Requirements and responsibility · details
Access is the company's responsibility
Unmanaged access, delayed revocation of permissions or missing records can cause problems during an incident or inspection. and regulations based on determine which obligations you must address. The following overview focuses on access-related areas.
1 · Unambiguous identity and authentication
A company needs to distinguish individual users and define how they are authenticated. Under the lower-obligation regime of the Czech Cybersecurity Act, these areas are detailed in Sections 7 and 8 of Decree No. 410/2025 Coll. The scope of measures depends on the applicable regime and regulated service.
Before granting access, the authorised user must be authenticated and their authentication data protected. The method must match the system's sensitivity and applicable requirements. Where is required, must use different types of factors. A card alone is a possession factor; automatically passing a stored password does not by itself create a second independent factor.
2 · Granting, changing and revoking access
Employees need permissions appropriate to their work. Access should change when their role changes and be revoked when they leave. The company should know who grants access, who reviews it and on what basis decisions are made. For regulated organisations, managing identities, roles and permissions is a specific security measure. Administrator and regular user access serve different purposes.
In practice, this covers the whole access lifecycle: grant it on joining, adjust it when work changes and revoke it when no longer needed. Czech Decree No. 410/2025 Coll. addresses these areas mainly in Section 7; the higher-obligation regime has its own corresponding requirements.
3 · Personal data protection
Article 32 GDPR requires security of personal data proportionate to risk. It includes, for example, encryption, confidentiality, availability and regular testing of the effectiveness of measures. Companies therefore need to address protection in transit and at rest, administrator rights and recovery after an outage. Employee data in the card directory and associated records also need protection.
4 · Logging relevant events
A suspicious event needs evidence for assessment. Logging relevant security events forms part of Czech cybersecurity requirements. Record content, availability, protection and retention all matter. At the same time, records containing personal data need a clear purpose and proportionate retention period; accumulating them without rules is not the objective.
For the lower-obligation regime, Section 9 of Czech Decree No. 410/2025 Coll. is particularly relevant. GDPR itself does not impose a general duty to record every sign-in; the proportionality of records is assessed according to purpose and risk.
Who the obligations apply to and what a breach can cost
GDPR applies to personal data processing within its scope. A breach of Article 32 is subject to a maximum fine of €10 million or, for an undertaking, 2% of total worldwide annual turnover for the preceding financial year, whichever is higher. This is a ceiling; the actual fine depends on the circumstances of the infringement.
Czech Act No. 264/2025 Coll., which transposes NIS2, has been in force since 1 November 2025. It applies to providers of regulated services under statutory criteria; merely using computers or operating a factory is not enough. For specified offences, maximum fines in the higher-obligation regime can reach CZK 250 million or 2% of an undertaking's net worldwide annual turnover; in the lower-obligation regime, CZK 175 million or 1.4%. The higher amount applies. The specific obligation, regime and circumstances determine the outcome.
What the CRA introduces
The primarily addresses the security of digital products and manufacturers' obligations. Reporting obligations under Article 14 apply from 11 September 2026, with the main requirements applying from 11 December 2027. For customers, this concerns the security of purchased products, support and vulnerability handling. Simply deploying ChipLogin does not automatically make a customer a manufacturer; the CRA also does not replace their own operational obligations.