If you want to win Czech companies as customers or partners, sooner or later you will ask: which kind of outreach is allowed? GDPR is not a blanket ban on prospecting – but together with Czech law and, for senders based in Germany, the German UWG, it sets clear limits. The rules for email are particularly strict.

Company data vs. personal data

GDPR protects natural persons, not legal entities. A company's name, Czech company ID (IČO), registered office and general contact details as listed in the Czech Business Register or ARES are therefore generally not personal data.

This changes with named individuals: jan.novak@company.cz is personal data, even in a B2B setting. The same applies to sole traders, whose name, business address – often their home address – and phone number identify a natural person.

Legitimate interest as the legal basis

If you process personal data for outreach, the usual legal basis is legitimate interest under Art. 6(1)(f) GDPR. Recital 47 recognises that direct marketing may be a legitimate interest. The processing must pass a three-part test:

  • Purpose: do you pursue a genuine, specific business interest, such as a relevant offer for a clearly defined audience?
  • Necessity: is processing personal data actually needed for that purpose?
  • Balancing: does your interest outweigh the rights and reasonable expectations of the person concerned?

Document the outcome in a legitimate interest assessment. You must also inform the people concerned under Art. 14 GDPR when you did not collect the data from them, and honour any objection under Art. 21 GDPR immediately.

Email marketing: consent required in the Czech Republic

Alongside GDPR, the Czech Republic applies Act No. 480/2004 Coll. on certain information society services, which implements the EU ePrivacy Directive. Under Section 7, commercial communications by electronic means generally require the recipient's prior consent. There is an exception for existing customers: if you obtained an email address in connection with a sale, you may promote your own similar products as long as the recipient can easily object at any time.

According to the Czech data protection authority ÚOOÚ, the consent requirement also applies to businesses and to general addresses such as info@company.cz. An email address that is publicly available is not consent.

If you advertise from Germany, German unfair competition law may also apply: under Section 7(2) UWG, email advertising without prior express consent is unlawful, including in B2B.

Phone and post

  • Phone: Czech rules for calling businesses are less strict than for email, but GDPR applies as soon as you work with data about natural persons. For senders based in Germany, Section 7(2) UWG requires at least presumed consent for phone advertising to businesses.
  • Post: letters to business addresses are the least sensitive channel legally. Anyone who objects is not contacted again.

Practical rules for any outreach

  • Relevance first: contact only companies for which your offer makes objective sense.
  • Disclose the source: say where you got the contact, for example from a public register.
  • Respect objections: keep a suppression list and match new lists against it.
  • No deception: sender and purpose must be clear.
  • Document: record why legitimate interest prevails in your case.

This article is for information only and is not legal advice. For your specific situation, consult a qualified lawyer or data protection officer.

B2B outreach and GDPR are compatible. What matters is a precisely defined segment, the right channel and respect for objections. How to build such a segment is covered in How to Find B2B Contacts for Czech Companies; scope and data status of our Czech data are on the EU and other countries page (in German).