Alessandro AleddaInsider RiskInformation Protection

Contact me

ITER/CZCzechia

What the record establishes for Czechia: the bodies an insider event is reported to, the channel each takes, and the act that transposes the NIS2 Directive, Directive (EU) 2022/2555.

Recipients
4 of 4
Reporting address
Recorded
NIS2
In force 1 November 2025
Terms moved
Yes
Sources cited
4
Last read
5 OCTOBER 2026

Recipients

Reached underBodyChannelSource
Data protection authorityGDPR, article 33Office for Personal Data Protection reported—edpb members
CSIRT or competent authorityNIS2, article 23Národní úřad pro kybernetickou a informační bezpečnost reported

https://portal.nukib.gov.cz/checked 2026-09-03

Portál NÚKIB. Where the portal is unavailable the guidance allows e-mail or a datová schránka.

nukib hlaseni incidentu
Financial supervisorDORA, article 19Česká národní banka reported—eba competent authorities
Market authorityMAR, article 17Česká národní banka (CNB) reported—esma mar nca

Transposition of NIS2 reported

ActZákon č. 264/2025 Sb., o kybernetické bezpečnosti
In force1 November 2025
RecipientNárodní úřad pro kybernetickou a informační bezpečnost
Moves a termYes. In two places. The anchor is ascertainment. Section 16(1) owes the first report «nejpozději do 24 hodin po zjištění kybernetického bezpečnostního incidentu», and section 16(3)(a) the notification «nejpozději do 72 hodin po zjištění», where the Directive runs both from becoming aware. The final report is thirty days, not one month, «nejpozději do 30 dnů ode dne předložení oznámení», from the day the notification is submitted, which is the Directive's own anchor in a different unit. An interim report is owed on request of the Úřad or the Národní CERT.
StandingRead in the act. Section 16(2) obliges the Úřad to tell a provider in the higher regime, within twenty-four hours of the first report, whether the incident has significant impact; the Úřad's guidance read earlier describes that step, and on the anchor and the seventy-two hour stage it is superseded by the act. The text was read in a consolidated database, not in the Sbírka.
Sourcenukib hlaseni incidentu

An event in Czechia

The five types, each opened on this jurisdiction: the acts it obliges, the term on each, and where the report goes.