Czech Whistleblowing Legislation

Scope

The Whistleblowing Legislation applies with respect to persons reporting, in particular, the following violations:

1. Violation which qualifies as a criminal offence;
2. Violation which qualifies as an administrative offence punishable by a fine with upper limit of at least CZK 100,000 (approx. EUR 4,300);
3. Violation of the Whistleblowing Legislation;
4. Violations in the area of public procurement; financial services, money laundering and terrorist financing; corporate tax; product and transport safety; environmental and nuclear safety; food and feed safety; animal health and welfare and public health; consumer protection; data protection and protection of economic competition.

Whistleblowing Channel

In order to enable reporting of the above violations, an employer (which is not a financial institution in the Czech Republic) is obligated to set up and operate an internal reporting channel only if it has employed at least 50 employees in the Czech Republic as of January 1 of the relevant calendar year.

Reklama

Převodní ceny v ČR aktuálně a výhled na rok 2026 – přístup finanční správy a povinnost dokumentace (online - živé vysílání) - 3.12.2025

3.12.2025 09:003 975 Kč s DPH
3 285 Kč bez DPH

Koupit

If a business group has more companies established in the Czech Republic, each company is considered separately for the purpose of meeting the thresholds related to number of employees.

Shared Internal

Companies with 50 to 249 employees in the Czech Republic as of January 1 of the relevant calendar year are allowed to use a shared reporting channel, so long as:

1. The respective employer appoints a designated person who is obligated to receive the whistleblowing report and to confirm receipt of this report to the whistleblower. If the whistleblower requests so, the designated person must enable a personal receipt of the whistleblowing report within a reasonable period of time, but no later than 14 days from the date on which the whistleblower requested it; and
2. The obligations outlined in the Whistleblowing Legislation are complied with.

Companies with 50 to 249 employees in the Czech Republic are obligated to set up the above reporting channel by 15 December 2023 at the latest.

Internal

Companies with 250 or more employees in the Czech Republic as of January 1 of the relevant calendar year are obligated to set up and operate their own internal reporting channel. They are obligated to set up such reporting channel by the first day of the second calendar month following after the date of the official announcement of the Czech Act on Protection of Whistleblowers.

External

Local authorities will set up and operate independent and autonomous external reporting channels, in addition to the internal reporting channels established by employers.

Language of Internal Reporting Channel

The Whistleblowing Legislation does not require the internal reporting channel to be available in Czech language.

Information/Consultation With Employee Representatives

There is no statutory information/consultation obligation vis-à-vis local employee representatives prior to implementing the internal reporting channel.

Designated Person

The company is obligated to determine the most suitable person to receive and follow up on whistleblowing reports. This could be a Compliance Officer, HR Director, Legal counsel, etc.

The designated person must be at least 18 years old, have full legal capacity and have a clean criminal record. The latter is demonstrated to the local company by submission of an extract from the Criminal Register not older than 3 months issued in the Czech Republic and in case of a foreign national, also in the country of his/her citizenship and each country, where he/she resided for at least 6 months in last 3 years (including an official Czech translation).

As the designated person must enable a personal receipt of the whistleblowing report, we recommend that it is an individual who is predominantly located in the company’s Czech office (or in the Czech Republic unless the company has a local office).

Information Obligation

The company is obligated to provide information to the employees, volunteers and interns and if applicable, other individuals eligible to reporting on:

1. The internal reporting channel;
2. The external reporting channel to the authorities;
3. Name of the designated person, his/her telephone number and e-mail address or other delivery address; and
4. Whether the internal reporting channel is available only to employees, volunteers and interns or also to independent contractors, suppliers, service providers, business partners, shareholders and statutory directors.

This information must be published on the Intranet or the Internet.

Whistleblowing Report

The designated person is obligated:

1. To confirm in writing receipt of the report within 7 days from the date of receipt; and
2. To inform the whistleblower of any action taken, the status of the internal investigation as well as the outcome thereof within a reasonable period of time, but no later than 30 days from the confirmation of receipt. In the event of factually or legally complex cases, this period may be extended once or twice with each extension lasting up to 30 days. The designated person is obligated to inform the whistleblower in writing of the extended deadline and the reasons for its extension before the deadline expires.

Anonymous Report

Anonymous reporting is possible, but an anonymous whistleblower does not have the below protection.

Anonymous whistleblowers who are later identified become protected.

Protection of Whistleblower

Whistleblowers must be protected against (threats and attempts of) any form of retaliation, including suspension, dismissal, demotion, transfer of duties, reduction in wages or working hours, withholding of a promotion or training, disciplinary measures, intimidation, harassment, discrimination, failure to convert a temporary contract into a permanent contract or to renew a contract, and early termination.

The whistleblower qualifies for protection if:

1. The report was not anonymous;
2. The whistleblower had reasonable grounds to believe that the information was true at the time of reporting; and
3. They made their report internally, externally, or publicly in accordance with the respective relevant procedures.

Data Storage

The designated person is obligated to keep evidence of received reports in an electronic form with specification of:

1. Date of receipt of the report;
2. Name, surname, date of birth and contact address of the whistleblower, or other information from which it is possible to infer the identity of the whistleblower if this information is known to him/her;
3. Summary of content of the report and identification of the person against whom the report was directed if their identity is known to him/her;
4. Date of completion of the assessment of the reasonableness of the report by the designated person and its result.

The designated person is obliged to store the report submitted through the internal reporting channel and documents related to the report for 5 years from the date of receipt of the report.

Access to the above evidence, the report submitted through the internal reporting channel and documents related to the report is restricted to the designated person only.

Sanctions

Corporate Liability

Companies may be held liable, in particular, for the following breaches:

1. Failure to set up and operate an internal reporting channel;
2. Failure to appoint a designated person;
3. Failure to confirm receipt of the report and to inform the whistleblower of any action taken, the status of the internal investigation as well as the outcome thereof;
4. Breach of duty of maintaining confidentiality.

Each of the above administrative offences is punishable by a fine. The maximum fine ranges from CZK 400,000 (approx. EUR 17,000) to CZK 1 million (approx. EUR 43,000). The decision as to whether and to what extent to impose an administrative fine is at the discretion of the competent authority.

Individual Liability

The Whistleblowing Legislation sanctions, in particular, the following breaches by individuals:

1. Hindering reporting;
2. Retaliation or attempted retaliation;
3. Breach of duty of maintaining confidentiality.

Each of the above administrative offences is punishable by a fine. The maximum fine ranges from CZK 80,000 (approx. EUR 3,500) to CZK 1 million (approx. EUR 43,000). The decision as to whether and to what extent to impose an administrative fine is at the discretion of the competent authority.

Data Privacy

If the confidentiality obligations are violated, there is an associated risk that data privacy obligations were violated as well. As a consequence, the sanction regimes under the GDPR may apply.

Mgr. Vlastimil Kreysa, 

Attorney at Law / advokát

 

 

Baker & McKenzie s.r.o., advokátní kancelář

Klimentská 1216/46
110 00 Praha 1

Tel.:       +420 236 045 001

e-mail:    vlastimil.kreysa@bakermckenzie.com