DSG?Belgium · enacted 2018What is Belgian Data Protection Act?Denmark · enacted 2018What is Databeskyttelsesloven?Finland · enacted 2018What is Data Protection Act 1050/2018?Norway · enacted 2018What is Personal Data Act?Afghanistan · enacted 2010What is Sectoral Privacy Protections?Algeria · enacted 2018What is Law No. 18-07 + Law No. 25-11?Andorra · enacted 2021What is LQPD?Angola · enacted 2011What is Law No. 22/11?Antigua and Barbuda · enacted 2013What is Data Protection Act 2013?Bahamas · enacted 2003What is DPA 2003?Bahrain · enacted 2018What is Law No. 30 of 2018?Barbados · enacted 2019What is Data Protection Act 2019-29?Belarus · enacted 2021What is Law No. 99-Z?Belize · enacted 2021What is Data Protection Act 2021?Benin · enacted 2018What is Code du numérique, Book V?Bhutan · enacted 2018What is ICM Act 2018 + NDGF 2025?Bolivia (Plurinational State of) · enacted 2009What is Art. 21(2), 25, 130–131 + Law 254?Botswana · enacted 2024What is Data Protection Act 2024?Brunei Darussalam · enacted 2025What is PDPO 2025?Burkina Faso · enacted 2021What is Loi n°001-2021/AN?Burundi · enacted 2026What is Law No. 1/03 of 2026?Cabo Verde · enacted 2001What is Lei n.º 133/V/2001?Cambodia · enacted 2019What is Fragmented privacy framework?Cameroon · enacted 2024What is Law No. 2024/017?Central African Republic · enacted 2024What is Law No. 24.001?Costa Rica · enacted 2011What is Ley 8968?Ecuador · enacted 2021What is LOPDP?El Salvador · enacted 2024What is LPDP?Dominican Republic · enacted 2013What is Ley 172-13?Sweden · enacted 2018What is GDPR + Data Protection Act?Malawi · enacted 2024What is Malawi DPA 2024?Mali · enacted 2013What is Mali Law 2013-015?Mauritania · enacted 2017What is Mauritania Law 2017-020?Mauritius · enacted 2017What is Mauritius DPA 2017?Monaco · enacted 2024What is Monaco Law 1.565?Nepal · enacted 2018What is Nepal Privacy Act 2075?Oman · enacted 2022What is Oman PDPL?Panama · enacted 2019What is Panama Ley 81/2019?Paraguay · enacted 2025What is Paraguay Law 7593/2025?Qatar · enacted 2016What is Qatar Law No. 13 of 2016?Rwanda · enacted 2021What is Rwanda Law 058/2021?Saint Lucia · enacted 2011What is Saint Lucia DPA 2011?Togo · enacted 2019What is Togo Law 2019-014?Turkmenistan · enacted 2017What is Turkmenistan Law 519-V?United Republic of Tanzania · enacted 2022What is Tanzania PDPA 2022?Uruguay · enacted 2008What is Uruguay Ley 18.331?Vanuatu · enacted 2024What is Vanuatu DPPA 2024?Zimbabwe · enacted 2021What is Zimbabwe Cyber and Data Protection Act?Chad · enacted 2015What is Chad Law 007/PR/2015?Comoros · not enacted in this profileWhat is Comoros Personal Data Law 2014?Congo · enacted 2019What is Congo Law 29-2019?Côte d'Ivoire · enacted 2013What is Côte d'Ivoire Law 2013-450?Cuba · enacted 2022What is Cuba Law 149/2022?Democratic People's Republic of Korea · enacted 2022What is DPRK Information Law materials?Democratic Republic of the Congo · enacted 2023What is DRC Digital Code 2023?Djibouti · enacted 2025What is Djibouti Digital Code 2025?Equatorial Guinea · enacted 2016What is Equatorial Guinea Law 1/2016?Eswatini · enacted 2022What is Eswatini Data Protection Act 2022?Ethiopia · enacted 2024What is Ethiopia Proclamation No. 1321/2024?Fiji · enacted 2018What is Fiji Privacy Framework?Gabon · enacted 2023What is Gabon Law 025/2023?Grenada · enacted 2023What is Grenada Data Protection Act 2023?Guinea · enacted 2016What is Guinea Law L/2016/037/AN?Guyana · enacted 2023What is Guyana Data Protection Act 2023?Haiti · enacted 2018What is Haiti 2018 Data Privacy Order?Iran (Islamic Republic of) · enacted 2003What is Iran Electronic Commerce Act 2003?Jordan · enacted 2023What is Jordan Personal Data Protection Law No. 24 of 2023?Kiribati · enacted 2025What is Kiribati Data Protection Act 2025?Kuwait · enacted 2024What is Kuwait CITRA Decision 2024/26?Lao People's Democratic Republic · enacted 2017What is Lao Law 25/NA?Lebanon · enacted 2018What is Lebanon Law 81/2018?Lesotho · enacted 2011What is Lesotho Data Protection Act 2011?Liberia · not enacted in this profileWhat is Liberia Data Protection Act 2024?Libya · enacted 2022What is Libya Law No. 6 of 2022?Liechtenstein · enacted 2026What is Liechtenstein DSG 2026?Madagascar · enacted 2015What is Madagascar Law 2014-038?Marshall Islands · enacted 2025What is Marshall Islands PDPA 2025?Mozambique · not enacted in this profileWhat is Mozambique Privacy Framework?Myanmar · enacted 2017What is Myanmar Privacy and Security Law?Nicaragua · enacted 2012What is Nicaragua Law No. 787?Niger · enacted 2022What is Niger Law No. 2022-59?Saint Kitts and Nevis · enacted 2018What is Saint Kitts and Nevis DPA No. 5 of 2018?Saint Vincent and the Grenadines · enacted 2003What is Saint Vincent and the Grenadines Privacy Act No. 18 of 2003?San Marino · enacted 2018What is San Marino Law No. 171/2018?Sao Tome and Principe · enacted 2016What is Lei n.º 03/2016?Seychelles · enacted 2023What is Seychelles Data Protection Act 2023?Somalia · enacted 2023What is Somalia Data Protection Act 2023?Syrian Arab Republic · enacted 2024What is Law No. 12 of 2024?Tajikistan · enacted 2018What is Law No. 1537?Tonga · enacted 2025What is Privacy Act 2025?Trinidad and Tobago · enacted 2011What is Trinidad and Tobago DPA 2011?Uganda · enacted 2019What is Uganda DPA 2019?United States of America · enacted 2013What is U.S. Privacy Law?Uzbekistan · enacted 2019What is Law No. O‘RQ-547?Venezuela (Bolivarian Republic of) · enacted 1999What is Constitution Article 28?Yemen · enacted 2012What is Law No. 13 of 2012?Zambia · enacted 2021What is Zambia Data Protection Act 2021?Holy See · enacted 2024What is Decree DCLVII?State of Palestine · not enacted in this profileWhat is Palestinian Data Protection Law (draft)?

Related concepts & guides