Is cold email legal in Czechia?

We hear this question in almost every demo. The answer is less convenient than we would like, given that we build an outreach tool. That is exactly why we are writing it down in full.

Important: This article is general information, not legal advice. It is based on the law and the Czech data protection authority’s public answers as of 26 September 2026. Talk to a lawyer who knows your situation before you launch a campaign.

The short answer

In Czechia you generally may not email a commercial offer to someone who has not given you prior consent. This applies to business addresses too. The exception is your existing customers, and only under specific conditions.

Many people believe the GDPR and “legitimate interest” are enough. They are not. Two different sets of rules apply to email outreach, and each answers a different question.

Two sets of rules, two different questions

The GDPR decides whether you may process personal data: whether you may store a person’s name, work email and job title and work with them.

Recital 47 says that processing personal data for direct marketing purposes may be regarded as carried out for a legitimate interest under Article 6(1)(f). You still have to be able to defend that interest: weigh it against the person’s interests and write the assessment down. And under Article 21, the person can object to direct marketing at any time.

Act No. 480/2004 Coll., on certain information society services, deals with something else: whether you may send a commercial communication electronically. Here the rule is stricter.

In other words, the GDPR may allow you to hold the data. That does not yet mean you may send an email with an offer.

What Act No. 480/2004 Coll. says

Section 2 of the Act defines a commercial communication very broadly: any form of communication meant to promote goods, services or the image of a business, directly or indirectly, including advertising and invitations to visit a website. A typical “we’d love to offer you our services” email is a commercial communication.

The key part is Section 7 (the link goes to the Czech text):

Subsection 2: you may use someone’s electronic contact details to send commercial communications only with their prior consent.
Subsection 3: an exception for your customers. If you obtained a customer’s email in connection with a sale, you may send them offers for your own similar products or services. They must have a clear, simple and free way to refuse, both when you collect the address and in every message.
Subsection 4: every commercial email must be clearly marked as a commercial communication, must not hide the sender, and must include a valid address where the recipient can opt out.

The Act treats both individuals and companies as “users”. A business address does not change anything.

What the Czech data protection authority says

In Czechia, commercial communications are supervised by the Office for Personal Data Protection (ÚOOÚ). Its website has an FAQ on Act No. 480/2004 Coll. (in Czech), and the answers are very direct:

Business or person, any difference? “Act No. 480/2004 Coll. does not distinguish between types of recipient.” There is no B2B exception.
Addresses published on the internet? Asked whether you may write to addresses published on a website, the authority answers: “You may not.” You may only send commercial communications to those who consented in advance.
Bought databases? Consent given “generally”, to an undefined group of companies, is not informed consent according to the authority.
A “customer” for the Section 7(3) exception is, according to the authority, someone who has entered into a contract with you. Someone who only downloaded your brochure is not a customer in this sense.
Fines: up to CZK 100,000 for individuals and up to CZK 10,000,000 for companies.

The authority also says that responsibility lies with the business the message promotes, not only with whoever sends it. Handing the sending to an agency or a tool does not hand over the responsibility.

What this means in practice

For Czech recipients it comes down to one thing: email offers to people who have consented, or to your existing customers.

There are many honest ways to get consent: at a conference, through a form on your website, at a webinar, or when a person contacts you first. What matters is that you can prove it.

A few questions we get asked most:

Other countries have other rules. Each EU country has implemented the European rules in its own way, and some are milder for business addresses. If you contact companies abroad, check the rules of that country.
LinkedIn and other channels. Whether and how Act No. 480/2004 Coll. applies to a personal LinkedIn message is less clear than for email. Do not treat it as a free pass; ask a lawyer.
The GDPR always applies. Even where you may write, you must tell the person who you are, where you got their data and how to contact you (GDPR Article 14). If they say no, you stop.

What every commercial message must contain

Whether you write to a customer or to someone who has consented, under Section 7(4) the message must:

be clearly marked as a commercial communication,
show who is sending it, with nothing hidden,
include a valid opt-out address that works for free and straight away.

Keep your list of people who opted out permanently. Once someone unsubscribes, you never send them an offer again.

What HypeLead does, and what it doesn’t

HypeLead helps with the parts that can be solved technically:

It adds a footer to every email that marks it as an offer, names your company and includes a one-click unsubscribe.
Your contacts get their own privacy notice page, which the footer links to.
Once someone unsubscribes, the app sends them nothing more.
Data is hosted in the EU.

What HypeLead does not do is decide who you may write to. That decision, and the responsibility as the sender, is yours. No tool, ours included, can turn outreach that isn’t allowed into outreach that is.

Summary

The GDPR and legitimate interest are about data. Act No. 480/2004 Coll. is about whether you may email an offer.
In Czechia you need prior consent for a commercial email, even to business addresses. Existing customers are the exception.
Every commercial message must be marked, show the sender and offer an opt-out.
When in doubt, talk to a lawyer.

Sources

Want to reach new clients with every message marked, with an unsubscribe link and a privacy notice? Try HypeLead free for 7 days. If you are not sure how this applies to you, book a short call with us.