GDPR for Employees (Czech Republic)

The GDPR requires the controller to take appropriate technical and organisational measures and requires people who process data under its authority to act only on its instructions (Articles 24, 29 and 32). Neither the Regulation nor Act No. 110/2019 Sb. prescribes a particular course or a record of it. Training employees is a common way to meet these duties.

No. You receive a certificate of completion: it shows that you have gone through the course and passed the test. It is not a regulated qualification, and the course has not been approved or accredited by the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ) or any other authority. It does not entitle you to act as a data protection officer and does not replace training that your employer may require. Whether the course meets the company's needs is for the employer to decide.

The employer is the controller and must draw up its own internal policy or rules for handling personal data, inform employees about the processing of their data (Article 13), keep a record of processing activities where required (Article 30), give you instructions for your post and systems, conclude contracts with processors, assess risks, have a procedure for personal data breaches and for requests from people, and provide a contact for the data protection officer where one must be appointed or has been appointed voluntarily. A general course cannot take over this responsibility.

The General Data Protection Regulation (EU 2016/679), Act No. 110/2019 Sb. on personal data processing, including the age of a child for consent (§ 7) and administrative penalties, the protection of employee privacy in § 316 of the Labour Code (zákoník práce), the rodné číslo (the Czech personal identification number) under § 13c of Act No. 133/2000 Sb. and the criminal offence of unauthorised handling of personal data under § 180 of the Criminal Code (trestní zákoník). Regulations can change. You will find current information at uoou.gov.cz.

GDPR fines are imposed on controllers and processors, that is usually on companies, not on ordinary employees. For public authorities and public bodies, the Office waives the imposition of an administrative penalty under § 62(5) of Act No. 110/2019 Sb. An employee may, however, face consequences under employment law and, for unauthorised handling of data that causes serious harm, criminal liability under § 180 of the Criminal Code. The course explains this in the last lesson.

Only within the limits of § 316 of the Labour Code. The employer may interfere with an employee's privacy only for a serious reason arising from the special nature of its activity and must inform you directly of the scope and methods of monitoring. It may check, proportionately, that the ban on using work equipment for personal purposes is respected. A specific case is assessed by the employer, the data protection officer or the Office; the course gives you the general framework.

The course covers rules that apply in all workplaces. Some fields have special rules, for example healthcare, education, finance or public administration. Ask your supervisor which further rules and systems are used where you work.

Most people need about an hour for the eight lessons and the 25-question test. You can read the lessons in parts and come back later. To pass, you need at least 80% correct answers.

Nothing happens. You will see which lessons to read again, and you can retake the test as many times as you like. The course and the test are free.

Only after you pass the test: 149 CZK for the certificate of completion as a PDF. The course and the test are free.

Every certificate has a number and a QR code. When you scan the code or enter the number on our verification page, your name, the course title and the date you passed the test are shown.

No law sets an expiry date for this kind of training. It is common practice to refresh knowledge regularly and the rules change, so the certificate shows a renewal date 24 months after you pass the test. Ask your employer what is required where you work.