Home » Protection of Personal Information

Rights of the Data Subject in the ČD Environment

As a ČD data subject, you have probably provided us with your personal data as part of your communication with us; we have thus become a controller of your personal data.

We place great emphasis on the protection of your personal data.

In accordance with Regulation of the European Parliament and Council No. 2016/679, on personal data protection (GDPR) and related regulations, you can exercise your rights in connection with the processing of your personal data.

This document will provide you with all information concerning options for exercising your rights in connection with your personal data.

Exercising the rights of the data subject

In order to make it easy for you to exercise your rights, no matter your relationship to ČD, we have prepared the Form for exercising rights concerning personal data, which is available on www.cd.cz/kontaktni-formular/, together with our complete terms and conditions of personal data protection available on www.cd.cz/pravasubjektu/. Upon request, we can also send you the form by Post. In the form, you will additionally find a detailed description of where to direct your request and what supporting documents are required.

You can exercise you rights concerning personal data, including revocation of consent, even without using the form.

Our highest priority is to prevent the loss, irreversible change or abuse of your personal data. This is why we always have to securely verify that the person submitting a request is really you. We must therefore insist on particular methods and supporting documents when making requests to exercise your rights.

Even so, if we are in doubt as to whether a request is being made by you or if we lack sufficient data to grant your request, we will ask you to provide further supplementary information. If you submit a request using the online contact form or by e-mail, we will always immediately confirm receipt of your request and inform you of when you can expect it to be processed, and possibly also of how your personal data will be handled in the interim.

Customers’ rights concerning personal data

Right to information

You have the right to information about the processing of your personal data. This information is always kept up-to-date and is available on www.cd.cz/pravasubjektu/. We will also attach this information to your request for access to personal data.

Access to personal data

If you need additional information about your specific personal data, you have the right to information about whether we are processing your personal data as well as the right to receive a copy of your personal data and the details of such processing. In addition, you have the right to access a catalogue of your rights – to correction, erasure, limitations on processing, to raise an objection to processing, to lodge a complaint with a supervisory authority.

Correction of personal data

It is our interest to process only up-to-date and accurate personal data. You thus have the right to correct inaccurate personal data and to supplement incomplete personal data. This means, for example, that whenever you change your e-mail address or telephone number we will always update it immediately so as to ensure problem-free communication. Therefore, please always inform us of changes to your personal information or make the updates yourself.

Objection to processing

If you believe that our legitimate interest in processing your personal data is not well-founded, then you have the right to raise an objection to the processing of personal data, including profiling. We will assess your request and if we determine that our interest in further processing does not outweigh your interest in the termination of such processing, then we will terminate the processing of your personal data. You also can proceed in the same manner in the event of an objection to direct marketing which we are not conducting on the basis of consent. Upon receipt of such an objection, we will terminate processing immediately without additional formalities.

Limitation of processing

You have the right to have us limit the processing of personal data to its storage and evident differentiation from other processed personal data if you believe that:

  • the personal data are not accurate
  • the processing of the personal data is illegal, but you do not wish to erase it
  • we need the personal data for the establishment, exercise or defence of legal claims, even if ČD no longer needs them
  • you object to the legitimacy of our interest in processing such data, for the duration of the period in which ČD will analyse the legitimacy of such interest

Erasure of personal data

You have the right to “be forgotten”, i.e. the right to have us erase all (or only certain) personal data once they are no longer necessary for the purposes for which they were processed and there is no legal reason for further processing, and of course also if such personal data were processed illegally. We will also erase your personal data if they are being processed on the basis of consent and you revoke such consent. They will further be erased if you raise an objection to such processing and we conclude that our legitimate interest does not outweigh your interest in terminating such processing (in cases where your personal data are processed on the basis of our legitimate interest), or if you raise an objection to such processing for purposes of direct marketing. We will also erase your personal information if we are ordered to do so in accordance with the law.

Your personal information cannot be erased in all cases, however. There exist reasons for which it is possible to continue processing despite your request, in particular the need for further processing for the establishment, exercise or defence of our legal claims, the fulfilment of our legal responsibilities or the exercise of rights to the freedoms of speech and information, as well as for scientific or historic research or for statistical or archiving purposes in the public interest. Unless further processing is essential, however, we will grant your request immediately.


You have the right to “take away” your personal data from us and give it to a different controller. In this manner, it is possible to transfer all the personal information that we process by automated means on the basis of your consent or in fulfilment of a contract. We will make available all data to you or to the new controller in a structured, commonly used and machine-readable format. However, completion of the transfer process is the responsibility of your new controller and its technical facilities. Simply put, we cannot guarantee that the new controller will be able to read and work with your personal data.

Revocation of consent

If we are processing your personal data on the basis of your consent, you can simply revoke such consent at any time. As soon as we receive your revocation of consent, we will no longer process your personal data for these purposes. You will find the procedure for revoking consent in the chapter on exercising customers’ rights. Before you fill in the form, please keep in mind that in certain cases you can also revoke your consent more easily, e.g. in the ČD e-shop.

Lodging a complaint with a supervisory authority

If you are convinced that your rights under the legislation have been violated, you can address a complaint directly to a supervisory authority in certain EU member states, in particular in the member state of your normal residence, your place of employment or the place where the alleged violation occurred. The supervisory authority in the Czech Republic is the Office for the Protection of Personal Data (Úřad pro ochranu osobních údajů).

ČD Directory

Passenger Transport, Information for passengers, www.cd.cz

Transport, Information for partners, www.cdcargo.cz

Switchboard operator
+420 221 111 122
Online form
Send us a question or comment by e-mail.