🇵🇱Act of 10 May 2018 on the Protection of Personal Data

← Back to laws in Poland

Act of 10 May 2018 on the Protection of Personal Data

Poland applies this national law alongside the GDPR. The summary below concentrates on the national overlay so that the GDPR baseline is not duplicated.

How the national law fits with GDPR

The Act establishes the Polish supervisory and procedural framework, implements GDPR derogations and regulates certification, codes, inspections, civil claims, fines and offences.

National additions and variations

• Article 2 creates defined GDPR exemptions for press, literary, artistic and academic expression.
• Articles 3-5a create public-task restrictions on transparency and access, subject to statutory purposes, necessity and safeguards; controllers must document the exact condition relied upon.
• Articles 8-11 require DPO designation under GDPR rules and notification and publication of DPO details; the 2026 unified text adds a temporary substitute-notification mechanism in Article 11a.
• Proceedings before UODO are single-instance administrative proceedings with administrative-court review, and the President may impose an interim processing restriction to prevent serious, difficult-to-remedy effects.
• The Act provides inspection powers, coordinated civil proceedings, public-sector fine caps, administrative penalties and criminal offences for unlawful processing and obstruction of an inspection.

Operational approach

First maintain the GDPR control set. Then document whether this country is in scope and apply the national controls to the affected people, systems and processing. Keep article-level evidence for child consent, employment, special-category or criminal data, research, electronic communications, identifiers, surveillance and any rights restriction relied upon.