Data protection & privacy law in Poland (2026)

Legal framework

EU GDPR (Regulation 2016/679) as directly applicable law, implemented nationally by the Personal Data Protection Act of 10 May 2018 (Ustawa o ochronie danych osobowych); supervised by the President of the Personal Data Protection Office (Prezes UODO).

GDPR & data protection in Poland

In Poland, data protection is governed by the EU General Data Protection Regulation (GDPR), which applies directly and is enforced by the Personal Data Protection Office (UODO).

Framework

the GDPR (Regulation (EU) 2016/679) plus the national data-protection act

Supervisory authority

the Personal Data Protection Office (UODO)

Applies to

any organisation processing the personal data of people in Poland, wherever the organisation is based

Maximum fine

€20 million or 4% of global annual turnover, whichever is higher

Breach notification

within 72 hours of becoming aware, to the supervisory authority

DPO

required for large-scale monitoring or large-scale special-category processing

The GDPR is bloc-wide; Poland supplements it with a national data-protection act and its own supervisory authority.

Key points: data & privacy in Poland

1. 01Comprehensive GDPR-based regime

   Poland is bound by the directly applicable EU GDPR, with national specifics set out in the Personal Data Protection Act of 10 May 2018. The Act fully incorporated the GDPR and addressed areas left to member-state discretion (e.g., the supervisory authority's structure and powers).

   gdprhub.eu uodo.gov.pl

2. 02Supervisory authority (UODO)

   The independent supervisory authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, PUODO), based in Warsaw. The President is appointed by the Sejm with the Senate's consent for a four-year term; the office replaced the former GIODO when the 2018 Act took effect.

   uodo.gov.pl en.wikipedia.org

3. 03Data subject rights

   Individuals in Poland enjoy the full set of GDPR rights: access, rectification, erasure, restriction of processing, data portability, objection, and protection against solely automated decision-making. Rights are exercised directly against the data controller.

   uodo.gov.pl

4. 04Controller obligations / breach notification

   Controllers must notify a personal data breach to UODO within 72 hours of becoming aware of it (unless unlikely to risk individuals' rights), and must communicate high-risk breaches to affected individuals. Standard GDPR duties on lawful basis, transparency, security and DPO appointment apply.

   uodo.gov.pl uodo.gov.pl

5. 05National-discretion specifics

   The 2018 Act sets the child's consent age for information-society services at 16, caps administrative fines on public bodies at PLN 100,000, and requires notification of a Data Protection Officer (DPO) to UODO within 14 days of designation.

   dlapiperdataprotection.com gdprhub.eu

6. 06Active enforcement

   UODO issues about 2,000 administrative decisions annually and has imposed major fines, including a record PLN 27 million on Poczta Polska (March 2025, presidential-election data) and PLN 18.4 million on ING Bank Śląski (2025), demonstrating a maturing, robust enforcement posture.

   edpb.europa.eu notesfrompoland.com

GDPR in Poland: FAQ

Timeline of decisions

1. 1 Oct 2025Decision
   Supreme Administrative Court Rules IP Addresses and Cookie IDs Are Not Automatically Personal Data

   Poland's Naczelny Sąd Administracyjny held that UODO must affirmatively demonstrate that an individual is identifiable, within the meaning of Article 4(1) GDPR, before classifying IP addresses or cookie identifiers as personal data. The ruling imposes a higher evidentiary burden on the regulator and constrains blanket cookie-consent enforcement.

   International Network of Privacy Law Professionals (INPLP)

2. 27 Aug 2025Enforcement · official
   ING Bank Śląski Fined €4.375 Million for Systematically Scanning Customer Identity Documents

   UODO penalised ING Bank Śląski PLN 18.4 million (~€4.375 million) for scanning the identity cards of approximately 4.7 million customers and prospective customers without verifying whether each scan was legally required under the AML Act, violating Articles 5(1)(a,b,c) and 6(1) GDPR. The case exposed widespread over-collection of biographic data in Polish retail banking.

   European Data Protection Board

3. 18 Mar 2025Enforcement · official
   Record Fine: Poczta Polska Penalised PLN 27 Million for 2020 Postal-Election PESEL Data Transfer

   UODO imposed its largest-ever fine, PLN 27,124,816 (~€6.44 million) on state postal operator Poczta Polska and PLN 100,000 on the Minister of Digitization, for unlawfully receiving and processing PESEL register data covering ~30 million adult citizens to organise a COVID-era postal presidential election without a valid legal basis under Articles 5(1)(a) and 6(1) GDPR. The case set a precedent that executive-directed emergency data transfers are not exempt from GDPR.

   European Data Protection Board

4. 1 Sept 2024Enforcement
   mBank Fined for Failure to Notify Data Subjects of Personal Data Breach

   UODO issued a significant fine against mBank S.A. for breaching Article 34 GDPR by failing to communicate a personal data breach directly to affected individuals, continuing the authority's intensified focus on breach-notification obligations as a standalone compliance requirement distinct from the 72-hour regulator notification rule.

   CMS Expert Guide — Data Protection and Cybersecurity: Poland

5. 1 Apr 2024Enforcement
   Santander Bank Polska Fined PLN 1.44 Million for Data Breach Notification Failure

   UODO penalised Santander Bank Polska S.A. (~€344,498) for not reporting a breach in which a parcel containing bank documents, including PESEL numbers, credentials, and ID data, was lost, in violation of the 72-hour notification requirement under Article 33 GDPR. The case reinforced that physical document losses trigger the same notification obligations as digital breaches.

   ICLG — Data Protection Laws & Regulations: Poland 2025-26

6. 1 Jan 2023Enforcement · official
   UODO Fines P4 (Play) Telecom Operator for Failure to Notify Personal Data Breach

   UODO imposed an administrative fine on P4 Sp. z o.o. (mobile network Play) for failing to notify the supervisory authority of a personal data breach within 72 hours as required by Article 33 GDPR, signalling that the authority would treat notification-deadline breaches as a standalone, fining-worthy violation.

   European Data Protection Board

7. 26 Mar 2019Enforcement · official
   Poland's First GDPR Fine: Bisnode Penalised ~€220,000 for Failure to Inform Data Subjects

   UODO issued Poland's inaugural GDPR enforcement decision against Bisnode, a data-analytics firm that scraped 7.6 million business records from public registries but notified only ~700,000 individuals, citing the cost of postal outreach as disproportionate; the authority rejected that argument and ordered contact with the remaining ~6 million people. The ruling established that financial inconvenience does not excuse Article 14 transparency obligations.

   European Data Protection Board

8. 21 Feb 2019Law · official
   Sectorial Amendments Act Completes Poland's GDPR Incorporation

   Parliament enacted the Act of 21 February 2019 amending over 160 sector-specific statutes, covering health, employment, scientific research, and financial services, to align them with GDPR and exercise Member State discretions. Together with the 2018 PDPA, it closed the formal transposition of the GDPR into Polish law.

   Internetowy System Aktów Prawnych (ISAP) — Polish Official Legislative Journal

9. 25 May 2018Law · official
   Personal Data Protection Act Enters Into Force, GDPR Implementation

   Poland's Act of 10 May 2018 on the Protection of Personal Data entered into force, implementing the EU GDPR and replacing the 1997 data-protection framework. It established the President of the Personal Data Protection Office (UODO) as the new independent supervisory authority, replacing GIODO. The Act set binding rules for online personal-data collection, processing, and enforcement relevant to all internet services operating in Poland.

   UODO — Personal Data Protection Office

10. 1 Jan 2016Law
    Surveillance Act Creates Direct Law-Enforcement Data Channel

    Poland enacted a surveillance law establishing a direct fast lane for law enforcement and intelligence agencies to obtain data from telecommunications and internet service providers without prior judicial authorisation. Critics and civil liberties organisations warned the law lacked proportionality safeguards and enabled bulk interception of online communications.

    Tech Against Terrorism

11. 29 Aug 1997Law · official
    Poland's Foundational Personal Data Protection Act Enacted, GIODO Created

    Poland enacted its first comprehensive data-protection statute to transpose EU Directive 95/46/EC, establishing the Inspector General for Personal Data Protection (GIODO) as supervisory authority and setting foundational rules on lawful processing, data subjects' rights, and cross-border transfers. The Act governed Polish data protection for over two decades until superseded by the PDPA 2018.

    EU Agency for Fundamental Rights (FRA)

Sources

1. 1.uodo.gov.pl/en
2. 2.uodo.gov.pl/en/485
3. 3.uodo.gov.pl/en/694
4. 4.uodo.gov.pl/en/p/for-controllers
5. 5.gdprhub.eu/Data_Protection_in_Poland
6. 6.dlapiperdataprotection.com/index.html?t=law&c=PL
7. 7.en.wikipedia.org/wiki/Polish_Data_Protection_Commissioner
8. 8.edpb.europa.eu/news/national-news/2021/polish-dpa-first-fine-non-compliance-administ
9. 9.notesfrompoland.com/2025/08/27/poland-fines-ing-bank-slaski-18-4m-zloty-over-data-privacy