Shrnutí: The GDPR has been in effect since May 25, 2018, and has harmonized the basic rules for personal data protection in the European Union. Companies must be able to explain why they need the data, protect it, and respect people’s rights. However, consent is not required for every instance of data processing. Even in 2026, these rules continue to affect everyday shopping, internet use, and business operations. What exactly has changed, and what should you watch out for?
Not sure if your company’s operations comply? As part of a GDPR audit, we’ll review your documentation and suggest specific changes.
The acronym GDPR stands for General Data Protection Regulation. It is a directly applicable European Union regulation that governs the processing of personal data. In the Czech Republic, it is supplemented by the Act on the Processing of Personal Data. The GDPR is therefore not a Czech law, even though it is sometimes inaccurately referred to as the “GDPR Act” in everyday speech.
A legal framework for the protection of personal data existed even before the GDPR. In the Czech Republic, we followed the Personal Data Protection Act. This law was based on Directive 95/46/EC, which took effect as early as 1995. However, the problem was that each country in the European Union interpreted this directive slightly differently. The result was a fragmented legal landscape, where companies in each country had to follow different rules. With increasing globalization and the expanding digital world, this needed to be addressed.
The technology boom began as early as the 1990s. The directive from the 1990s was unable to adequately address phenomena such as social media, e-commerce, cloud storage, and mobile apps. People began to grow increasingly concerned about how easily their personal data could be misused and that they had no control over what happened to their information. Therefore, it was not only necessary but also desirable to start protecting data more effectively.
Take advantage of our GDPR audit service and find out whether all of your company’s processes are set up to comply with the law. An in-depth audit may reveal areas that need improvement. Address them before your lack of knowledge comes back to haunt you.
The main objectives the GDPR was intended to achieve are:
The European Commission drafted the GDPR as early as 2012. However, after several years of negotiations, the GDPR regulation was not finally approved until 2016, with a two-year transition period. Since May 25, 2018, it has been directly applicable in all European Union member states without the need for national legislation—which distinguishes it from the previous directive.
The introduction of the General Data Protection Regulation caused a great deal of uncertainty even before 2018. Companies, institutions, and government agencies scrambled to prepare, often out of fear of massive fines. At that time, many myths emerged ( such as the idea that you couldn’t even save an email to your address book without consent), and schools, for example, were inundated with hundreds of questions from parents.
Over time, however, the situation has calmed down. Larger companies began systematically implementing and configuring internal processes. Smaller businesses and sole proprietors typically face significantly fewer requirements, but even they had to learn, for example, how to inform clients about how their data is handled.
Visible changes included more detailed information about personal data processing on websites and a greater emphasis on who has access to the data. However, the GDPR does not mean that every registration or order must include consent. If a company needs data to provide a requested service, it may process it based on the performance of a contract. Informing the customer about data processing is a separate obligation that should not be confused with obtaining consent.
Since 2018, the nature of personal data protection has been significantly influenced by rulings from the Court of Justice of the European Union and interpretations by supervisory authorities. Companies therefore cannot rely solely on the documentation prepared during the GDPR implementation. They must also monitor how the rules apply to new technologies and specific processing methods.
A Case from the Courts: Data Transfers to the U.S.
In the Schrems II ruling of July 2020, the Court of Justice of the European Union invalidated the then-existing Privacy Shield mechanism for transferring personal data to the U.S. At the same time, it confirmed the validity of standard contractual clauses but emphasized the need to assess the actual level of protection in the destination country. For companies, the ruling thus demonstrated that simply signing a contractual document may not be sufficient for lawful data transfers.
Cookies Are Also Governed by Other Rules
Cookie banners are not solely a result of the GDPR. In the Czech Republic, consent to the storage of non-essential cookies is also based on the Electronic Communications Act; the shift to the principle of prior consent has been in effect since January 2022. Essential technical cookies may be used without consent. For all others, visitors must have the option to refuse their use. If personal data is processed via cookies, the GDPR also applies.
Tip: In recent years, services that allow people to trace their ancestry using DNA have grown in popularity. This area is also closely related to the GDPR. You can learn more about it in our article.
To help you better understand how the GDPR works, we’ll summarize a few basic terms that form the core of the entire GDPR.
The GDPR is based on seven fundamental principles:
1. Lawfulness, fairness, and transparency
2. Purpose limitation
3. Data minimization
4. Accuracy
5. Storage limitation
6. Integrity and confidentiality
7. Controller’s responsibility
This means that, for example, if someone operates a fitness center, they cannot require their customers to provide their social security number. This is because it is not necessary for the operation of the service. The fitness center must be satisfied with the customer’s name, email address, and, if necessary, phone number.
The GDPR has granted individuals a wide range of rights that protect their interests. Among the most important are:
Right to erasure: Under certain conditions, you may request that your data be deleted. However, erasure is not absolute; for example, if the controller is required by law to retain the data.
Controllers must enable the exercise of these rights and inform individuals about the processing of their data. The obligation to maintain records of processing activities has statutory exceptions; however, a small business should not automatically assume that it is exempt. Security breaches must be reported to the Office for Personal Data Protection (ÚOOÚ) within 72 hours of discovery, if possible, unless it is unlikely to pose a risk to individuals’ rights and freedoms. In cases of high risk, it is generally necessary to also notify the affected individuals.
Tip: Do you have cameras installed in the hallways of your building so you can keep track of what’s going on and prevent potential risks? You may very well be breaking the law. Read on to find out when cameras in hallways are a problem.
Although the GDPR may seem complex, in practice it boils down to ensuring that companies do not process more data than is strictly necessary, that they maintain control over the data they handle, and that they respect people’s rights during this processing.
From our experience: We’ve helped an electronics e-shop and a financial advisorcomply with the GDPR, for example. Data protection rules apply to both, but the specific settings need to be tailored to the type of data the business processes and how it uses that data.
An online store generally does not need the customer’s consent to process data necessary for accepting and delivering an order. The legal basis is the performance of a contract. Some data is subsequently retained to meet legal obligations, such as accounting requirements. However, the business must clearly explain to the customer how it handles the data and ensure its protection. The sending of newsletters is also assessed separately under the Act on Certain Information Society Services.
Do you use a single, combined consent form for orders, newsletters, and other uses of data? Have your forms and related documentation reviewed as part of a GDPR audit.
The GDPR thus represents a milestone in the field of digital privacy. Although its implementation sparked a huge wave of concern, today it has become a completely natural part of the legal culture across the European Union. It has provided greater protection of each individual’s personal data, introduced greater accountability in companies, and, above all, increased people’s awareness of what happens to their data.
The GDPR has been in effect since May 2018 and has harmonized the basic rules for personal data protection across the European Union. Companies must have a legal basis for processing data, collect only necessary data, protect it, and enable people to exercise their rights. Consent is not a universal requirement: for example, processing an order is generally based on the performance of a contract. Since the GDPR’s introduction, its practical application has been further clarified by courts and supervisory authorities. Businesses therefore need to continuously review their documentation and the actual functioning of their processes, including the use of cookies and the transfer of data abroad.
Without undue delay, no later than one month after receiving the application. In the case of complex or numerous applications, the deadline may be extended by an additional two months, but the applicant must be notified of the extension and the reasons for it within the first month.
Processing requests is generally free of charge. In the case of manifestly unfounded or excessive requests, the controller may, under the conditions set forth by law, charge a reasonable fee or refuse to comply with the request. The controller must be able to substantiate the reasons for doing so.
Yes, if the data is part of a record or is to be included in one. Examples include systematically organized customer cards or employee files.
No. The obligation depends on statutory conditions, such as the large-scale, regular, and systematic monitoring of individuals or the large-scale processing of sensitive data as part of the organization’s core activities. The mere fact of conducting business does not give rise to this obligation.
The general registration requirement for data controllers was abolished with the GDPR. However, companies must continue to fulfill the relevant obligations and be able to demonstrate that their processing activities comply with the rules.
Our team of experienced attorneys will help you solve any legal issue. Within 24 hours we’ll evaluate your situation and suggest a step-by-step solution, including all costs. The price for this proposal is only CZK 690, and this is refunded to you when you order service from us.
Ondřej is the attorney who came up with the idea of providing legal services online. He's been earning his living through legal services for more than 15 years. He especially likes to help clients who may have given up hope in solving their legal issues at work, for example with real estate transfers or copyright licenses.
Ondřej is the attorney who came up with the idea of providing legal services online. He's been earning his living through legal services for more than 15 years. He especially likes to help clients who may have given up hope in solving their legal issues at work, for example with real estate transfers or copyright licenses.
We’ll review your case and suggest how to resolve it for CZK 690.
In person and online. Just choose the appropriate service or opt for an independent consultation when you are unsure.
