GDPR does not ban B2B outreach to Czech companies, but it is only half of the picture. Whether you may process a contact is a GDPR question; whether you may send an offer by email is decided by Czech Act No. 480/2004 Coll. — and that Act requires prior consent even when the recipient is a company. Phone and post are less restricted. This article explains what applies to each channel.

This is an informational overview as of 11 October 2026, not legal advice. Consult a qualified lawyer or data protection specialist about your specific situation.

When a business contact is personal data

GDPR protects natural persons. A company's name, company ID (IČO), registered address and general contact details are therefore not personal data. Anything that leads to a specific individual is:

  • a named address or direct line — jan.novak@company.cz is personal data even in a business context;
  • a sole trader's details — where an individual runs the business, the name, place of business and phone number identify a natural person;
  • the contact of a board member — for example a committee chair's phone number listed as the contact of a homeowners' association.

A company database is therefore never "outside GDPR". It contains legal entities as well as sole traders, and for some records the contact belongs to a specific person. Treat every export as if it contained personal data.

Legitimate interest: the legal basis for phone and post

The usual legal basis for processing contacts for outreach is legitimate interest under Article 6(1)(f) GDPR. Recital 47 states that processing for direct marketing purposes may be regarded as carried out for a legitimate interest. That alone is not enough — the interest has to pass three steps:

  • Purpose: do you have a specific commercial reason for contacting this particular group?
  • Necessity: do you really need these data, to this extent?
  • Balancing: do the rights and reasonable expectations of the person contacted outweigh your interest?

Record the outcome in a legitimate interest assessment. The narrower and more relevant the selection — one industry, one region, an offer that concerns that industry — the more easily it holds. If you did not obtain the data from the person concerned, you must also inform them under Article 14 GDPR, including where the data came from. And anyone may object to processing for direct marketing at any time under Article 21; after that you may no longer use their data for that purpose.

Email: not without prior consent, not even to an info@ address

Legitimate interest under GDPR does not entitle you to send an offer by email. Commercial communications sent by electronic means are governed by Section 7 of Act No. 480/2004 Coll. on Certain Information Society Services, which requires the recipient's prior consent.

The Act does not distinguish between natural and legal persons as recipients. According to the Czech Office for Personal Data Protection (ÚOOÚ), an email offer sent without prior consent is an unsolicited commercial communication even when it goes to a general company address such as info@. The Office says so in its FAQ on Act No. 480/2004 Coll. (Czech): a commercial communication cannot be sent to a publicly available address without consent (question 10), and the Act "does not distinguish between types of recipient" (question 25). Consent cannot be obtained by emailing a request for consent either (question 13).

The exception is your own customers under Section 7(3): someone who has concluded a contract with you may receive messages about your own similar products or services, provided they can refuse further messages simply and free of charge.

Email addresses in a purchased export are therefore not for mailing campaigns. Use them to complete and check your own records, to match existing customers, and for individual, relevant correspondence the other party actually wants.

Phone and post

  • Phone: for numbers taken from the public telephone directory, Section 96 of the Czech Electronic Communications Act applies — marketing calls may only be made to subscribers who have expressly allowed them in the directory. For numbers from other public sources this rule does not apply, but GDPR still does: you need a legal basis, you must say who is calling and where you got the number, and you must respect an objection.
  • Post: a letter is not an electronic means, so Act No. 480/2004 Coll. does not apply. Processing the address is governed by GDPR; anyone who objects receives no further mail.
  • LinkedIn and contact forms: a single, specific message is different from a bulk mailing. It is governed by the platform's rules and, for personal data, again by GDPR.

Practical rules for phone, post and LinkedIn

  • Relevance: contact only those for whose industry the offer objectively makes sense.
  • Source: say where the contact came from — a public register, the company website, a purchased export.
  • Objections: keep a suppression list and compare every new export against it by company ID and number.
  • No deception: the caller or sender must be clearly identified and the purpose of the contact obvious.
  • Documentation: keep your legitimate interest assessment, the selection brief and the data date.
  • Email only with a title: an unsubscribe link in every message concerns emails to customers and to recipients who have given consent. Without one of those two titles, do not send an email offer at all.

When you cannot do without consent

  • you want to send an offer by email or SMS to someone who is not your customer;
  • you want to make marketing calls to a number from the public telephone directory whose subscriber has not allowed them;
  • you are targeting consumers rather than businesses;
  • you work with data from settings where a person does not reasonably expect commercial use, such as private social media profiles.

How to choose the companies your offer concerns is covered in How to Find B2B Contacts for Czech Companies; the number of entities with a phone number and email in each industry is shown in the overview of industry exports (Czech).