Data Protection Update in Poland: Q2 2026

Poland data protection 2026 is entering a more demanding phase. The Polish supervisory authority, UODO (Urząd Ochrony Danych Osobowych), has intensified its enforcement posture, new sector-specific guidance has been issued, and several legislative amendments are working their way through the Sejm. For businesses operating in Poland - whether domestic or foreign-owned - the compliance picture is shifting in ways that require prompt attention. This guide covers the key regulatory developments, enforcement signals, practical obligations, and the steps organisations should take to stay ahead.

The current wave of change has three distinct drivers. First, the EU';s broader digital regulatory agenda continues to interact with Poland';s national GDPR implementation law - the Act on Personal Data Protection of May 2018 (the "Polish Data Protection Act") - creating new compliance layers. Second, UODO has published updated guidance on several high-priority areas, including artificial intelligence, employee monitoring, and cross-border data transfers. Third, Polish courts have begun issuing substantive rulings on data subject rights, adding a litigation dimension that was largely absent in earlier years.

Organisations that treat Poland as a low-risk jurisdiction within the EU are increasingly finding that assumption to be incorrect. UODO';s enforcement budget and staffing have grown, its inspection programme has become more systematic, and its willingness to impose meaningful administrative fines has been demonstrated in a series of recent decisions. The combination of regulatory guidance, court decisions, and active enforcement makes this a moment for genuine compliance review rather than a tick-box exercise.

The Polish legislature has been working on targeted amendments to the Polish Data Protection Act to align it more precisely with the EU';s evolving digital framework. The most significant proposed changes concern the legal basis for processing employee data, the conditions under which consent can be relied upon in employment contexts, and the obligations of data processors operating in Poland on behalf of non-EU controllers.

The proposed amendments would tighten the rules on employee monitoring - including electronic monitoring of work devices and location tracking - by requiring employers to document the legitimate purpose of each monitoring measure and to notify employees in a more structured way than current practice demands. Many employers currently rely on general notices in employment contracts or workplace regulations; the amended rules would require a separate, specific notification that names the monitoring method, its scope, and the retention period for collected data.

A non-obvious requirement emerging from the legislative process is the proposed obligation to conduct a Data Protection Impact Assessment (DPIA) for any new employee monitoring system, even where the system would not ordinarily meet the threshold for a mandatory DPIA under Article 35 of the GDPR. This represents a stricter national standard than the baseline EU requirement and would apply to all employers with operations in Poland regardless of where their parent entity is established.

UODO has issued practical guidance on the use of AI tools that process personal data. The guidance does not create new law but clarifies how existing GDPR obligations apply when organisations deploy AI-driven systems for tasks such as recruitment screening, customer profiling, automated decision-making, and fraud detection.

The guidance emphasises three points. First, organisations must be able to demonstrate that their AI systems process only the minimum data necessary for the stated purpose - the principle of data minimisation under Article 5(1)(c) of the GDPR. Second, where AI produces decisions that significantly affect individuals, the requirements of Article 22 of the GDPR on automated decision-making apply in full, including the right to human review. Third, organisations must document their AI systems in their Records of Processing Activities (RoPA) with sufficient detail to allow UODO to assess compliance during an inspection.

In practice, many organisations have been listing AI tools in their RoPA under generic categories such as "analytics" or "IT systems." UODO';s guidance signals that this level of description is insufficient. Each AI tool that processes personal data should be listed separately, with a description of the logic involved, the categories of data processed, and the safeguards in place.

Poland is not a data transfer hub in the same sense as Ireland or Luxembourg, but a significant number of Polish subsidiaries of multinational groups transfer data to parent companies or shared service centres outside the European Economic Area. The current standard contractual clauses (SCCs) adopted by the European Commission remain the primary mechanism for such transfers, but UODO has signalled that it will scrutinise transfer impact assessments (TIAs) more closely during inspections.

A common mistake among Polish subsidiaries of foreign groups is to assume that the parent company';s global data transfer framework covers Polish operations automatically. In practice, the Polish entity is itself a data controller or processor under Polish and EU law, and it bears independent responsibility for ensuring that transfers it initiates or participates in are lawful. Where a TIA has not been conducted or has not been updated to reflect recent developments in the destination country';s legal framework, UODO may treat this as a compliance gap.

UODO';s recent enforcement decisions reveal clear thematic priorities. The authority has focused on: failure to respond to data subject access requests within the statutory one-month period; inadequate technical and organisational security measures leading to personal data breaches; unlawful processing of special category data (particularly health data and biometric data); and failures in the appointment and functioning of Data Protection Officers (DPOs).

On DPOs specifically, UODO has taken action against organisations that appointed DPOs who lacked the requisite expertise, or where the DPO was placed in a position of conflict of interest - for example, where the DPO also held a senior HR or IT management role. Under Article 38 of the GDPR, the DPO must be able to perform their duties independently. UODO has interpreted this strictly, and organisations should review whether their DPO arrangements meet this standard.

Administrative fines imposed by UODO in recent decisions have ranged from relatively modest amounts for procedural failures to more substantial penalties for systemic breaches involving large volumes of data. The authority has also made increasing use of corrective orders - requiring organisations to implement specific remedial measures within a defined timeframe - as a complement to financial penalties.

Poland has seen a rise in the number of personal data breach notifications submitted to UODO, partly reflecting greater awareness among data controllers of the 72-hour notification obligation under Article 33 of the GDPR, and partly reflecting an increase in actual incidents. UODO has used breach notifications as a trigger for broader compliance investigations, examining not only the breach itself but the organisation';s overall security posture, its incident response procedures, and the adequacy of its prior risk assessments.

A practical scenario worth noting: a mid-sized Polish e-commerce company suffered a breach affecting customer payment data. The company notified UODO within the 72-hour window but had not previously conducted a DPIA for its payment processing system, despite that system meeting the threshold for a mandatory DPIA under Article 35. UODO';s investigation found multiple compliance gaps beyond the breach itself, resulting in a corrective order and a fine. The lesson is that breach notification, while necessary, does not insulate an organisation from scrutiny of its broader compliance framework.

If your organisation is reviewing its breach response procedures or has recently experienced an incident, we can assist with the notification process and the regulatory response. Contact us at info@vlolawfirm.com.

Every organisation that processes personal data in Poland - whether as a controller or a processor - must maintain a RoPA under Article 30 of the GDPR. UODO inspections routinely begin with a request to produce the RoPA, and deficiencies in this document often lead to broader scrutiny.

Current UODO guidance emphasises that a RoPA must be a living document, updated whenever a new processing activity is introduced or an existing one changes materially. Organisations that created their RoPA at the time of the GDPR';s entry into force and have not updated it since are at significant risk. Common gaps include: failure to record AI tools and automated systems; outdated retention periods that no longer reflect actual practice; missing entries for processing carried out by third-party processors on the organisation';s behalf; and failure to document the legal basis for each processing activity with sufficient specificity.

A practical scenario: a foreign-owned manufacturing company with a Polish subsidiary assumed that its group-level RoPA, prepared by the parent company';s legal team, was sufficient for Polish compliance purposes. During a UODO inspection, the authority found that the group RoPA did not reflect several processing activities specific to the Polish entity - including employee monitoring systems and a local HR platform - and that the Polish entity had not maintained its own RoPA as required. The company received a corrective order requiring it to establish a compliant RoPA within 60 days.

Polish data subjects are increasingly aware of their rights under the GDPR, and the volume of data subject access requests (DSARs), erasure requests, and objections has grown substantially. UODO receives a significant number of complaints from individuals who allege that their requests were ignored, handled late, or answered inadequately.

The statutory deadline for responding to a DSAR is one month from receipt, extendable by a further two months for complex or numerous requests, provided the data subject is notified of the extension within the first month. UODO has taken enforcement action against organisations that missed the one-month deadline without seeking an extension, and against those that provided incomplete or evasive responses.

Organisations should ensure that their internal processes for receiving and routing DSARs are robust. A common failure point is the absence of a designated person or team responsible for handling requests, meaning that requests received by email, post, or through customer service channels are not identified as DSARs and are not escalated appropriately. Another frequent issue is the failure to verify the identity of the requester before providing data - a step that is required but must not be used as a pretext to delay or obstruct a legitimate request.

Polish law and the GDPR impose heightened obligations on the processing of special category data, defined in Article 9 of the GDPR to include health data, biometric data, data revealing racial or ethnic origin, religious beliefs, trade union membership, and data concerning sexual orientation. UODO has been particularly active in this area, with several enforcement decisions involving unlawful processing of health data by employers and biometric data by access control systems.

On biometric data specifically, UODO has taken the position that the use of fingerprint or facial recognition systems for employee time-and-attendance purposes requires explicit consent under Article 9(2)(a) of the GDPR, and that consent in the employment context must be genuinely voluntary - meaning that employees must not suffer any detriment for refusing. Where an employer makes biometric enrolment a condition of employment or access to the workplace, UODO has found that consent cannot be considered freely given. Organisations using biometric systems should review their legal basis and consider whether alternative, less intrusive methods are available.

Financial institutions operating in Poland face a dual compliance burden: GDPR obligations administered by UODO, and sector-specific requirements under financial services regulation administered by the Polish Financial Supervision Authority (KNF). Recent guidance from both authorities has addressed the use of customer data for marketing purposes, the sharing of data within financial groups, and the obligations of institutions that use third-party data analytics providers.

A particular area of focus is the use of profiling for credit scoring and insurance underwriting. Where profiling produces decisions that significantly affect individuals - such as a refusal of credit or an increase in insurance premiums - the requirements of Article 22 of the GDPR apply. Financial institutions must ensure that individuals are informed of the profiling, that a human review mechanism exists, and that the logic of the automated decision is explained in terms the individual can understand.

Healthcare providers and life sciences companies processing health data in Poland must comply with both the GDPR and the Polish Act on Patient Rights and the Patient Rights Ombudsman, which contains specific provisions on the confidentiality and security of medical records. UODO has coordinated with the Patient Rights Ombudsman on several investigations involving hospitals and clinics that experienced data breaches affecting patient records.

For life sciences companies conducting clinical trials or research involving Polish participants, the legal basis for processing health data is typically Article 9(2)(j) of the GDPR (processing for scientific research purposes), read together with Article 89 and the relevant provisions of Polish research law. Organisations should ensure that their research protocols include a data protection annex that addresses the specific requirements of Polish law, including the obligations of the research ethics committee and the conditions for secondary use of research data.

Foreign companies with Polish subsidiaries or branches often underestimate the independence of their Polish compliance obligations. The Polish entity is a data controller or processor in its own right and cannot simply rely on the parent company';s group-wide compliance framework. The most common risks are: an outdated or incomplete RoPA that does not reflect Polish-specific processing activities; failure to appoint a DPO where one is required under Article 37 of the GDPR; and inadequate data transfer arrangements for flows of personal data from Poland to the parent company';s jurisdiction. UODO has shown a willingness to investigate Polish entities of foreign groups, and the fact that the parent company is compliant in its home jurisdiction does not protect the Polish entity from enforcement action.

A UODO investigation can range from a few months for straightforward cases to well over a year for complex matters involving large organisations or significant volumes of data. The authority may initiate an investigation following a complaint from a data subject, a breach notification, or on its own initiative as part of a thematic inspection programme. Possible outcomes include: a finding of no infringement; an advisory letter recommending improvements; a corrective order requiring specific remedial action within a defined timeframe; a reprimand; or an administrative fine. Fines are calculated by reference to the factors in Article 83 of the GDPR, including the nature and severity of the infringement, the number of data subjects affected, and the degree of cooperation shown by the organisation. Organisations that engage constructively with UODO and implement remedial measures promptly tend to receive more favourable outcomes than those that are unresponsive or obstructive.

Yes, and this is an area where many organisations are behind. Privacy notices must accurately describe the processing activities actually carried out, the legal bases relied upon, the retention periods applied, and the rights available to data subjects. Where processing activities have changed - for example, because new AI tools have been deployed, new third-party processors have been engaged, or data is now transferred to additional countries - the privacy notice must be updated and data subjects must be informed of material changes. On consent mechanisms, UODO has scrutinised cookie consent banners and marketing consent flows closely, and has found that many fail to meet the standard of freely given, specific, informed, and unambiguous consent required by the GDPR. Consent obtained through pre-ticked boxes, bundled consents, or consent walls is unlikely to be valid. Organisations should audit their consent mechanisms and update them where necessary.

Poland';s data protection landscape is becoming more demanding across every dimension: legislative, regulatory, and judicial. Organisations that have not reviewed their compliance frameworks recently face real exposure to UODO enforcement, data subject litigation, and reputational risk. The priorities are clear - update your RoPA, review your DPO arrangements, audit your data transfer mechanisms, and ensure your breach response procedures are fit for purpose.

VLO Law Firms advises international clients on data protection matters in Poland. We can assist with GDPR compliance reviews, RoPA preparation, DPO support, UODO investigation responses, and data transfer arrangements. To request a consultation, contact: info@vlolawfirm.com