What Is Act No. 110/2019 Coll., "Zákon o zpracování osobních údajů" (Act on Personal Data Processing)?
Czechia is an EU member state, so the GDPR applies directly alongside Act No. 110/2019 Coll., the Act on Personal Data Processing. The current consolidated text is version 4, effective 1 August 2025, and reflects amendments effective in 2025; no later version was shown in the portal's displayed history. The Act creates conditional national layers for information duties, access, restriction, recipient notification, research, journalism, expression, and automated processing. Its journalism and expression provisions create substantial but conditional derogations only where necessary for the expressive purpose and subject to statutory safeguards. Scientific, historical, and statistical research must use minimization, access restriction, pseudonymization, encryption, and non-identifying forms where achievable. No statutory route expressly named for "data brokers" was located — a "not located," not "confirmed nonexistent," finding. UOOU nevertheless provides directly relevant guidance for private online databases built from public-register data: public availability does not permit unlimited further processing, and a person may first object to the database operator and then complain to UOOU if the objection is rejected or unanswered after roughly 30 days.
At a glance
- Full name
- Act No. 110/2019 Coll., "Zákon o zpracování osobních údajů" (Act on Personal Data Processing)
- Short code
- Act No. 110/2019 Coll.
- Jurisdiction
- Czechia
- Enacted
- 2019
- Last major update
- Current consolidated text version 4 effective 1 August 2025, reflecting Act No. 448/2024 effective 1 January 2025, Act No. 218/2025 effective 1 July 2025, and Act No. 230/2025 effective 1 August 2025
- Regulator
- Office for Personal Data Protection (UOOU)
- Private right of action
- Limited
Scope, who Act No. 110/2019 Coll. covers
Protected data
Data subject rights
Right to information under GDPR Articles 12–14, with Section 8 permitting remote-publication delivery for legally required processing and Section 11 restrictions potentially applying
Right of access under Article 15, subject to Section 11 restrictions and proportionate or delayed application for research under Section 16
Right to rectification under Article 16, with research and expression-related qualifications
Right to erasure under Article 17, with journalism and expression requests directed to other applicable rules under Section 20
Right to restriction under Article 18; Section 13 does not allow restriction to override a statutory transfer or disclosure duty, and restricted data must be marked
Right to data portability under Article 20, subject to possible restriction or proportionate application for journalism and expression purposes
Right to object under Article 21, including a narrower journalism objection requiring concrete reasons that the subject’s interest outweighs the publication interest
Protection against solely automated decisions under Article 22, subject to the conditional journalism and expression rules
Right to complain to UOOU with the suspected controller or processor, processing activity, alleged violation, data categories, supporting documents, source links, and complainant identity and contact details; UOOU’s current form distinguishes a GDPR complaint by a person directly affected by the processing from a general initiative about processing that affects someone else
Right to judicial remedy when three months pass without progress or outcome information from UOOU
Right to object to a private online database using personal data copied from a public register; an operator may request additional identity information where reasonably necessary but cannot require a notarized signature or an ID-card copy
Notable features
Czechia combines directly applicable GDPR rights with substantial but conditional national rules for journalism, academic, artistic, and literary expression, plus proportionate research safeguards. UOOU’s public-register guidance states that public availability does not permit unlimited private-database processing and that an objection cannot be conditioned on a notarized signature or an ID-card copy.
Enforcement & penalties
Regulator: Office for Personal Data Protection (UOOU)
Penalties: GDPR Article 83 structure applies generally. No separate Czech fine schedule was located that replaces Article 83 for ordinary GDPR Title II controllers; Section 62 classifies GDPR and rights violations as offenses but states no Czech maximum there. Narrow Czech-specific figures include CZK 1 million or CZK 5 million for listed publication-prohibition violations under Section 61, CZK 10 million for specified criminal-law-enforcement offenses under Section 63, CZK 1 million or CZK 10 million for legal-person birth-number violations under Act 133/2000, and up to CZK 100,000 for a natural-person birth-number violation.
Private right of action: UOOU complaints and judicial remedies, including the three-month GDPR Article 78(2) trigger when no progress or outcome information is provided, are the identified mechanisms. A general private damages route was not located in the report.
Relevance to data brokers
No statutory route expressly named for "data brokers" was located — a "not located," not "confirmed nonexistent," finding. UOOU provides a strong public-register/private-database analog: first object to the private database operator, usually under GDPR Article 21 where legitimate interest is relied on, then complain to UOOU if there is no response or a rejection after a reasonable period, which UOOU cites as roughly 30 days. UOOU’s current materials distinguish a GDPR complaint by the person directly affected by the processing from a general initiative about processing affecting another person. This is not an automatic right to delete the originating government register or a guaranteed downstream-database removal.
Generate requests in under 60 seconds
Explore 1,034 US/global data brokers
FAQ
What is Czechia’s current national data-protection act?+
Act No. 110/2019 Coll., the Act on Personal Data Processing, enacted 12 March 2019 and effective 24 April 2019. The current consolidated text shown in the report is version 4, effective 1 August 2025.
Can I object to a private database copied from a public register?+
Yes, according to UOOU guidance. Public availability does not permit unlimited further processing. A person should first object to the private database operator; if the operator does not respond or rejects the objection after a reasonable period, roughly 30 days, the person may complain to UOOU with the objection and response or non-response evidence.
How can I submit a Czech data-protection complaint?+
Use UOOU’s current complaint materials and provide the controller or processor, processing activity, alleged violation, relevant data, supporting documents, source links, and your identity and contact details. UOOU publishes postal, data-box, email, and in-person channels; its materials distinguish a GDPR complaint by the person directly affected from a general initiative about processing that affects someone else. This route does not guarantee a removal outcome.
Does Czechia have a dedicated data-broker removal route?+
No statutory route expressly named for "data brokers" was located — a "not located," not "confirmed nonexistent," finding. UOOU’s public-register/private-database objection guidance is a directly relevant analog, but it is not an automatic right to delete the originating government register or a guaranteed downstream-database removal.
Official sources & citations
Other international privacy regimes
Act No. 110/2019 Coll. sits in a global ecosystem of data-protection laws. Start with these comparative frameworks, or visit the privacy research hub for the complete jurisdiction index: