Data retention in the Czech Republic: what the Constitutional Court rulings mean.
Not legal advice. This is how we read the law for our own service; your situation may differ. Last reviewed 17 October 2026.
"Czech law" is on our front page as a reason to pick us. That deserves more than a slogan. Here is what the law actually says about keeping records of who communicated with whom, how the courts have treated it, and where we fit.
The 2011 rulings
Czech data retention started as a transposition of the EU Data Retention Directive (2006/24/EC). Section 97(3) and (4) of the Electronic Communications Act (Act No. 127/2005 Coll.) obliged operators to keep traffic and location data about every user for six months, just in case.
On 22 March 2011, in Pl. ÚS 24/10, the Constitutional Court annulled those provisions. The reasoning matters more than the result: retaining data about everyone, without suspicion, with vague rules on who may ask for it and why, was held disproportionate to the right to privacy and to informational self‑determination. On 20 December 2011, in Pl. ÚS 42/11, the Court followed up by annulling § 88a of the Code of Criminal Procedure, the provision that let the police obtain such data in criminal proceedings, because it did not limit the request to serious crime or require real necessity.
2019: a narrower regime survives
Parliament re‑enacted retention with a six‑month period and tighter access rules. A group of deputies challenged it. On 14 May 2019, in Pl. ÚS 45/17, the Court dismissed the petition and let the regime stand, while reading its scope narrowly and stressing the safeguards on access. So the honest summary is: blanket retention was struck down once, a narrower version exists today and binds telecom operators. Anyone who tells you Czech law has "no data retention" is simplifying.
The EU layer
The Court of Justice of the EU went the same way, more than once. Digital Rights Ireland (C‑293/12 and C‑594/12, 2014) invalidated the Directive itself. Tele2 Sverige / Watson (C‑203/15 and C‑698/15, 2016) held that EU law precludes national laws requiring general and indiscriminate retention of traffic and location data. La Quadrature du Net (C‑511/18, C‑512/18 and C‑520/18, 2020) confirmed that and carved out narrow exceptions (serious national‑security threats, targeted retention, IP addresses assigned at the source of a connection). Any Czech regime has to live inside those limits.
Who is bound
The retention duty in § 97 binds providers of publicly available electronic communications services and networks: the companies that carry your signals, your ISP and mobile operator. The same group carries the interception duties in § 97(7): they must build and maintain interfaces for lawful interception at their own cost.
Where does a VPN sit? A VPN does carry packets, so the question is real. In our assessment Pevnost is an information‑society service under Act No. 480/2004 Coll. and a "mere conduit" intermediary under Article 4 of the Digital Services Act (Regulation (EU) 2022/2065): we transmit what the user sends, we do not select or modify it, we do not choose the recipient, and the user's actual internet access is provided by their own ISP. We have not notified the Czech Telecommunication Office as a provider of an electronic communications service and we do not consider ourselves one. We also say plainly: this is our assessment, not settled Czech case law. The CJEU has drawn the line in Skype (C‑142/18, SkypeOut is an electronic communications service) and Gmail (C‑193/18, web‑mail is not), and a VPN is closer to the second than the first, but no court has ruled on a VPN as such. If a competent authority decided otherwise, our terms and privacy policy say what would happen: we would say so, and our systems are built so that the data a retention duty would cover never arises in the first place.
What the authorities can still order
None of this means nobody can ask us anything. Three instruments matter.
- § 7b of the Code of Criminal Procedure (in force since 2019): a prosecutor, or the police with consent, may order anyone who holds data to preserve existing data for up to 90 days and to keep the order confidential. It does not create a duty to collect anything new. Applied to us it reaches the list in our privacy policy: an account ID, an expiry date, device public keys, aggregate load. It cannot reach activity records, because none exist.
- § 8 of the same Code (duty to cooperate) and a court order for production of what we hold. The answer is the same list.
- The EU e‑Evidence Regulation (2023/1543), which applies from 18 August 2026: authorities of another EU member state may send a European Production Order or Preservation Order directly to a service provider, without going through Czech authorities, and may impose confidentiality towards the user. We honour such orders to the extent of the data we hold, which is the same list.
Hardware can also be seized under §§ 78 and 79 of the Code. What that yields on a diskless node is the subject of another post.
Why this is still a good place to run a VPN
Not because the law is absent. Because the highest court has twice drawn a line against suspicionless retention and explained why, because EU law draws the same line, because the retention duty that survived binds carriers and in our assessment not us, and because there is no general power to order a service like ours to build logging in. Add the practical part: a service you can find in the public Trade Licensing Register, with servers you can point to, under a legal system we read in the original. That is a narrower promise than "no logs, no laws, no problem". It is also one we can keep.