← FFCheckWho do I contact?CS
Privacy · Czechia
Updated September 2026

🔐 A company leaked or misuses my data — who do I report it to?

Direct answer

Under the GDPR you can demand from any company what it holds on you, correction and deletion, and it must answer within a month. Write to the company's data protection officer first. If it ignores you, misuses your data or lost it in a breach, complain to Úřad pro ochranu osobních údajů (ÚOOÚ) (234 665 111) — the data protection authority in Czechia; it investigates and fines, free of charge. Identity misuse after a leak: also the police, Policie ČR — oznámení (158), and your bank.

Call firstÚřad pro ochranu osobních údajů (ÚOOÚ)
Report toPolicie ČR — oznámení
If that failsdTest — vzory žádostí

🗣️ What to say

"Under Article 15 GDPR I request a copy of all personal data you hold on me, its sources and recipients, within one month. Under Article 17 I request deletion of [what]. Please confirm in writing."

🪜 Step by step

  1. Write to the companyAccess request (Art. 15), deletion (Art. 17) or objection (Art. 21). One month to answer; keep the date.
  2. Collect proofThe e-mails, the breach notification, screenshots of the misuse, unsolicited calls or mails that show your data was passed on.
  3. Complain to Úřad pro ochranu osobních údajů (ÚOOÚ)Online form. Attach your request and the non-answer. The authority contacts the company and can order and fine.
  4. Identity misuse: Policie ČR — oznámeníIf someone opened accounts or bought in your name after a leak, report it to the police and tell your bank.
  5. DamagesGDPR gives a right to compensation for material and non-material damage; consumer organisations run collective claims after large breaches.

📇 All contacts

Úřad pro ochranu osobních údajů (ÚOOÚ)Complaints against companies, inspections, finesWhen the company does not answer within a month or misuses data📞 234 665 111🔗 uoou.gov.cz
Policie ČR — oznámeníReport identity misuseWhen accounts or orders were made in your name📞 158🔗 www.policie.cz/clanek/oznameni-trestneho-cinu.aspx
dTest — vzory žádostíTemplates for GDPR access and deletion requestsFor the request to the company📞 299 149 009🔗 www.dtest.cz/vzory

❓ Frequently asked

The company says it needs my data for "legitimate interest"

You can object (Art. 21); for direct marketing the objection is absolute — they must stop.

How long does the authority take?

Months, sometimes longer; but a complaint on file is what forces the company to answer, and fines follow patterns of complaints.

I keep getting spam calls

Register on the national do-not-call list where it exists, object to the caller in writing, and report the number to Úřad pro ochranu osobních údajů (ÚOOÚ).

📎 Sources

Last checked: 2026-09-26

🔎 Common searches

Recognise your own search? The answer above covers all of these.

  • “report data breach Czechia”
  • “data protection authority Czechia”
  • “GDPR complaint company”
  • “company won't delete my data”
  • “identity theft after data leak”

🧭 Is this still correct?

We check this information carefully, but phone numbers, websites and rules change — and sometimes we get something wrong. Spotted a mistake or a change? Let us know below.

🔗 Related questions

💳Scammed online→🆔Identity theft→

Your tools for Czechia

Before it goes wrongCan I?What is allowed, what is not, which permit you need — with the official source.Energy · CzechiaElectricity & gasThe rules that protect you as an electricity and gas customer in Czechia, and who to contact. Every fact is checked on an official source.Recognise it firstIs dit veilig?Check a phone number, website or message against 47,000 scam dossiers.