Meet the Polish Data Protection Act and GDPR with one control set

The Polish Data Protection Act is the Act of 10 May 2018 on the Protection of Personal Data, Poland's national law supplementing the GDPR. It applies alongside the GDPR and sets Polish rules on data protection officers, the UODO supervisory authority, certification, codes of conduct, inspections, civil claims, administrative fines and criminal offences. It came into force on 25 May 2018 and replaced the 1997 Personal Data Protection Act.

Controllers and processors whose processing of personal data falls within the scope of the GDPR in Poland must comply with it. Public sector entities, research institutes and the National Bank of Poland have extra obligations, including a duty to designate a data protection officer. Some activities, such as journalism, literary and artistic expression and academic expression, benefit from partial exemptions from GDPR provisions under Article 2.

The Polish Act does not replace the GDPR, it supplements it. The GDPR sets the core rules on lawful processing, data subject rights and security, while the Polish Act fills in areas the GDPR leaves to member states, such as which public bodies need a DPO, how UODO conducts proceedings and inspections, fine limits for public bodies and criminal penalties. Organisations need to comply with both.

UODO can impose administrative fines on the terms of GDPR Article 83, which reach up to EUR 20 million or 4% of worldwide annual turnover for the most serious breaches. Most public sector bodies face a lower cap of PLN 100,000. The Act also creates criminal offences: unlawful processing of personal data is punishable by a fine, restriction of liberty or up to 2 years' imprisonment, rising to 3 years for special category data.

Yes. Under Article 10, any organisation that designates a data protection officer must notify the President of UODO within 14 days, giving the officer's name and an email address or phone number. Changes to those details, and the dismissal of the officer, must also be notified within 14 days. The officer's contact details must be published on the organisation's website, or made available at its place of business.

Yes, indirectly. The Act amended the Polish Labour Code to add rules on workplace video monitoring and email monitoring by employers. These set the permitted purposes, require employees to be informed in advance and limit how long recordings can be kept. Employers in Poland should review these Labour Code provisions alongside the GDPR when they monitor staff.

There is no separate certificate for the Act itself. The Act sets out how GDPR Article 42 certification works in Poland, with certification carried out by the President of UODO or by certification bodies accredited by the Polish Centre for Accreditation. Many organisations instead show compliance through documented controls, records of processing, policies and evidence, often supported by ISO 27001 or ISO 27701 for the security side.

The Polish Data Protection Act is mapped in OneClickComply's control library and is available on request. Because it builds on the GDPR, controls and evidence you collect for GDPR can be reused towards the Polish national requirements. OneClickComply automates evidence collection, generates policies, monitors controls continuously and gives you access to our in-house audit team through Ask an Auditor.