Yes, for existing customers, subject to the statutory exception. The Electronic Communications Act requires prior demonstrable consent for email marketing. Consent is unnecessary when promoting your own similar goods or services to people whose address you obtained during a sale, provided they can refuse easily and free of charge both when you collect it and in every message. Bought or borrowed databases do not qualify. You also need a GDPR legal basis, usually legitimate interests, with a right to object at any time.
Almost every online shop asks this after its first season: we have thousands of addresses from orders; may we email them? The Electronic Communications Act supplies the answer. The GDPR complements those rules rather than replacing them.
Prior consent is the rule
Automated calling and communication systems without human intervention, fax, email, SMS and MMS may be used for direct marketing to a subscriber or user only with their prior demonstrable consent obtained before contacting them.
— Section 116(3) of Act No. 452/2021 Coll. (unofficial English translation)
Demonstrable consent must satisfy all GDPR requirements. Whoever obtains it retains it on a durable medium for at least four years after withdrawal and explains, when obtaining it, how to withdraw easily (Section 116(5)). Withdrawal must be confirmed within 30 days (Section 116(6)). Consent must not be solicited by email or telephone (Section 116(4)). Buying or borrowing a database does not in itself confer a right to contact the people listed in it, nor does it transfer the existing-customer exception. Any valid and demonstrable consent covering the specific sender, or another statutory exception such as the exception for published business contact details discussed below, must nevertheless be assessed separately. Act No. 22/2004 Coll. on Electronic Commerce (Section 4(6)) and Act No. 147/2001 Coll. on Advertising (Section 3(3)) repeat the prohibition. Section 116 provides the detailed existing-customer exception.
The exception for your own customers
Prior consent under paragraph 3 from an email, SMS or MMS recipient is not required for direct marketing of a person’s own similar goods and services where that same person obtained the recipient’s contact details in connection with a sale in accordance with this Act or a separate regulation, […] or for direct marketing addressed to published contact details of a subscriber or user who is an individual entrepreneur or legal entity. Recipients must be offered an easy, free opportunity to refuse such use of their contact details at any time, when the details are collected and in every message delivered, unless they have previously refused.
— Section 116(15) of Act No. 452/2021 Coll. (unofficial English translation)
The exception rests on four conditions. You promote your own goods or services similar to those bought, not a partner’s products. You obtained the address from a buyer: registration without purchase, an enquiry form or competition participation is insufficient. You offered refusal at ordering and provide a free one-click unsubscribe link in every message. Each message clearly identifies the sender and their address. The Act also limits the exception in time:
Contact details obtained in connection with the sale of goods or services may be used under paragraphs 14 and 15 for one year after the contractual relationship ends.
— Section 116(16) of Act No. 452/2021 Coll. (unofficial English translation)
For a one-off purchase, establish in advance when the contractual relationship ends and clean the database accordingly. Companies and sole traders may be contacted at published contact details without consent, again with an opt-out in every message (Section 116(15)).
GDPR: legitimate interests and the right to object
The Electronic Communications Act determines whether you may send the message; the GDPR determines the basis for processing the address. For existing customers, this is usually legitimate interests. Recital 47 GDPR states that processing personal data for direct marketing may be regarded as a legitimate interest (unofficial English translation). This requires a proportionality assessment, marketing information in the privacy notice and the right to object under Article 21(2) and (3) GDPR. For direct marketing, that right is absolute: after an objection, the address must no longer be used for that purpose. We summarise other data requirements in personal data processing duties. Cookie consent is a separate matter: see cookie walls and valid consent.
What are the consequences?
A breach of Section 116 is an administrative offence. The Regulatory Authority for Electronic Communications and Postal Services imposes a business fine from EUR 200 to 5% of turnover for the previous accounting period (Section 124(3)); if turnover cannot be established, the maximum is EUR 300,000 (Section 124(6)). The Office for Personal Data Protection may separately address processing addresses without a legal basis.
How we can help
We determine which part of your database qualifies for the exception and which needs consent, and prepare checkout wording, unsubscribe arrangements and a legitimate interests assessment through our GDPR and personal data protection service. Our e-commerce legal services cover marketing, reviews and discounts as a whole, with related provisions added to your online shop terms. Send us a sample checkout and your latest campaign; we can usually identify needed changes on first inspection.
This answer provides general information on the law as at 10 September 2026. It does not constitute legal services or replace an assessment of an individual case. The details of your situation may differ. Book a consultation to discuss them.
