Legal Q&A · 09

Compliance, Registers & Licences — questions and answers.

40 answered questions on a subject we work on. Find related services in the catalogue: Compliance, Registers & Licences.

Answered by , Czech and Slovak attorney, admitted to the Slovak and Czech Bars (SAK 300422 · ČAK 19654).

Search questions in this area

Search covers questions, short answers and topics. To search the whole Q&A, visit the Q&A homepage.

Questions about Compliance, Registers & Licences

  1. We accidentally sent a customer an invoice or email containing another customer's data. Do we have to notify the authority? Not always, but every such mistake is a personal data breach that you must assess and record in your breach register. You must notify the authority without undue delay, where feasible within 72 hours of becoming aware of it, unless a risk to the person whose data was disclosed is unlikely. In an example involving a mix-up of two invoices containing names, addresses and purchase details, the European Data Protection Board assesses the risk as low, and an internal record is sufficient. If the document also disclosed non-public data, such as a date of birth, sensitive data or data concerning many people, expect to have to notify the authority. Where the risk is high, also inform the individuals affected.
  2. A former employee is asking us for all their personal data, including emails. They appear to be preparing a lawsuit. Do we have to provide it? Yes, to the extent of the personal data you process about them. You do not assess the reason for the request, including any planned litigation. You do not have to hand over the entire email mailbox, but the employee must receive a faithful and intelligible copy of their data and, where necessary to understand it, extracts or complete documents. You may protect colleagues' and clients' data and trade secrets by redacting them. The GDPR leaves only narrow scope for refusing the entire request. You must respond without undue delay and within a month of receiving the request. For a complex request, the deadline may be extended with notification.
  3. We want to offer services by telephone to individuals and companies we have not worked with before. What requirements must we meet in Slovakia and Czechia? Different rules apply in Slovakia and Czechia. In Slovakia, you may call with an offer, generally using a number reserved for marketing, if the number called is not on the opt-out register maintained by the regulatory authority and the recipient has not objected to such calls from you. You must check the numbers against the register before the campaign. In Czechia, you must not make marketing calls to numbers from public or purchased lists, or to randomly generated numbers, unless their holder, including a company, has opted in to marketing calls. When calling individuals, including sole traders, you need a legal basis under the GDPR in both countries and must inform the recipient of the right to object no later than during the first call.
  4. An employee has reported wrongdoing and we want to dismiss them with notice on other grounds. Do we need the authority's consent? In Slovakia, only if the employee is a protected whistleblower, meaning that a prosecutor or administrative authority has served you with notification that it has granted them protection. If consent is required and the Office has not granted it, the dismissal with notice is invalid. Consent is not required for other whistleblowers, but the employee may ask the Office to suspend the effect of the notice of dismissal, and you must demonstrate that it is unrelated to the report. Czech law does not provide for the authority's consent, but it prohibits retaliation. If, in a dispute, the employee presents facts indicating retaliation, the employer must demonstrate that the dismissal was objectively justified.
  5. We are a group of companies. Can the parent company or a single external provider receive reports from employees of all subsidiaries? Yes, a parent company or an external provider can contractually take over the receipt of reports on behalf of subsidiaries. However, the obligations remain with each subsidiary required to have a system. In Slovakia, an external person may also investigate reports only for an employer with fewer than 250 employees, and each subsidiary appoints its own responsible person and issues its own internal rules. In Czechia, companies required to have a system that have no more than 249 employees may share one. Larger companies may entrust its operation to another person. The whistleblower's identity must not be disclosed even to the parent company's management without the whistleblower's written consent.
  6. Our Commercial Register entry includes “organisational and economic consultancy”, but we do not carry out any such activities. Are we an obliged entity under the AML Act? Not automatically. The AML Act treats an organisational and economic consultant as an obliged entity only in relation to specified activities, such as buying and selling real estate or businesses, managing clients' assets, forming and managing companies, or providing a registered office. Addressing this precise situation, the Financial Intelligence Unit states that you are not an obliged entity if you do not carry out these activities. In general, however, where an activity is registered, it requires an internal AML programme even from a person who does not carry it out, so the safest course is to terminate an unnecessary trade authorisation. If you retain it, keep records of your actual activities.
  7. We are a Czech company with a branch in Slovakia. Must we also comply with the Slovak Cybersecurity Act? According to the National Security Authority's interpretation, generally not, because the branch forms part of the Czech company, which falls within the jurisdiction of the state in which it is established and therefore under the Czech Cybersecurity Act. However, the authority's interpretation is not binding. The recitals to the NIS2 Directive envisage concurrent jurisdiction over an entity established in several states. It is therefore sensible to assess a branch with its own operations under Slovak law as well. Exceptions apply to providers of public electronic communications networks and services, which fall under the state where they provide services, and to certain digital services, for which the location where cybersecurity decisions are taken is decisive. A Slovak subsidiary, by contrast, is a Slovak entity.
  8. We are a crypto firm outside the EU, and Slovak or Czech clients approached us on their own initiative. Do we need authorisation under MiCA? You do not need authorisation under MiCA for the specific service that an EU client requested entirely on their own initiative. However, the exemption is interpreted narrowly. It does not apply if you or anyone acting on your behalf solicits clients in the Union in any way, even if your contract or website states otherwise. Even a client who approached you independently must not be offered new types of crypto-assets or services. If you wish to operate on the Slovak and Czech markets on an ongoing basis, you need CASP authorisation in an EU Member State.
  9. Who is a beneficial owner, and how are they identified? A beneficial owner is always an individual, never a company. In a company, this particularly includes anyone with a direct or indirect interest of at least 25% in voting rights or registered capital, the right to appoint or remove statutory or supervisory bodies, control by other means, or entitlement to at least 25% of the economic benefit. If no such individual can be identified, senior management, meaning the statutory body, is treated as the beneficial owner.
  10. What happens if we are not registered in RPVS or miss annual verification? The consequence is more than a fine. If beneficial owner verification is missing, the public-sector counterparty is not in default when it withholds performance for that reason, so it may lawfully withhold payment of your invoice. False or incomplete data can bring a company fine equal to the economic benefit obtained, or otherwise EUR 10,000–1,000,000, and EUR 10,000–100,000 for the statutory representative. The two-year re-registration ban arises in the sanction cases governed by Section 13a, not after every voluntary deletion.
  11. What must an RPVS verification document contain, and who prepares it? Only an authorised person, a lawyer, notary, bank, auditor or tax adviser, prepares the document to evidence beneficial owner identification or verification. It must explain the information supporting the conclusion, state the partner's ownership and management structure and confirm that the facts match what was actually established. It must not contain a personal identification number or another generally applicable identifier.
  12. We are a medium-sized business. Does NIS2 apply, and must we register with NBÚ? Two things matter together: whether your activity is in Annex 1 or 2 to Act No. 69/2018 Coll. on Cybersecurity, and whether you are at least medium-sized, generally having at least 50 employees or both annual turnover and balance-sheet total above EUR 10 million. If so, you must identify this yourself and notify the National Security Authority within 60 days of starting the activity. Exceptions matter: some entities register regardless of size, and group companies count towards size.
  13. Which documents should we bring for a lawyer to authorise our agreement? Bring two valid official photo identity documents, at least one being an identity card or passport. Under professional rules, one is normally insufficient. If you have no second physical document, alternatives include eID, qualified electronic identification or two identity witnesses. A representative also needs a power of attorney bearing an officially certified signature; authorisation does not replace that certification.
  14. Why does a lawyer examine beneficial ownership when authorising an agreement? When authorising, a lawyer is an obliged entity under Act No. 297/2008 Coll. and must perform customer due diligence, including beneficial owner identification and verification, ownership structure checks, sanctions screening and politically exposed person checks. If ownership cannot be established or the client refuses cooperation, the lawyer cannot proceed. Prepare an ownership structure traced through to specific individuals.
  15. How do we give our accountant or lawyer access to the company's electronic mailbox? The statutory representative grants permission directly in the mailbox on slovensko.sk: after signing in, they add a person under Settings and Person Permissions, specify the scope (full or partial access) and its duration. The administrator processes electronic permission without delay; a paper application with a certified signature takes longer. Permission is not a power of attorney: it provides access to messages, not authority to act for the company. It can be changed or revoked at any time through the same process.
  16. What is registration in the List of Economic Operators for, and which documents do you not need to provide? The Public Procurement Office maintains the list. Registration replaces proving personal standing in each tender and is valid for all contracting authorities and entities for three years, after which a new application is needed. You do not attach documents that the Office can obtain from public administration systems: it checks Commercial Register and criminal record extracts, contributions and taxes itself. In practice, the main requirements are a correctly completed application and the fee.
  17. The contracting authority has not issued our reference. How can we obtain it? Issuing a reference is a statutory duty: ordinarily within 30 days of completion, or in specified cases within 10 days of your request. If the authority is silent, send a written request. If it still fails to issue the reference, apply to the Public Procurement Office with performance evidence. The Office issues it instead and fines the authority for non-compliance. Subcontractors do not receive Section 12 references; they prove experience through confirmation from the main contractor.
  18. We drive a van with a trailer abroad. Do we need a tachograph from 1 July 2026? Very probably yes. If the vehicle's maximum permissible mass, including any trailer, exceeds 2.5 tonnes and you carry goods across borders, it must have a second-generation smart tachograph from 1 July 2026. The driver must observe driving times, breaks and rest periods as truck drivers do. The new extension for combinations over 2.5 and up to 3.5 tonnes applies to international transport and cabotage. Above 3.5 tonnes, domestic journeys may also be covered; statutory exemptions must always be assessed. At an inspection, the relevant records for the inspection day and the preceding 56 days must be produced.
  19. How does the authority calculate a fine for a GDPR breach? The EDPB methodology in Guidelines 04/2022 uses five steps: identify the processing operations, set a starting amount based on the infringement category, severity and the undertaking's turnover, adjust for aggravating and mitigating factors, check the statutory ceiling, and assess effectiveness and proportionality. Ceilings are EUR 10 or 20 million, or 2% or 4% of worldwide turnover for undertakings. Turnover means the whole group, rather than only the company at fault. Arguments can address severity, remediation and enhanced cooperation; mandatory notification itself is neutral. Inability to pay is considered only exceptionally.
  20. Do we need an internal whistleblowing system? Yes, if you employ at least 50 people; public authorities are covered from five employees, and employers in financial services, transport safety or environmental services regardless of size. The system requires a designated responsible person, published reporting channels, an internal policy and a register of reports. Receipt must be acknowledged within seven days and investigation results communicated within 90 days. The Whistleblower Protection Office may impose a fine of up to EUR 50,000, or EUR 100,000 for employers with at least 250 employees.
  21. We want to change the authorised person in the Register of Public Sector Partners. How does it work? The change is always a replacement, because the register allows only one authorised person. You sign a written agreement with the new person, who verifies the beneficial owners afresh, prepares a verification document and electronically applies to register the change; the law does not require cooperation from the former person. However, if the former person requested their own removal, you must secure a replacement within 30 days of removal. After that period the other contracting party may withhold payments and, if the delay exceeds 30 days, withdraw from the contract.
  22. When is a certified signature enough, and when do we need lawyer authorisation? These are different legal procedures. Official signature certification by a notary, municipality or district office confirms only that a particular person signed the document; its content is not reviewed. In authorisation, a lawyer drafts the contract, establishes the parties' identities, checks legality and bears liability for damage. The cadastre does not require certified signatures on such contracts. Since 17 August 2026, incorporation documents and business interest transfers require lawyer authorisation or a notarial deed. A qualified electronic signature with a timestamp replaces a handwritten signature and its certification, but not authorisation or a notarial deed.
  23. We want to operate a guarding service. What do we need for a private security licence? The regional Police Force directorate grants a guarding licence for ten years. For a company, it checks reliability and especially the people involved. Every statutory body member must be at least 21, of good character, reliable, medically fit and professionally qualified, with the required education and experience and a type P competence card after an Interior Ministry examination. Members with interests of 15% or more must be of good character and reliable. Attach personal documents, the founding deed and the fee. Unlicensed operation risks a fine and activity ban.
  24. What do we need for a road haulage operator authorisation for vehicles over 3.5 tonnes? The district office in the regional capital grants road transport operator authorisation for ten years if the undertaking proves four requirements under Regulation (EC) No. 1071/2009: an effective and stable establishment in Slovakia, good repute of statutory representatives and the transport manager, financial standing comprising equity of at least EUR 9,000 for the first vehicle and EUR 5,000 for each additional vehicle over 3.5 tonnes, and the appointed transport manager's professional competence verified by examination. Transport to other EU countries additionally requires a Community licence and evidence of it in every vehicle.
  25. Must we tell customers that they are being answered by a chatbot on our website? Yes, unless it is obvious from the circumstances. Article 50(1) of the AI Act applies from 2 August 2026 and requires a system intended to interact directly with people to be designed so that the person concerned learns that they are interacting with AI. The duty falls on the provider of the system, and that is generally also the company that has a chatbot developed for it and operates it under its own name, even though it is built on a third party’s language model. The information must be given clearly and no later than at the first interaction.
  26. Must we train employees who use AI tools? Yes, to a reasonable extent. A company deploying AI must, under Article 4 of the AI Act, take measures to promote AI literacy among its employees and other persons who use AI on its behalf. Regulation (EU) 2026/1744 relaxed the obligation with effect from 27 July 2026: it no longer requires a sufficient level of literacy to be ensured and expressly does not require any specific level to be guaranteed for any individual. The obligation nonetheless remains, and it is worth documenting the measures taken.
  27. How long must whistleblowing reports be kept and who may have access to them? In Slovakia an employer must keep a register of reports for three years from their delivery; in the Czech Republic the responsible person keeps the report and related documents for five years from receipt. Access should be limited to the person who receives and examines reports; the whistleblower's identity is not disclosed even to management without their written consent. Reports contain the personal data of several people, so the manner of processing must be set out in an internal policy and aligned with the GDPR.
  28. Can an employee bypass our reporting channel and go straight to an authority or the media? To an authority yes; to the media only if certain conditions are met. Both Slovak and Czech law protect a whistleblower who approaches the competent authority directly, without first using the company's internal system. Where information is disclosed publicly, for instance in the media, protection is tied to conditions: the internal or official route produced no result, there is an immediate threat to the public interest, or retaliation is feared. A company cannot prohibit employees from approaching the authorities.
  29. Can a group of companies have a single shared data protection officer (DPO)? Yes. Article 37(2) GDPR allows a group of undertakings to appoint a single data protection officer provided they are easily accessible from each establishment. According to the guidelines of the European supervisory authorities, accessibility also means being able to communicate with data subjects and supervisory authorities in their language, which for a Slovak-Czech group means dealing with two authorities. Each company nevertheless remains a separate controller: it publishes the officer's contact details itself, notifies them to its own authority and must provide the conditions for the role to be performed.
  30. Our transport manager is leaving. How much time do we have to replace them without losing the authorisation? A change in the person of the transport manager must be notified to the district office in the regional capital within 15 days, and you may operate transport only with an appointed transport manager who effectively and continuously manages the transport activities. Regulation (EC) No. 1071/2009 allows the authority to set a period of up to six months to appoint a replacement where the transport manager ceases to satisfy the requirements of good repute or professional competence; on the transport manager’s death or physical incapacity, it may be extended by three months. The period is not automatic and concerns the fate of the authorisation. The Act does not rule out a fine for operating without a transport manager even during that period, so arrange a replacement while the notice period is still running.
  31. We trace debtors' assets and gather information on companies for clients. Do we need a detective service licence? If you carry out such activities for clients, generally yes. Act No. 473/2005 Coll. on Private Security expressly treats the tracing of property, the gathering of information on a person's financial circumstances and the gathering of information in connection with debt recovery as detective services, and a detective service may be operated only under a licence from a regional Police Force directorate. Activities carried out as part of an activity under special regulations are an exception. Operating without a licence risks a fine of EUR 3,319 to EUR 66,387 and an activity ban.
  32. We are selling a company holding a private security licence and the managing director is changing. Will the licence remain valid? On a sale of a business interest, yes: the licence stays with the company to which it was granted; the licence itself cannot be transferred, so a buyer does not acquire it on a sale of the enterprise. The new managing director must, however, meet the same conditions as on the grant of the licence, and a new member holding an interest of at least 15% must be of good character and reliable, with changes notified to the regional directorate within 15 days. If the sole managing director leaves, or a statutory representative ceases to meet the conditions, the regional Police Force directorate suspends operation for up to three months and, if the grounds persist after that period, withdraws the licence.
  33. We want to issue our own token. Do we need authorisation under MiCA? For an ordinary token that is not a stablecoin, generally no. A public offer of such a token requires no regulatory authorisation, but it does require a legal person, a crypto-asset white paper notified to the competent authority at least 20 working days before publication, and compliance with the duties of a person offering crypto-assets. A different regime applies to stablecoins: an asset-referenced token requires authorisation under MiCA, and an e-money token may be offered only by a credit institution or an electronic money institution. You also need authorisation as a crypto-asset service provider if, alongside the issue, you provide clients with crypto-asset services, such as exchanging the token for money or holding it in custody.
  34. We are developing a non-custodial crypto wallet. Do we need a CASP authorisation? Software or hardware for a wallet in which the private keys are held exclusively by the user generally does not require an authorisation as a crypto-asset service provider, because it is not custody on behalf of clients. MiCA says so expressly in recital 83. You do need an authorisation, however, if you gain control over the crypto-assets or the means of access to them, for instance through key management or recovery, or if the application itself provides exchange, receives orders or executes transfers on behalf of users.
  35. We hold a CASP authorisation in Slovakia. How do we start providing crypto-asset services in Czechia? You do not need a new authorisation from the Czech National Bank. A CASP authorisation granted by the National Bank of Slovakia permits you to provide services throughout the Union, but before starting services in Czechia you must notify NBS of the list of Member States, the services, the intended start date and your other activities. NBS forwards the information to the Czech single point of contact within 10 working days, and you may start on the day it notifies you of that transmission, and at the latest on the 15th calendar day after submitting the notification. You may provide only the services covered by your authorisation.
  36. Our company has been hit by a cyberattack. To whom and by when must we report it? If you are an essential service operator, you report a serious cybersecurity incident to the National Security Authority through the unified cybersecurity information system. The early warning must be sent within 24 hours of detection, the notification with an initial assessment within 72 hours, and the final report no later than one month after the notification. Alongside reporting, you must address the incident, secure evidence, and report to the police or law enforcement authorities any criminal offence of which you credibly learn.
  37. Must we undergo a cybersecurity audit, or is a self-assessment enough? An essential service operator must verify the effectiveness of its security measures by a cybersecurity audit within two years of the date of entry in the register; the audit is carried out by a certified auditor and the final report must be submitted to the authority within 30 days. Apart from the transitional rules running until the end of 2026, only an operator that does not operate a critical essential service may replace the audit with a self-assessment through the unified information system, and even that operator must undergo an audit within five years of registration. The audit is also repeated after every change with a significant effect on the security measures.
  38. We no longer do business with the State. Should we be removed from the RPVS, or is ending the arrangement with our authorised person enough? If you are no longer a public sector partner and are no longer receiving performance under any contract, the correct route is removal from the register, applied for by your authorised person while they are still registered. Were the authorised person to apply for their own removal only, you would remain in the register and would have to secure a new authorised person within 30 days of that removal. Voluntary removal does not in itself trigger the two-year bar on fresh registration, but it does not end proceedings already commenced on the verification of beneficial owner data.
  39. Can our regular lawyer or auditor act as our RPVS authorised person? Yes. An ordinary relationship with a lawyer, notary, auditor, tax adviser or bank that arose in the performance of their profession does not, under the Act, call the authorised person's impartiality into question. Excluded, however, is anyone who is themselves the partner or beneficial owner in the matter, who shares a beneficial owner with the company, or who is personally or through ownership connected with the company or members of its bodies. A breach of the prohibition is punishable by a fine imposed on the authorised person, the company and its statutory representative alike.
  40. We are on the List of Economic Operators. What must we still submit with a tender? Registration proves only the participation requirements concerning personal standing, that is good repute, up-to-date contributions and taxes, absence of bankruptcy, authorisation to conduct business and absence of a ban on participation. A tender must still include evidence of financial and economic standing and of technical or professional capacity where the contracting authority requires it, and a statutory declaration on persons with decisive influence under Section 32(7). Certificates on contributions and taxes may be requested subsequently even from a registered company, and registration may be lost before its validity expires.

Cannot find your question? Ask us — we will reply by email. Answers in this Q&A are general information and do not constitute legal services.

Other Q&A topics

Need help in this area?

Tell us about your situation. We will usually reply within 24 hours.

A Q&A answer explains the rule; a consultation addresses your situation. For each topic, we can explain what needs to be done and by when.

Book an initial consultation Ask your own question
Contact a lawyer