If you want to win Czech companies as customers or partners, sooner or later you will ask: which kind of outreach is allowed? GDPR is not a blanket ban on prospecting – but together with Czech law and, for senders based in Poland, the Polish Electronic Communications Law, it sets clear limits. The rules for email are particularly strict.

Company data vs. personal data

GDPR protects natural persons, not legal entities. A company's name, Czech company ID (IČO), registered office and general contact details as listed in the Czech Business Register or ARES are therefore generally not personal data.

This changes with named individuals: jan.novak@company.cz is personal data, even in a B2B setting. The same applies to sole traders, whose name, business address – often their home address – and phone number identify a natural person.

Legitimate interest as the legal basis

If you process personal data for outreach, the usual legal basis is legitimate interest under Art. 6(1)(f) GDPR. Recital 47 recognises that direct marketing may be a legitimate interest. The processing must pass a three-part test:

  • Purpose: do you pursue a genuine, specific business interest, such as a relevant offer for a clearly defined audience?
  • Necessity: is processing personal data actually needed for that purpose?
  • Balancing: does your interest outweigh the rights and reasonable expectations of the person concerned?

Document the outcome in a legitimate interest assessment. You must also inform the people concerned under Art. 14 GDPR when you did not collect the data from them, and honour any objection under Art. 21 GDPR immediately.

Email marketing: consent required in the Czech Republic

Alongside GDPR, the Czech Republic applies Act No. 480/2004 Coll. on certain information society services, which implements the EU ePrivacy Directive. Under Section 7, commercial communications by electronic means generally require the recipient's prior consent. There is an exception for existing customers: if you obtained an email address in connection with a sale, you may promote your own similar products as long as the recipient can easily object at any time.

According to the Czech data protection authority ÚOOÚ, the consent requirement also applies to businesses and to general addresses such as info@company.cz. An email address that is publicly available is not consent.

Senders based in Poland must also observe Article 398 of the Polish Electronic Communications Law (prior consent for e-mail and phone marketing). Since 10 November 2024 it has prohibited sending commercial information, including direct marketing, by e-mail, phone or SMS without the recipient's prior consent – and it covers businesses too, so B2B is included.

Phone and post

  • Phone: Czech rules for calling businesses are less strict than for email, but GDPR applies as soon as you work with data about natural persons. Senders based in Poland must also observe Article 398 of the Polish Electronic Communications Law (prior consent for e-mail and phone marketing), including when calling businesses.
  • Post: letters to business addresses are the least sensitive channel legally. Anyone who objects is not contacted again.

Practical rules for any outreach

  • Relevance first: contact only companies for which your offer makes objective sense.
  • Disclose the source: say where you got the contact, for example from a public register.
  • Respect objections: keep a suppression list and match new lists against it.
  • No deception: sender and purpose must be clear.
  • Document: record why legitimate interest prevails in your case.

This article is for information only and is not legal advice. For your specific situation, consult a qualified lawyer or data protection officer.

B2B outreach and GDPR are compatible. What matters is a precisely defined segment, the right channel and respect for objections. How to build such a segment is covered in How to Find B2B Contacts for Czech Companies; scope and data status of our Czech data are on the Czech company database page.