Poland Personal Data Protection Act — Act of 10 May 2018

Why does it matter?

The GDPR leaves the supervisory authority, procedure, certification, public-sector fines and criminal sanctions to each member state, and this Act is where Poland decided them. A controller or processor in Poland answers to the Prezes UODO, notifies its IOD under Art. 10, is inspected under Chapter 9 and can face a criminal charge under Art. 107 for processing data it may not process. Public finance units, research institutes and the National Bank of Poland get a separate fine regime (Arts. 101 and 102).

Key benefits include:

• One named authority

The Prezes Urzędu Ochrony Danych Osobowych is the competent authority and the supervisory authority for the GDPR, Directive 2016/680 and the Europol Regulation (Art. 34), appointed by the Sejm with the Senate's consent and subject only to the Act (Art. 34.3 and 34.5).

• A defined IOD notice

Controllers and processors that must appoint an IOD under GDPR Art. 37 notify the Prezes Urzędu within 14 days, electronically with a qualified signature or trusted profile, and publish the IOD's details (Arts. 8, 10 and 11).

• Proceedings in one instance

Proceedings before the Prezes Urzędu are single-instance (Art. 7.2); the route against a decision is a complaint to the administrative court, which suspends the fine (Art. 74).

• Bounded inspections

A control runs for no more than 30 days from presentation of the authorization (Art. 89), with entry between 6:00 and 22:00, access to documents and systems and the right to take explanations (Art. 84).

• Known public-sector exposure

Fines on public finance units, research institutes and the National Bank of Poland are capped at PLN 100,000, and at PLN 10,000 for the units named in Art. 9 point 13 of the Public Finance Act (Art. 102).

How does it work?

Chapter 1 trims the GDPR where Polish law allows. Press, literary and artistic activity is exempt from most of the GDPR's information, rights and record-keeping articles, and academic expression from a shorter list (Art. 2). A controller performing a public task may withhold GDPR Arts. 13.3, 14 and 15 information where that is necessary for the task or protects classified information, but must tell the person the basis within a month of a request (Arts. 3 to 5a). National security processing by named public finance units and the special services sits outside the Act and the GDPR (Art. 6).

Chapters 2 to 5 cover people and schemes. The IOD duty follows GDPR Art. 37; Art. 9 names the public bodies that must appoint one (public finance sector units, research institutes and the National Bank of Poland), Art. 10 sets the 14-day electronic notice with name, e-mail or telephone and REGON, Art. 11 requires publication and Art. 11a allows a notified substitute. The Polskie Centrum Akredytacji accredits certifying bodies (Art. 12); certification under GDPR Art. 42 is done by the Prezes Urzędu or an accredited body within three months of a complete application and is confirmed by a certificate (Arts. 15 to 21). Codes of conduct are approved by the Prezes Urzędu and monitored by accredited bodies (Arts. 27 to 33).

Chapters 6 to 11 are enforcement. The Prezes Urzędu conducts infringement proceedings (Art. 60), may order a temporary restriction of processing (Art. 70) and must state the GDPR Art. 83.2 grounds for any fine (Art. 72). Controls follow a plan or information received (Art. 78) and end with a protocol. Civil claims under GDPR Arts. 79 and 82 go to the regional court, which informs the Prezes Urzędu (Arts. 92 to 94). Fines on private entities follow GDPR Art. 83 (Art. 101); half of fines for security breaches of GDPR Arts. 5.1(f), 25, 28.3(c) and 32 fund the Cybersecurity Fund (Art. 104); payment is due within 14 days of the appeal deadline (Art. 105).

Key Elements

• Scope and exemptions (Arts. 1 to 7)

Application within GDPR Arts. 2 and 3 (Art. 1); press, literary, artistic and academic carve-outs (Art. 2); public-task controllers' limited information duties (Arts. 3 to 5a); national security and special services excluded (Art. 6); the President of the Republic (Art. 6a); the Code of Administrative Procedure applies and proceedings are single-instance (Art. 7).

• Inspektor ochrony danych (Arts. 8 to 11a)

Appointment under GDPR Art. 37 (Art. 8); the public bodies covered (Art. 9); 14-day electronic notice of appointment, changes and dismissal to the Prezes Urzędu (Art. 10); publication of the IOD's details (Art. 11); a notified substitute during absence (Art. 11a).

• Accreditation and certification (Arts. 12 to 26)

Polskie Centrum Akredytacji accredits certifying bodies under GDPR Art. 43 and informs the Prezes Urzędu (Arts. 12 to 14); certification by the Prezes Urzędu or a certifying body, application contents, three-month handling, certificate, withdrawal and fees (Arts. 15 to 26).

• Codes of conduct (Arts. 27 to 33)

Drafting, consultation and approval by the Prezes Urzędu (Art. 27); monitoring by accredited bodies with a public list (Arts. 28 to 33).

• Prezes Urzędu (Arts. 34 to 59)

Competence for the GDPR, Directive 2016/680, the Europol Regulation and the Data Governance Act (Art. 34.1 to 34.2a); appointment by the Sejm with Senate consent, four-year term, at most two terms, removal only on listed grounds (Art. 34.3 to 34.10); oath (Art. 35); up to three deputies (Art. 36); the Urząd Ochrony Danych Osobowych as its office (Art. 45).

• Proceedings and cooperation (Arts. 60 to 77)

Infringement proceedings before the Prezes Urzędu (Art. 60); social organizations acting for data subjects (Art. 61); protected business secrets (Art. 65); interim restriction of processing (Art. 70); reasoning of fines (Art. 72); publication of decisions (Art. 73); suspension of fines on appeal (Art. 74); European cooperation (Arts. 75 to 77).

• Control (Arts. 78 to 91)

Planned or ad hoc controls (Art. 78); authorized inspectors, including those of other EU authorities (Art. 79); inspector powers (Art. 84); Police assistance; a 30-day limit (Art. 89); the control protocol and objections.

• Liability, fines and offenses (Arts. 92 to 108)

Civil claims before the regional court (Arts. 92 to 100); GDPR Art. 83 fines for private entities (Art. 101); PLN 100,000 and PLN 10,000 caps for public entities (Art. 102); euro conversion on January 28 each year (Art. 103); the Cybersecurity Fund share (Art. 104); payment, deferral and installments (Art. 105); offenses of unlawful processing, up to two years, or three for special categories (Art. 107), and obstructing a control (Art. 108).

What does it cover?

The Act applies to the protection of natural persons in connection with the processing of personal data within the scope defined by Arts. 2 and 3 of the GDPR (Art. 1.1), so it follows the GDPR to every controller and processor established in Poland and to those targeting people in Poland from outside. Within that, it withdraws parts of the GDPR for press, literary, artistic and academic activity (Art. 2), lets public-task controllers limit information duties (Arts. 3 to 5a) and excludes national security processing by named public bodies and the activity of the special services (Art. 6). Footnote 2 of the Act records that it also partly implements Directive 2016/680 on processing by criminal justice authorities.

What are its objectives?

Art. 1.2 lists what the Act determines; in practical terms it sets out to:

Name the public bodies obliged to appoint an inspektor ochrony danych and the procedure for notifying the appointment (Art. 1.2 point 1; Arts. 8 to 11a).

Set the conditions for accrediting certifying bodies and code-monitoring bodies and for certification itself (Art. 1.2 points 2 and 3; Arts. 12 to 33).

Establish the competent authority for personal data protection and its independence (Art. 1.2 point 4; Arts. 34 to 59).

Define proceedings for infringements, European administrative cooperation and the control of compliance (Art. 1.2 points 5 to 7; Arts. 60 to 91).

Provide civil liability and court procedure for breaches of data protection law (Art. 1.2 point 8; Arts. 92 to 100).

Provide criminal liability and administrative fines for breaches (Art. 1.2 point 9; Arts. 101 to 108).

Framework in Context

The Act is one of three Polish instruments that carry the EU data protection package: the GDPR applies directly; this Act supplies the authority and procedure; and the Act of 14 December 2018 on processing in connection with preventing and combating crime (Dz.U. 2019 poz. 125) implemented Directive 2016/680, ending the remaining provisions of the 1997 Act on February 6, 2019 (Art. 175, footnote 10). The Act of 21 February 2019 (Dz.U. 2019 poz. 730) then adjusted sectoral laws to the GDPR, and the Prezes Urzędu later became the competent authority for data intermediation services and data altruism under Regulation 2022/868 (Art. 34.2a). None of this changes the controller's primary obligations, which remain those of the GDPR.

Common Framework Mappings

Organizations map the Act, together with the GDPR it serves, to the privacy and information security frameworks below so that one set of records, one IOD function and one breach procedure can serve Polish and international obligations.

Mapped frameworks include:

APEC PF

Convention 108+

ePrivacy Directive (2002/58/EC)

GDPR

ISO 27001:2022

ISO 27701

NIST Privacy Framework v1.0

OECD Privacy Guidelines