GDPR wants you to really protect personal data and prescribes no particular software. Article 32 asks for "appropriate technical and organisational measures" matched to the risk, and Article 33 asks for a report to the authority after a data breach, where feasible within 72 hours. We are not lawyers and this is not legal advice. We read the text of the GDPR through an IT administrator's eyes: what follows from it for networks, passwords, backups and tests. If your firm also falls under the cybersecurity act, two reports with different deadlines apply side by side.
- The GDPR prescribes no software, Art. 32 wants appropriate steps matched to the risk.
- A breach is reported to the Office for Personal Data Protection where feasible within 72 hours.
- Every breach is recorded, including one you do not report (Art. 33(5)).
- The fine for Art. 32 to 34 is up to EUR 10 million or 2% of turnover.
- The cybersecurity act has its own deadline: the first notice within 24 hours.
What Article 32 asks for
Under Art. 32(1), the controller and the processor put in place protection proportionate to the risk. They take into account the state of the art, the cost, the nature and scope of working with the data, and how likely and how serious the risk is for people. The protection includes, where appropriate, four things:
- pseudonyms and ciphers: separate identity from data and encrypt the data,
- systems and services that keep data safe from disclosure, change and outage and withstand load,
- being able to restore data and access to it in good time after a physical or technical incident,
- a process that regularly tests and evaluates how well the steps in place work.
Paragraph 2 names what you protect the data against: accidental or unlawful destruction, loss, alteration, unauthorised disclosure and unauthorised access. Paragraph 4 wants everyone who may touch the data to work with it only on your instruction. You will find the underlying principle in Art. 5(1)(f): the data must stay protected against unauthorised handling and against accidental loss and damage.
You will not find a number or a specific tool here. The GDPR does not say how many characters a password should have. But if your service falls under Act No. 264/2025 Coll., Decree No. 410/2025 Coll. gives you that number: passwords of 12, 17 and 22 characters depending on the account type (§ 8(4)). It also works as a yardstick for those outside the act, but that is our idea, not a GDPR requirement.
What to do in a firm of 20 people
The table is our reading of how Art. 32 turns into work. The GDPR names no specific steps.
| What Art. 32 says | What it means in practice (our reading) |
|---|---|
| Pseudonyms and ciphers | Encrypt notebook disks and phones, separate names from data where possible |
| Protection against disclosure and change | Everyone has only the rights needed for the work, especially the administrator account, and MFA |
| Recovery after an incident | Backups outside the main network and at least one try to confirm that data really restores from them |
| Regular tests | A scan or a penetration test from time to time, and fix what it finds |
| Only on the controller's instruction | Rules for employees and suppliers on who may work with the data |
Start with an overview: which personal data you have, where it sits and who may reach it. Only then does it make sense to choose steps. A test that checks that the steps hold is described in the text on how a penetration test runs. Most breaches do not begin with a brilliant attack. An employee opens a phishing e-mail, or ransomware hits the firm and not only encrypts the data but steals it too.
A data breach: 72 hours and what to do with them
A breach under the GDPR means that data was accidentally or unlawfully destroyed, lost, altered or reached unauthorised people (Art. 4(12)). A lost notebook with personal data is such a case, just like a burgled server.
- To the authority: the controller reports it to the Office for Personal Data Protection without undue delay and where feasible within 72 hours of becoming aware of it. If you miss that, you attach the reasons for the delay. An exception applies when it is unlikely that the breach threatens people's rights (Art. 33(1)).
- The processor: if a supplier processes data for you, it must report a breach to you without undue delay (Art. 33(2)). Your contract should bind it to do so.
- To people: if the breach probably means a high risk, you notify the people concerned without undue delay too (Art. 34(1)). You do not have to if the data was unreadable to the unauthorised, for example thanks to a cipher (Art. 34(3)(a)).
- A record: the controller writes down every breach, including one it does not report: what happened, what effects it had and what was fixed (Art. 33(5)).
On its website the Office states that the controller uses an electronic form and that it can be sent through a data box or by post. If it is sent by e-mail, it must carry a recognised electronic signature, otherwise by the Office's account it is not a proper report.
An example: an employee of a shop loses a company notebook. If it had an encrypted disk, the data is unreadable to the finder. You do not have to tell people, but you still write the breach down and judge whether you must report it to the Office. If the disk was not encrypted, it is a different case and you judge it more strictly.
If you fall under the cybersecurity act, you have a second deadline on top: send the first notice of a cyber incident within 24 hours of detection (§ 16(1) of Act No. 264/2025 Coll.). It goes to the NÚKIB or the National CERT and it is a different task from the GDPR report. In § 64(5) the act expects the NÚKIB and the Office for Personal Data Protection to exchange data so that the same offence is not punished twice. More about the act is in the text on NIS2 and the new act.
Fines
For breached duties under Art. 25 to 39, including Art. 32 to 34, Art. 83(4) allows a fine of up to EUR 10 million, or for a business up to 2% of worldwide annual turnover of the previous year, whichever is higher. For breached basic principles under Art. 5 to 7 and 9, paragraph 5 threatens up to EUR 20 million, or 4% of turnover. The principle in Art. 5(1)(f) is precisely the one on protecting data. How much the authority imposes in a particular case, the GDPR does not say. We found only the ceiling.
Mistakes that keep repeating
- Paper without protection. Policies and consents are needed, but only steps in the systems protect the data.
- Backups nobody tried to restore. Art. 32 wants the ability to restore data in good time, not just to hold a copy.
- A supplier without rules. If someone else processes your data, they must tell you about a breach without undue delay.
- A breach without a record. Art. 33(5) wants every case written down, including one you do not report.
- Not knowing where the data sits. Whoever does not know where personal data is cannot judge what leaked.
Common questions
Is it enough to have the documents in order?
No. Documents are necessary, but Art. 32 wants real technical and organisational steps proportionate to the risk. The principle in Art. 5(1)(f) wants data protected against unauthorised handling and against loss.
Is the GDPR connected to a penetration test?
Indirectly. Art. 32(1)(d) wants a process that regularly tests and evaluates how well the steps in place work. A penetration test is one way to do that, but the GDPR does not name it.
By when must I report a breach?
Where feasible within 72 hours of becoming aware of it. If you miss that, attach the reasons for the delay (Art. 33(1)). The Office recommends the electronic form.
Do I have to tell customers about a breach too?
Only if a high risk to their rights and freedoms is likely. An exception is data that was unreadable to the unauthorised, for example thanks to a cipher (Art. 34).
How high is the fine?
Up to EUR 10 million or 2% of turnover for breaching Art. 32 to 34 and up to EUR 20 million or 4% of turnover for breaching basic principles. The higher of the two amounts applies.
Do the GDPR and the cybersecurity act apply at the same time?
Yes, they are two different rules with different deadlines: 72 hours under the GDPR and 24 hours under § 16 of Act No. 264/2025 Coll. The act expects the authorities to exchange data so that the same offence is not punished twice.
Sources
- GDPR, that is Regulation (EU) 2016/679, Czech text, Art. 4, 5, 32, 33, 34 and 83: https://eur-lex.europa.eu/legal-content/CS/TXT/HTML/?uri=CELEX:32016R0679
- Office for Personal Data Protection, personal data breach, viewed 25 October 2026: https://uoou.gov.cz/profesional/poruseni-zabezpeceni-osobnich-udaju
- Act No. 264/2025 Coll., version in force from 1 November 2025: https://www.zakonyprolidi.cz/cs/2025-264
- Decree No. 410/2025 Coll., in force from 1 November 2025: https://www.zakonyprolidi.cz/cs/2025-410
Risk analysis for NIS2 and ISO 27001: a step-by-step guide
PHP2Shell vulnerability: does it affect your website and what to do
Free CRM: when it's enough and when it costs more than a paid one
