The Government has submitted a draft amendment to Act No. 110/2019 Coll., on the Processing of Personal Data, the purpose of which is to adapt Czech legislation to Regulation (EU) 2025/2518 of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of the GDPR. The proposed amendment responds in particular to new European requirements concerning the handling of complaints by data subjects and coordination between the supervisory authorities of the Member States of the European Union in dealing with cross-border cases of personal data protection infringements. The amendment is proposed to take effect on 3 April 2027.
The main change is the introduction of more detailed regulation of proceedings concerning complaints filed by data subjects with the Office for Personal Data Protection (ÚOOÚ). It is newly to be expressly stipulated that a complaint constitutes an application under the Administrative Procedure Code, with the ÚOOÚ being obliged to decide on it or handle it in the manner envisaged by law. At the same time, the draft introduces an obligation to file complaints using a form prescribed by the ÚOOÚ, either in paper or electronic form.
The amendment further sets a three-month time limit for handling complaints and regulates situations in which the running of this time limit may be suspended, for example due to cross-border cooperation between European supervisory authorities or due to related proceedings being conducted. At the same time, the procedural rights of complainants are strengthened, as they are to be given the opportunity to comment on the preliminary assessment of the matter before a decision is issued.
A significant part of the proposed regulation also concerns cross-border complaints under the GDPR. The draft introduces special rules for communication between the ÚOOÚ, supervisory authorities of other Member States and the European Data Protection Board (EDPB), including the possibility of using the English language in certain cases.
One of the objectives of the amendment is to make the handling of complaints more efficient, prevent the misuse of procedural rights and, at the same time, preserve the effective protection of data subjects’ rights guaranteed by the GDPR. The proposed regulation thus represents a further step towards unifying procedural rules for personal data protection within the European Union and brings significant changes to proceedings before the Office for Personal Data Protection.
Download Legal Update 06/2026 here.