🔒 Data Protection Regulatory Intelligence
Data Protection Monitor · dataprotection.gi
PL v13-gdpri-1.0.0
content: ai_generated legal review: never_reviewed (informational) publication gate: 0 failing16 sources retrieved model claude-sonnet-5 · 2026-08-03

Poland

PL schema gdpri-v2 trajectory: not yet assessedregulated (omnibus)overlaps: AIC

Last updated · 10 categories · 37 claims · 25 sources in the cumulative register

10Categoriesbaseline.[]
57Sub-modulesbaseline..sub_modules{}
37Claimsbaseline..claims[]
10Tier-1 sourcesrun_metadata.t1_source_count
Traffic-light mix (sums to 10 rendered categories; click to filter)
No categories are currently flagged red.

Jurisdiction brief

Latest update · 28 September 2026

Lead Signal

The UODO's enforcement posture in Poland continues to escalate. Following what secondary reporting characterises as a record 2025 with over PLN 64 million in fines, 2026 has already produced a further large single decision: UODO fined DPD Polska PLN 11 million on 23 February 2026 following an ex officio inspection of courier-delivery data processing, splitting the penalty between deficient data-processing-agreement governance (PLN 6.251 million) and inadequate technical and organisational access controls (PLN 5.209 million). This is understood to be the largest 2026 fine to date, and it sits alongside an earlier decision against a delivery platform (Glovo), fined almost PLN 5.9 million for requiring users to upload ID-card scans for anti-fraud purposes with no legal basis, in breach of the data-minimisation principle, with UODO ordering erasure of the collected scans.

10 of 10 categories
Signal
Density

Selections OR within a group, AND across groups. Press / to search.

#

Mature, non-derogating GDPR implementation with an active, well-resourced single supervisory authority and 8 years of enforcement practice.

Primary frameworkAct of 10 May 2018 on the Protection of Personal Data, implementing Regulation (EU) 2016/679 (GDPR)
Supervisory authorityUODO (Prezes Urzędu Ochrony Danych Osobowych)
Traffic-light rationale — GreenMature, non-derogating GDPR implementation with an active, well-resourced single supervisory authority and 8 years of enforcement practice.

Sub-modules (5)

Regulator And AuthorityGreen

UODO's President is the GDPR supervisory authority; other bodies (UOKiK, Office of Electronic Communications) can take related but distinct enforcement action.

Claims (1):

  • UODO's President is the competent GDPR supervisory authority in Poland, with powers to conduct compliance audits, issue administrative decisions and publish guidance.

Act And InstrumentsGreen

Primary instrument is the Act of 10 May 2018, applying GDPR without major derogation.

Claims (1):

  • The Act of 10 May 2018 on the Protection of Personal Data implements the GDPR in Poland and does not contain major derogations from the Regulation.

Material ScopeGreen

Material scope follows GDPR Art 2 - automated processing and structured manual filing systems of personal data.

Claims (1):

  • As a non-derogating GDPR implementation, Poland's material scope of protected processing mirrors GDPR Article 2 (automated processing and structured filing systems).

Territorial ScopeGreen

Territorial scope follows GDPR Art 3 - applies to non-established controllers targeting or monitoring data subjects in Poland/EU.

Claims (1):

  • Poland's territorial scope of application to non-established controllers mirrors GDPR Article 3, extending to entities targeting or monitoring data subjects in Poland.

Regulator Registration And FilingGreen

No general controller registration regime; however DPO appointments must be notified to UODO within 14 days of appointment.

Claims (1):

  • Controllers and processors must notify the appointment of a DPO to PUODO within 14 days of the appointment.

Key findings (1)

  • Draft AI Systems Act would create KRiBSI as primary AI supervisory authority, with UODO retaining only a coordination role. — source on file
Category narrative75 words

Poland's data protection regime is a GDPR-implementation jurisdiction. The Act of 10 May 2018 on the Protection of Personal Data establishes the Prezes Urzędu Ochrony Danych Osobowych (President of the Personal Data Protection Office, UODO/PUODO) as the sole supervisory authority for GDPR matters, with audit, decision-making and guidance-issuing functions. The Act is described as containing no major derogations from the GDPR, meaning material and territorial scope track the GDPR baseline (Articles 2 and 3) directly.

No new data since the standing brief. 1 periodic run re-emitted it unchanged.

Sources and claims (5)
  1. ConfirmedDataGuidance — UODO's President is the competent GDPR supervisory authority in Poland, with powers to conduct compliance audits, issue administrative decisions and publish guidance.observed
  2. ConfirmedDataGuidance — The Act of 10 May 2018 on the Protection of Personal Data implements the GDPR in Poland and does not contain major derogations from the Regulation.observed
  3. ProbableEUR-Lex — As a non-derogating GDPR implementation, Poland's material scope of protected processing mirrors GDPR Article 2 (automated processing and structured filing systems).observed
  4. ProbableEUR-Lex — Poland's territorial scope of application to non-established controllers mirrors GDPR Article 3, extending to entities targeting or monitoring data subjects in Poland.observed
  5. ConfirmedIAPP — Controllers and processors must notify the appointment of a DPO to PUODO within 14 days of the appointment.observed

#

GDPR-aligned lawful basis and consent framework with active enforcement precedent; anonymisation/pseudonymisation guidance is comparatively thin.

Primary frameworkGDPR Articles 6, 7, 9; Act of 10 May 2018
Supervisory authorityUODO (Prezes Urzędu Ochrony Danych Osobowych)
Traffic-light rationale — GreenGDPR-aligned lawful basis and consent framework with active enforcement precedent; anonymisation/pseudonymisation guidance is comparatively thin.

Sub-modules (4)

Lawful BasesGreen

Six GDPR Art 6 lawful bases apply without national variation.

Claims (1):

  • Data controllers in Poland must rely on one of the GDPR Article 6 lawful bases (consent, contract, legal obligation, vital interests, public task, legitimate interests) to process personal data lawfully.

Special CategoriesAmber

UODO's non-binding employer's guide addresses handling of sensitive/employment data, including restrictions on background checks and social media screening.

Claims (1):

  • UODO's employer's guide sets out restrictive views on collecting candidate and employee data, including that former employers and social media accounts should generally not be used as data sources without specific justification; this guidance is formally non-binding.

Pseudonymisation And AnonymisationAmber

No Poland-specific statutory safe-harbour or dedicated UODO guidance on pseudonymisation/anonymisation definitions was identified beyond the GDPR Article 4(5) baseline.

Absence provenance: unavailable. Searched: unavailable.

Category narrative58 words

Lawful bases, consent standards and special-category rules in Poland follow GDPR Articles 6, 7 and 9 directly, given the Act's non-derogating approach. UODO enforcement (e.g. the ClickQuickNow decision) confirms strict application of the Article 7(3) 'easy withdrawal' consent standard. UODO's non-binding employer's guide addresses special-category and employment data handling but is not itself a source of binding law.

Sources and claims (3)
  1. ConfirmedEUR-Lex — Data controllers in Poland must rely on one of the GDPR Article 6 lawful bases (consent, contract, legal obligation, vital interests, public task, legitimate interests) to process personal data lawfully.observed
  2. ConfirmedEDPB — UODO fined a company over PLN 201,000 for obstructing the exercise of the right to withdraw consent, finding that withdrawal mechanisms must be as easy as giving consent under Article 7(3) GDPR.observed
  3. ProbableDataGuidance — UODO's employer's guide sets out restrictive views on collecting candidate and employee data, including that former employers and social media accounts should generally not be used as data sources without specific justification; this guidance is formally non-binding.observed

#

Full GDPR rights framework in force with confirmed enforcement precedent on erasure/objection; deadlines follow the standard one-month GDPR response window.

Primary frameworkGDPR Articles 12-22; Act of 10 May 2018
Supervisory authorityUODO (Prezes Urzędu Ochrony Danych Osobowych)
Traffic-light rationale — GreenFull GDPR rights framework in force with confirmed enforcement precedent on erasure/objection; deadlines follow the standard one-month GDPR response window.

Sub-modules (5)

Access RightGreen

Article 15 access right applies without national modification.

Rectification And ErasureGreen

UODO has enforced erasure/'right to be forgotten' obligations where controllers processed data of objectors without legal basis.

Claims (1):

  • UODO found that a company unlawfully continued processing personal data of individuals who were not its customers and who had objected to processing, in violation of the right to erasure/'right to be forgotten'.

Restriction And ObjectionGreen

UODO enforcement confirms the right to object must be operationalised effectively by controllers.

Claims (1):

  • UODO found that a company unlawfully continued processing personal data of individuals who were not its customers and who had objected to processing, in violation of the right to erasure/'right to be forgotten'.

Data PortabilityAmber

Article 20 portability right applies without national modification; no PL-specific derogation or guidance beyond GDPR baseline identified.

Absence provenance: unavailable. Searched: unavailable.

Deadlines And Response WindowsGreen

The standard GDPR one-month (extendable to three-month) response window applies to controller responses to data subject requests.

Category narrative48 words

Poland applies the GDPR Chapter III data subject rights (access, rectification, erasure, restriction, objection, portability) without national derogation. UODO enforcement precedent (ClickQuickNow) confirms active enforcement of the right to object/erasure ('right to be forgotten') where a controller continued processing after an objection was received without a legal basis.

Sources and claims (1)
  1. ConfirmedEDPB — UODO found that a company unlawfully continued processing personal data of individuals who were not its customers and who had objected to processing, in violation of the right to erasure/'right to be forgotten'.observed

#

Deep, multi-year enforcement record across DPIA/accountability, DPO, ROPA, security, breach-notification and retention obligations confirms these duties are actively supervised and litigated up to appellate courts.

Primary frameworkGDPR Articles 5, 24-39; Act of 10 May 2018
Supervisory authorityUODO (Prezes Urzędu Ochrony Danych Osobowych)
Traffic-light rationale — GreenDeep, multi-year enforcement record across DPIA/accountability, DPO, ROPA, security, breach-notification and retention obligations confirms these duties are actively supervised and litigated up to appellate courts.

Sub-modules (7)

Accountability And DpiaGreen

UODO enforcement of the accountability principle (Art 5(2)) includes findings on inadequate ROPA and lack of documented risk analysis.

Claims (1):

  • UODO found a mayor's office breached the accountability principle (Article 5(2) GDPR) due to shortcomings in its register of processing activities and absence of risk analysis for publication of council meeting recordings.

Dpo RequirementsGreen

DPOs must be appointed per Art 37 GDPR conditions and notified to PUODO within 14 days.

Claims (1):

  • Controllers and processors must notify the appointment of a DPO to PUODO within 14 days of the appointment.

Ropa RequirementsGreen

A public-entity controller was fined in part for a deficient register of processing activities lacking recipients and deletion dates.

Claims (1):

  • The first administrative fine imposed on a Polish public entity (PLN 40,000) included findings that its register of processing activities failed to indicate all data recipients or planned deletion dates.

Joint Controller ArrangementsGreen

Warsaw's administrative court confirmed a controller (Fortum) remained responsible for security even where a processor (Pika) created an unauthorised additional database.

Claims (1):

  • The Provincial Administrative Court in Warsaw confirmed that a controller remains responsible for the security of personal data processing and cannot shift that responsibility entirely to its processor.

Security MeasuresGreen

UODO imposed a €645,000 fine for insufficient technical and organisational security measures following a large-scale data breach.

Claims (1):

  • UODO imposed a €645,000 fine on a company for failing to implement technical means of data protection appropriate to risk, breaching the confidentiality principle of Article 5(1)(f) GDPR, after a breach exposed data of about 2.2 million people.

Breach NotificationGreen

Polish courts have upheld UODO fines for failure to notify breaches within the 72-hour window and for failing to communicate breaches to affected individuals.

Claims (2):

  • A Provincial Administrative Court upheld a PLN 16,000 UODO fine against a company for failing to report a data breach, emphasising the obligation to notify UODO within 72 hours of discovering a breach.
  • UODO imposed a further fine of over PLN 85,000 on a healthcare entrepreneur for failing to comply with an order to communicate a personal data breach to affected patients.

Retention And DisposalGreen

UODO found a storage-limitation violation (Art 5(1)(e)) where a public body retained property declarations beyond the statutory 6-year retention period.

Claims (1):

  • UODO found a public body violated the storage-limitation principle (Article 5(1)(e) GDPR) by retaining property declarations from 2010 despite a statutory 6-year retention period.
Category narrative77 words

UODO enforcement demonstrates active application of accountability, ROPA, breach notification, security and retention obligations. Notable cases include a fine on a municipal mayor for lacking Article 28(3) processing agreements and violating storage-limitation/accountability principles, an entrepreneur fined for failing to communicate a breach to patients, a company fined €645,000 for insufficient technical/organisational security measures following a 2.2 million-record breach, and a joint controller/processor case (Fortum/Pika) confirming that a controller cannot shift responsibility for security entirely to its processor.

Sources and claims (7)
  1. ConfirmedEDPB — UODO found a mayor's office breached the accountability principle (Article 5(2) GDPR) due to shortcomings in its register of processing activities and absence of risk analysis for publication of council meeting recordings.observed
  2. ConfirmedEDPB — The first administrative fine imposed on a Polish public entity (PLN 40,000) included findings that its register of processing activities failed to indicate all data recipients or planned deletion dates.observed
  3. ConfirmedDataGuidance — The Provincial Administrative Court in Warsaw confirmed that a controller remains responsible for the security of personal data processing and cannot shift that responsibility entirely to its processor.observed
  4. ConfirmedEDPB — UODO imposed a €645,000 fine on a company for failing to implement technical means of data protection appropriate to risk, breaching the confidentiality principle of Article 5(1)(f) GDPR, after a breach exposed data of about 2.2 million people.observed
  5. ConfirmedDataGuidance — A Provincial Administrative Court upheld a PLN 16,000 UODO fine against a company for failing to report a data breach, emphasising the obligation to notify UODO within 72 hours of discovering a breach.observed
  6. ConfirmedEDPB — UODO imposed a further fine of over PLN 85,000 on a healthcare entrepreneur for failing to comply with an order to communicate a personal data breach to affected patients.observed
  7. ConfirmedEDPB — UODO found a public body violated the storage-limitation principle (Article 5(1)(e) GDPR) by retaining property declarations from 2010 despite a statutory 6-year retention period.observed

#

Core transfer mechanisms are harmonised and green at EU level, but Poland-specific friction exists around telecom data-retention law that UODO itself has flagged as inconsistent with EU standards, and this evidence set could not source distinct Polish-issued adequacy decisions (correctly, as this is an EU Commission competence).

Primary frameworkGDPR Chapter V (Articles 44-49); EU Commission adequacy decisions
Supervisory authorityUODO (Prezes Urzędu Ochrony Danych Osobowych)
Traffic-light rationale — AmberCore transfer mechanisms are harmonised and green at EU level, but Poland-specific friction exists around telecom data-retention law that UODO itself has flagged as inconsistent with EU standards, and this evidence set could not source distinct Polish-issued adequacy decisions (correctly, as this is an EU Commission competence).

Sub-modules (6)

Transfer MechanismsGreen

GDPR Chapter V mechanisms apply uniformly; UODO acted as lead supervisory authority in a cross-border complaint from a German data subject.

Claims (1):

  • UODO acted as lead supervisory authority under the GDPR one-stop-shop mechanism in a cross-border complaint originally lodged with the German DPA for Rhineland-Palatinate, because the controller company was established in Poland.

Adequacy ReceivedAmber

Adequacy decisions are issued at EU Commission level, not by individual Member States; no Poland-specific adequacy-received finding applies distinct from the EU baseline.

Absence provenance: unavailable. Searched: unavailable.

Adequacy GrantedAmber

Adequacy decisions granted to third countries are issued by the European Commission on behalf of the EU, not individually by Poland.

Absence provenance: unavailable. Searched: unavailable.

Sccs And BcrsGreen

Standard Contractual Clauses and BCRs approved by the EDPB/Commission are directly applicable in Poland; no Poland-specific variant identified.

Transfer Impact AssessmentAmber

TIA requirements follow the EDPB/CJEU Schrems II framework applied uniformly across the EU including Poland; no distinct Polish TIA guidance was located in this research pass.

Absence provenance: unavailable. Searched: unavailable.

Data LocalisationAmber

UODO issued an opinion criticising Polish telecommunications data-retention law as inconsistent with EU standards, raising localisation/retention-adjacent privacy risks.

Claims (1):

  • UODO issued an opinion highlighting the inconsistency of Polish telecommunications data-retention laws with EU standards and associated privacy risks.
Category narrative87 words

As an EU Member State, Poland relies on the GDPR's harmonised cross-border transfer mechanisms (adequacy decisions issued by the European Commission, SCCs, BCRs, and Article 49 derogations); Poland's UODO does not issue its own third-country adequacy decisions, since that competence sits with the European Commission at EU level. UODO does participate actively in the GDPR one-stop-shop cooperation mechanism as lead or concerned authority in cross-border cases. A distinct localisation-adjacent concern flagged by UODO is Polish telecommunications data-retention law, which UODO's own opinion found inconsistent with EU standards.

Sources and claims (2)
  1. ConfirmedEDPB — UODO acted as lead supervisory authority under the GDPR one-stop-shop mechanism in a cross-border complaint originally lodged with the German DPA for Rhineland-Palatinate, because the controller company was established in Poland.observed
  2. ProbableDataGuidance — UODO issued an opinion highlighting the inconsistency of Polish telecommunications data-retention laws with EU standards and associated privacy risks.observed

#

Health, employment, education and credit-scoring/data-broker sub-sectors show active supervisory engagement; financial-sector-specific and insurance-specific DP overlays were not surfaced in this research pass.

Primary frameworkGDPR (general); sector legislation (Education Law, Cybersecurity Act/NIS2 implementation, Telecommunications Law) applied alongside UODO oversight
Supervisory authorityUODO (Prezes Urzędu Ochrony Danych Osobowych)
Traffic-light rationale — AmberHealth, employment, education and credit-scoring/data-broker sub-sectors show active supervisory engagement; financial-sector-specific and insurance-specific DP overlays were not surfaced in this research pass.

Sub-modules (7)

Financial Sector OverlayAmber

No Poland-specific financial-sector DP overlay (e.g. banking-secrecy vs GDPR conflict) was surfaced in this research pass.

Absence provenance: unavailable. Searched: unavailable.

Health Sector OverlayGreen

A healthcare entrepreneur was fined for failing to comply with a UODO order to notify patients of a personal data breach.

Claims (1):

  • UODO fined a healthcare-sector entrepreneur more than PLN 85,000 for failing to comply with an administrative order requiring it to notify affected patients of a personal data breach.

Telecoms And EprivacyAmber

UODO has flagged inconsistency between Polish telecommunications data-retention law and EU standards, and cookie-related guidance exists alongside the ePrivacy Directive framework.

Claims (1):

  • UODO issued an opinion highlighting the inconsistency of Polish telecommunications data-retention laws with EU standards and associated privacy risks.

Employment DataAmber

UODO's non-binding 2018 employer's guide sets restrictive expectations for recruitment and employment-related personal data processing.

Claims (1):

  • UODO's employer's guide sets out restrictive views on collecting candidate and employee data, including that former employers and social media accounts should generally not be used as data sources without specific justification; this guidance is formally non-binding.

Credit And ScoringGreen

A data-broker/business-information company was fined roughly €220,000 for failing to provide Article 14 privacy notices to millions of individuals whose data it held in credit/business-verification records.

Claims (1):

  • A Polish data-broker/business-verification company holding over 7.5 million records was fined approximately €220,000 for failing to provide Article 14 GDPR privacy notices to most affected business owners.

EducationGreen

UODO commented on a draft amendment to the Education Law, flagging privacy concerns and recommending refinements.

Claims (1):

  • UODO commented on a draft amendment to Poland's Education Law, highlighting privacy concerns and recommending refinements to better protect personal data.

InsuranceAmber

No Poland-specific insurance-sector DP overlay was surfaced in this research pass.

Absence provenance: unavailable. Searched: unavailable.

Category narrative71 words

Sectoral overlays in Poland are led by UODO for GDPR compliance, with parallel competences held by UOKiK (competition/consumer protection, including dark-pattern detection) and the Office of Electronic Communications for telecoms. UODO enforcement touches healthcare (breach-notification failures), employment (via non-binding employer guidance), and education (commenting on draft Education Law amendments). A distinct credit-scoring/data-broker enforcement action (a business-information company processing 7.5 million records) resulted in a substantial fine for Article 14 transparency failures.

No new data since the standing brief. 1 periodic run re-emitted it unchanged.

Sources and claims (3)
  1. ConfirmedEDPB — UODO fined a healthcare-sector entrepreneur more than PLN 85,000 for failing to comply with an administrative order requiring it to notify affected patients of a personal data breach.observed
  2. ConfirmedEuropean Commission — A Polish data-broker/business-verification company holding over 7.5 million records was fined approximately €220,000 for failing to provide Article 14 GDPR privacy notices to most affected business owners.observed
  3. ProbableDataGuidance — UODO commented on a draft amendment to Poland's Education Law, highlighting privacy concerns and recommending refinements to better protect personal data.observed

#

Cookie/consent and direct-marketing enforcement are well evidenced; dark-pattern enforcement is emerging via UOKiK; opt-out signal, clean-room and cross-context advertising sub-modules lack Poland-specific evidence.

Primary frameworkePrivacy Directive 2002/58/EC (as transposed into Polish Telecommunications Law); GDPR Article 6/7 for marketing consent
Supervisory authorityUODO (Prezes Urzędu Ochrony Danych Osobowych)
Traffic-light rationale — AmberCookie/consent and direct-marketing enforcement are well evidenced; dark-pattern enforcement is emerging via UOKiK; opt-out signal, clean-room and cross-context advertising sub-modules lack Poland-specific evidence.

Sub-modules (6)

Cookies And TrackersGreen

UODO has published guidance on cookies alongside the ePrivacy Directive framework as transposed into Polish telecommunications law.

Claims (1):

  • UODO has published guidance addressing cookies, alongside guidance on employment data protection and DPIAs.

Dark PatternsAmber

UOKiK is developing AI-based tools specifically to detect and combat dark patterns in online commerce.

Claims (1):

  • UOKiK (Poland's Office of Competition and Consumer Protection) is developing AI-based tools to detect and combat dark patterns in online commerce.

Opt Out SignalsAmber

No Poland-specific finding on Global Privacy Control or DAA-style opt-out signal recognition was surfaced.

Absence provenance: unavailable. Searched: unavailable.

Clean Rooms And DcrAmber

No Poland-specific clean-room/data-collaboration-room rule was surfaced.

Absence provenance: unavailable. Searched: unavailable.

Cross Context AdvertisingAmber

No Poland-specific cross-context advertising ('sale'/'share' style) rule was surfaced; general GDPR consent/legitimate-interest rules for advertising apply.

Absence provenance: unavailable. Searched: unavailable.

Direct MarketingGreen

UODO enforcement confirms strict standards for direct-marketing consent withdrawal mechanisms.

Claims (1):

  • UODO fined a company over PLN 201,000 for obstructing the exercise of the right to withdraw consent, finding that withdrawal mechanisms must be as easy as giving consent under Article 7(3) GDPR.
Category narrative72 words

Cookie and tracker consent in Poland follows the ePrivacy Directive framework as transposed into Polish Telecommunications Law, supplemented by UODO cookie guidance. UOKiK (the competition/consumer authority) is separately developing AI tools to detect and combat dark patterns in online commerce. UODO enforcement against obstructive consent-withdrawal mechanisms (ClickQuickNow) is directly relevant to direct-marketing consent practices. Poland-specific findings on opt-out signals (GPC/DAA), clean rooms, and cross-context advertising were not surfaced in this research pass.

Sources and claims (2)
  1. ConfirmedDataGuidance — UODO has published guidance addressing cookies, alongside guidance on employment data protection and DPIAs.observed
  2. ProbableDataGuidance — UOKiK (Poland's Office of Competition and Consumer Protection) is developing AI-based tools to detect and combat dark patterns in online commerce.observed

#

AI governance framework is actively in development (draft law, not yet finalised) with UODO's competence recognised but cooperation rules incomplete; biometric/genetic/surveillance-carveout sub-modules lack dedicated Poland-specific evidence.

Primary frameworkGDPR Article 22; Regulation (EU) 2024/1689 (EU AI Act) as implemented via Poland's draft AI implementing law (KRiBSI)
Supervisory authorityUODO (Prezes Urzędu Ochrony Danych Osobowych)
Traffic-light rationale — AmberAI governance framework is actively in development (draft law, not yet finalised) with UODO's competence recognised but cooperation rules incomplete; biometric/genetic/surveillance-carveout sub-modules lack dedicated Poland-specific evidence.

Sub-modules (6)

Profiling RestrictionsGreen

GDPR Article 22 restrictions on solely automated decision-making with legal/similarly significant effects apply without national derogation.

Claims (1):

  • Poland applies GDPR Article 22's restriction on decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects, without national derogation.

Automated Decision Making TransparencyGreen

Transparency obligations for automated decision-making follow GDPR Articles 13-15 without Poland-specific variation identified.

Claims (1):

  • Poland applies GDPR Article 22's restriction on decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects, without national derogation.

Ai Risk AssessmentsAmber

Poland's Council of Ministers adopted a draft law implementing the EU AI Act, establishing KRiBSI as the national market surveillance authority, with UODO recognised as having exclusive supervisory competence over high-risk AI systems, though the draft reportedly lacks detailed cooperation rules.

Claims (2):

  • Poland's Council of Ministers adopted a draft law implementing the EU AI Act, establishing KRiBSI as the national market surveillance authority to supervise AI compliance and support innovation.
  • Poland's draft AI implementing law recognises UODO's exclusive supervisory competence over high-risk AI systems, but commentary indicates the draft lacks detailed inter-authority cooperation rules and explicit protection of fundamental rights.

Biometric RegimeAmber

No Poland-specific biometric data regime (facial recognition/fingerprint/gait) finding was surfaced in this research pass.

Absence provenance: unavailable. Searched: unavailable.

Genetic DataAmber

No Poland-specific genetic data regime finding was surfaced beyond the GDPR Article 9 special-category baseline.

Absence provenance: unavailable. Searched: unavailable.

State Surveillance CarveoutsAmber

No Poland-specific state-surveillance carveout/national-security exemption finding was surfaced in this research pass.

Absence provenance: unavailable. Searched: unavailable.

Key findings (1)

  • UODO's exclusive high-risk-AI supervisory competence recognised in draft, but cooperation rules and fundamental-rights protections undetailed. — source on file
Category narrative82 words

Profiling and automated decision-making restrictions in Poland follow GDPR Article 22 directly. The dominant recent development is Poland's implementation of the EU AI Act: the Council of Ministers adopted a draft law designating KRiBSI as the national market surveillance authority for AI, and the draft recognises UODO's exclusive supervisory competence over high-risk AI systems, though commentary notes the draft law lacks detailed inter-authority cooperation rules and explicit fundamental-rights protections. Poland-specific biometric-regime, genetic-data, and state-surveillance-carveout findings were not surfaced in this research pass.

No new data since the standing brief. 1 periodic run re-emitted it unchanged.

Sources and claims (3)
  1. ProbableEUR-Lex — Poland applies GDPR Article 22's restriction on decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects, without national derogation.observed
  2. ProbableDataGuidance — Poland's Council of Ministers adopted a draft law implementing the EU AI Act, establishing KRiBSI as the national market surveillance authority to supervise AI compliance and support innovation.observed
  3. UncertainDataGuidance — Poland's draft AI implementing law recognises UODO's exclusive supervisory competence over high-risk AI systems, but commentary indicates the draft lacks detailed inter-authority cooperation rules and explicit protection of fundamental rights.observed

#

Age-verification-for-adult-content legislation is a live, not-yet-fully-effective development; the precise Article 8 age-of-consent figure for Poland could not be confirmed with a dedicated primary-source citation in this pass, and minor-profiling-ban / dependent-adult sub-modules lack direct evidence.

Primary frameworkGDPR Article 8; Act of 10 May 2018; draft act on age verification for online adult content
Supervisory authorityUODO (Prezes Urzędu Ochrony Danych Osobowych)
Traffic-light rationale — AmberAge-verification-for-adult-content legislation is a live, not-yet-fully-effective development; the precise Article 8 age-of-consent figure for Poland could not be confirmed with a dedicated primary-source citation in this pass, and minor-profiling-ban / dependent-adult sub-modules lack direct evidence.

Sub-modules (5)

Age VerificationAmber

Poland's Council of Ministers adopted a draft act requiring age verification for online adult content to protect minors.

Claims (1):

  • Poland's Council of Ministers adopted a draft act requiring age verification for online adult content specifically to protect minors.

Minor Profiling BansAmber

No Poland-specific ban on profiling of minors distinct from the general GDPR Article 22/Recital 71 baseline was surfaced.

Absence provenance: unavailable. Searched: unavailable.

Education SettingsGreen

UODO commented on a draft amendment to the Education Law, flagging privacy concerns relevant to pupil data processing.

Claims (1):

  • UODO commented on a draft amendment to Poland's Education Law, highlighting privacy concerns and recommending refinements to better protect personal data.

Dependent AdultsAmber

No Poland-specific dependent-adults (elderly/mentally incapacitated) data protection finding was surfaced in this research pass.

Absence provenance: unavailable. Searched: unavailable.

Category narrative91 words

Poland's Act of 10 May 2018 is described as containing no major derogations from the GDPR, and no Poland-specific lower age-of-consent provision under GDPR Article 8 was located in this research pass, implying the GDPR default age of 16 applies absent an identified national derogation. Separately, Poland's Council of Ministers adopted a draft act requiring age verification for online adult content specifically to protect minors, and UODO has engaged with the Ministry of Education on draft Education Law amendments touching pupil data. No Poland-specific minor-profiling ban or dependent-adults-specific finding was surfaced.

Sources and claims (2)
  1. ProbableDataGuidance — Poland's Council of Ministers adopted a draft act requiring age verification for online adult content specifically to protect minors.observed
  2. UncertainDataGuidance — Because the Act of 10 May 2018 does not contain major derogations from the GDPR, Poland is presumed to apply the GDPR default age of 16 for a child's own consent to information-society services under Article 8, absent an identified national derogation lowering that age.observed

#

UODO exhibits sustained, escalating enforcement activity with judicial oversight (both upholding and overturning decisions), indicating a mature and active enforcement ecosystem; collective-redress mechanisms specific to Poland were not confirmed in this pass.

Primary frameworkGDPR Articles 58, 83, 84; Act of 10 May 2018
Supervisory authorityUODO (Prezes Urzędu Ochrony Danych Osobowych)
Traffic-light rationale — GreenUODO exhibits sustained, escalating enforcement activity with judicial oversight (both upholding and overturning decisions), indicating a mature and active enforcement ecosystem; collective-redress mechanisms specific to Poland were not confirmed in this pass.

Sub-modules (6)

Regulator Powers And PenaltiesGreen

UODO holds full GDPR Article 58 corrective powers including administrative fines, applied against both private companies and public bodies.

Claims (2):

  • UODO's corrective powers include the power to order breach communication to data subjects and to impose administrative fines in addition to or instead of other Article 58(2) GDPR measures.
  • UODO imposed a PLN 15,000 fine on a company for failing to provide the supervisory authority with access to personal data and information necessary for performance of its tasks in a cross-border complaint.

Enforcement Activity IndexGreen

Multiple significant fines and court decisions occurred within the last 12 months, spanning breach notification, security, transparency and election-related data misuse.

Claims (3):

  • UODO fined the Minister of Justice PLN 100,000 for unlawful access and misuse of judges' personal data.
  • The Provincial Administrative Court in Warsaw overturned UODO's PLN 27 million fine against Poczta Polska concerning personal data processing during the 2020 postal presidential elections.
  • UODO fined the Nawrocki Presidential Electoral Committee PLN 35,582 for unlawfully disclosing personal data during a press conference.

Regulator Funding And CapacityAmber

Historical EU Commission data show Poland's DPA received one of the highest complaint volumes in the EU/EEA (around 12,000 complaints in the 2018-2019 period), indicating substantial caseload relative to peer authorities; more current staffing/budget figures were not located in this pass.

Claims (1):

  • Between 25 May 2018 and 30 November 2019, Poland's data protection authority was among the highest-volume EU/EEA authorities, registering around 12,000 complaints in that period.

Collective Redress And Class ActionsAmber

No Poland-specific collective-redress or class-action mechanism for data protection claims was surfaced in this research pass.

Absence provenance: unavailable. Searched: unavailable.

Private Right Of ActionGreen

GDPR Articles 79/82 provide for judicial remedies and compensation; Polish administrative courts (Provincial Administrative Court in Warsaw, Supreme Administrative Court) actively review UODO decisions on appeal by both controllers and complainants.

Claims (1):

  • Polish administrative courts, including the Provincial Administrative Court in Warsaw and the Supreme Administrative Court, actively review and can uphold or overturn UODO's administrative fine decisions on appeal.

Recent Developments 180DGreen

Within the last 180 days, Poland signed an amended Cybersecurity Act (19 February 2026) aligning with NIS2, and progressed the Data Management Act implementing the EU Data Governance Act with UODO's President as competent authority; a draft AI implementing law naming KRiBSI as AI market surveillance authority was also adopted by the Council of Ministers.

Claims (2):

  • Poland's amended Cybersecurity Act, aligning with the NIS2 Directive and imposing new compliance deadlines and reporting obligations for key and important entities, was signed on 19 February 2026.
  • Poland's Parliament passed the Data Management Act to ensure full application of the EU Data Governance Act, designating UODO's President as the competent authority.
Category narrative127 words

UODO has broad GDPR Article 58 corrective powers, including administrative fines, which it has used extensively across public and private sector controllers since 2019. Recent 12-month enforcement activity (to August 2026) includes a PLN 100,000 fine on the Minister of Justice for unlawful access to judges' personal data, a PLN 35,582 fine on a presidential electoral committee, upheld fines against Fortum/Pika for a breach affecting over 90,000 individuals, and a Provincial Administrative Court decision overturning a PLN 27 million fine against Poczta Polska (illustrating active judicial review of UODO decisions). Poland's amended Cybersecurity Act (signed 19 February 2026) and the Data Management Act (implementing the EU Data Governance Act, with UODO's President as competent authority) are recent developments within the last 180 days materially affecting UODO's remit.

Periodic update · new data 2026-09-28

Enforcement & Redress

Poland's data-protection enforcement environment continues on an escalating trajectory into 2026. Secondary reporting characterises 2025 as a record enforcement year for UODO, with over PLN 64 million in fines issued across the year; this figure has not yet been directly corroborated against UODO's own published annual report, and its precise official total remains an open question. Regardless of that outstanding corroboration, 2026 enforcement activity has already produced a large individual decision that reinforces the escalating-intensity picture: UODO fined DPD Polska PLN 11 million on 23 February 2026 following an ex officio inspection of courier-delivery data processing. The penalty was split between deficient governance of data-processing agreements, at PLN 6.251 million, and inadequate technical and organisational access controls, at PLN 5.209 million, indicating UODO's willingness to impose substantial fines across multiple distinct GDPR failure categories within a single decision.

A second material 2026 decision, against a delivery platform (Glovo), imposed a fine of almost PLN 5.9 million for requiring users to upload ID-card scans for anti-fraud purposes without a legal basis, in breach of the data-minimisation principle, with UODO ordering erasure of the collected scans. Both decisions are Probable-confidence findings resting on law-firm and vendor secondary reporting rather than a directly retrieved primary UODO decision page, a sourcing gap that, if closed, would allow these findings to move toward Confirmed status.

Alongside the fine-driven enforcement track, Poland implemented Directive (EU) 2020/1828 in August 2024, amending the Polish Class Actions Act to permit authorised consumer organisations to bring representative GDPR actions seeking injunctive relief and compensation. This collective-redress mechanism is a standing feature of the enforcement-and-redress landscape rather than a new development this cycle, but it means UODO's own administrative fining power now operates alongside a private collective-litigation route as a second enforcement channel available to affected data subjects.

Outlook

Corroboration of UODO's official 2025 total-fines figure against its own published annual report is the most useful confirmation to watch for, given the current reliance on secondary reporting. Continued 2026 enforcement volume, and any use of the August 2024 collective-redress mechanism in a GDPR-specific representative action, would both be significant markers of how Poland's dual administrative-and-collective enforcement architecture is maturing in practice.

1 further periodic run re-emitted the standing brief unchanged and is not shown.

Sources and claims (9)
  1. ConfirmedEDPB — UODO's corrective powers include the power to order breach communication to data subjects and to impose administrative fines in addition to or instead of other Article 58(2) GDPR measures.observed
  2. ConfirmedEDPB — UODO imposed a PLN 15,000 fine on a company for failing to provide the supervisory authority with access to personal data and information necessary for performance of its tasks in a cross-border complaint.observed
  3. ProbableDataGuidance — UODO fined the Minister of Justice PLN 100,000 for unlawful access and misuse of judges' personal data.observed
  4. ProbableDataGuidance — The Provincial Administrative Court in Warsaw overturned UODO's PLN 27 million fine against Poczta Polska concerning personal data processing during the 2020 postal presidential elections.observed
  5. ProbableDataGuidance — UODO fined the Nawrocki Presidential Electoral Committee PLN 35,582 for unlawfully disclosing personal data during a press conference.observed
  6. ConfirmedEuropean Commission — Between 25 May 2018 and 30 November 2019, Poland's data protection authority was among the highest-volume EU/EEA authorities, registering around 12,000 complaints in that period.observed
  7. ConfirmedDataGuidance — Polish administrative courts, including the Provincial Administrative Court in Warsaw and the Supreme Administrative Court, actively review and can uphold or overturn UODO's administrative fine decisions on appeal.observed
  8. ConfirmedDataGuidance — Poland's amended Cybersecurity Act, aligning with the NIS2 Directive and imposing new compliance deadlines and reporting obligations for key and important entities, was signed on 19 February 2026.observed
  9. ConfirmedDataGuidance — Poland's Parliament passed the Data Management Act to ensure full application of the EU Data Governance Act, designating UODO's President as the competent authority.observed
No categories match.

Filters combine as OR inside a group and AND across groups.

Publication gate

No failing checks.

schema_validpass
min_t1_per_instrument_metn/a — no subject in this jurisdiction
min_quoted_text_presentwaived — floor 0%
translation_provenance_recordedn/a — no subject in this jurisdiction
egress_verifiedpass
source_tier_integrity_okpass
jurisdiction_source_floor_metpass
tier_a_b_national_primary_pct62.5
aggregator_only_jurisdiction_count0
manual_override

Editorial metadata

Provenance only. Nothing below gates publication or affects the render.

Editorial metadata for Poland
FieldValue
trust.lawyer_review.statusnever_reviewed
trust.lawyer_review.reviewerno reviewer on record
trust.content_sourceai_generated

Provenance and declared absence

Disclosure model: category cards load OPEN; narratives render in full; standing narratives load as a clamped teaser with an explicit “read full” control carrying the true word count. No text is hidden without disclosing how much of it there is.

Sub-modules are DP-specific nested subsections with their own real per-sub-module traffic light, rendered under each category (BRIEF section 2b.5). Neither WPM nor the crypto monitor carries this field.

Traffic-light dots are REAL data (baseline.<category>.traffic_light), not renderer-invented taxonomy, and are never suppressed -- unlike WPM, where a RAG dot would be forbidden as invented severity.

Family/accent taxonomy is renderer-level presentation config, not a JID field; it decorates the RAG dot, it does not replace it. Colour is always duplicated in text and is never the sole carrier of meaning.

Suppressed by doctrine: derived risk score; derived_scores = {}.

Band honesty: uncertainty bands are computed against a frozen build clock of 2026-10-02. A year-precision row is never promoted into a tighter band.

Envelope: baseline resolved at jurisdiction_json.baseline; 10 categories, 57 sub-module(s), 37 claim(s) (37 category placement(s)), 25 source(s) in the cumulative register.

Think something on this page is wrong? Report an error.

GDPR article map

Cross-reference: which category/sub-module covers each UK GDPR article (37 mapped).

Show article map
GDPR article to category mapping
ArticleCategorySub-module
Art. 5Controller/Processor Dutiesaccountability and dpia
Art. 6Lawful Processing & Special Datalawful bases
Art. 7Lawful Processing & Special Dataconsent thresholds
Art. 9Lawful Processing & Special Dataspecial categories
Art. 13Data Subject Rightsdeadlines and response windows
Art. 14Data Subject Rightsdeadlines and response windows
Art. 15Data Subject Rightsaccess right
Art. 16Data Subject Rightsrectification and erasure
Art. 17Data Subject Rightsrectification and erasure
Art. 18Data Subject Rightsrestriction and objection
Art. 19Data Subject Rightsrectification and erasure
Art. 20Data Subject Rightsdata portability
Art. 21Data Subject Rightsrestriction and objection
Art. 22Algorithmic, Biometric & Surveillance Governanceautomated decision making transparency
Art. 25Controller/Processor Dutiesaccountability and dpia
Art. 28Controller/Processor Dutiesjoint controller arrangements
Art. 30Controller/Processor Dutiesropa requirements
Art. 32Controller/Processor Dutiessecurity measures
Art. 33Controller/Processor Dutiesbreach notification
Art. 34Controller/Processor Dutiesbreach notification
Art. 35Controller/Processor Dutiesaccountability and dpia
Art. 37Controller/Processor Dutiesdpo requirements
Art. 38Controller/Processor Dutiesdpo requirements
Art. 39Controller/Processor Dutiesdpo requirements
Art. 44Cross-Border & Adequacytransfer mechanisms
Art. 45Cross-Border & Adequacyadequacy received
Art. 46Cross-Border & Adequacyadequacy granted
Art. 47Cross-Border & Adequacysccs and bcrs
Art. 48Cross-Border & Adequacysccs and bcrs
Art. 49Cross-Border & Adequacytransfer mechanisms
Art. 77Enforcement & Redressprivate right of action
Art. 78Enforcement & Redressprivate right of action
Art. 79Enforcement & Redressprivate right of action
Art. 80Enforcement & Redresscollective redress and class actions
Art. 82Enforcement & Redressprivate right of action
Art. 83Enforcement & Redressregulator powers and penalties
Art. 84Enforcement & Redressregulator powers and penalties

Self-audit

regulator_and_framework, controller_processor_duties, and enforcement_and_redress modules are well-supported by T1 (EDPB-published UODO press releases, EUR-Lex GDPR text) and T2 (DataGuidance jurisdiction tracker) sources with strong enforcement precedent. lawful_processing_and_special_data, data_subject_rights, sectoral_watch and adtech_and_commercial_privacy rely on a mix of T1/T2/T3 sources with some sub-modules (pseudonymisation/anonymisation, data portability, financial/insurance sectoral overlays, opt-out signals, clean rooms, cross-context advertising) carrying explicit absent_field_provenance due to no Poland-specific finding beyond the GDPR baseline. cross_border_and_adequacy correctly notes that adequacy decisions are an EU Commission competence rather than a Poland-specific finding. algorithmic_biometric_and_surveillance_governance and children_and_vulnerable_groups rely primarily on T2/T3 sources (DataGuidance) for the still-developing Polish AI Act implementation and age-of-consent position, both flagged Uncertain/Probable pending primary-source confirmation.

Unresolved questions (5):

  • What is Poland's specific Article 8 GDPR age-of-consent figure (default 16 vs a lower derogated age) under the Act of 10 May 2018, confirmed by primary statutory text?
  • Has Poland's draft AI Act implementing law (naming KRiBSI as market surveillance authority) been finalised/enacted, and what cooperation mechanism exists between KRiBSI and UODO for high-risk AI systems processing personal data?
  • Are there Poland-specific financial-sector or insurance-sector DP overlays (e.g., banking secrecy interactions with GDPR) beyond the general framework?
  • What is the current (2025-2026) UODO staffing/budget figure, given the cited complaint-volume data is from the 2018-2019 period?
  • Is there a Poland-specific collective-redress/representative-action mechanism operational for GDPR claims under the EU Representative Actions Directive?

Escalate to primary-source review: yes