--- title: "Poland Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/poland/ source_html: /jurisdictions/poland/index.html description: "Poland data protection and privacy regulation: 10 categories, 65 claims, updated 2026-11-04. Lawful processing, data subject rights, cross-border transfer…" generated_at: 2026-11-07T14:58:19Z content_sha256: ba587c03b7da0baad2bc3bb34775a1f4a564147e9d1e60220722c8aa255361de generator: "fe-fleet/md-twin@1.0" --- # Poland Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) overlaps: artificial-intelligence Last updated 2026-11-04 · 10 categories · 65 claims · 37 sources in the cumulative register Download report (PDF) Expand all Poland's most material data-protection development this cycle is an unresolved institutional competence dispute over who supervises artificial-intelligence systems that process personal data. Data collected 2026-11-01 · Data published 2026-11-04 AI-assembled from cited sources Not fully checked this cycle: Enforcement & Redress (2 open gaps). Evidence re-verified: 2026-11-04 · Position last changed: 2026-11-04 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=POLAND)[Build Report](/reports/?j=POLAND)[Compare](/compare/?j=POLAND) Framework posture Regulated (omnibus) 10 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority UODO (Prezes Urzędu Ochrony Danych Osobowych) Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 10 / 10 modules assessed 0 Confirmed · 9 Probable · 1 Uncertain 10 Categories 0 Red categories 57 Sub-modules 65 Claims 10 Tier-1 sources Traffic-light mix 5 green 5 amber (sums to 10 rendered categories; click to filter) No categories are currently flagged red. Law made at European Economic Area (Bloc) level that applies in Poland is covered once, on the [European Economic Area (Bloc)](/jurisdictions/european-economic-area-bloc/) page. This page covers Poland’s own layer: implementation, national authorities, national options and local enforcement. ## Jurisdiction brief Jurisdiction lead brief 899 Full executive summary 164 ###### Latest update · 4 November 2026 #### Lead Signal Poland's data protection authority is understood to have pressed ahead with enforcement built on its own information-and-access powers rather than on the substance of the underlying data-processing conduct it was investigating. A decision dated 18 May 2026 against an association referred to as RKW, reported as moving into enforcement on 26 October 2026, imposed a fine of PLN 10,082 for failing to respond to the authority's requests for information in connection with an election-related application. The fine rests on the cooperation and access duties set out in Article 58(1)(a) and (e) of the General Data Protection Regulation, not on any finding about how the application itself handled personal data. #### Other Developments A second, similarly structured matter is understood to be in progress against a Kraków-based entrepreneur, where a decision reported on 30 September 2026 in case DKE.561.7.2026 imposed a fine of PLN 31,507 for failing to provide information requested during an investigation into two websites. That decision is reported as not yet final. In both matters, the underlying question that prompted the regulator's inquiry, namely the data-processing conduct of the election-related application and of the two websites, has not been shown to have reached resolution; the enforcement activity visible so far concerns only the entities' cooperation with the regulator's own information-gathering powers. #### Cross-Monitor Connections No overlap with adjacent monitors has been identified in the material reviewed. #### Outlook Whether the RKW decision has become final or is under appeal, and whether the Kraków entrepreneur's fine will be confirmed once any appeal period runs, are both open questions as at this writing. Attention going forward should rest on whether either matter progresses from a cooperation-based penalty to a substantive finding on the data-processing conduct that prompted the original inquiries, since that would mark a materially different and more consequential stage of enforcement. 4 earlier updates not shown here. ###### Standing brief · as of 23 August 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal Poland's most material data-protection development this cycle is an unresolved institutional competence dispute over who supervises artificial-intelligence systems that process personal data. The Draft Act on Artificial Intelligence Systems, adopted by the Council of Ministers on 31 March 2026 and submitted to Parliament, would establish a new body, KRiBSI, as Poland's primary national AI supervisory authority, with UODO — the existing data-protection authority — retaining only a coordination role on data-protection matters. UODO has publicly criticised this allocation, arguing that relegating it to an advisory role without voting rights is inadequate given that AI Act enforcement involving personal data requires meaningful participation in decision-making. At the same time, the draft law does recognise UODO's exclusive supervisory competence over high-risk AI systems, but the draft is described as lacking detailed cooperation rules and explicit protection of fundamental rights. This is assessed with High confidence, corroborated by a Tier-3 source describing the objection and a Tier-2 DataGuidance source describing the competence allocation independently. The competence dispute is significant beyond its immediate institutional stakes: it will determine whether AI-related personal-data supervision in Poland proceeds through a body with established GDPR enforcement experience and precedent, or through a newly-created authority without that institutional history, at a moment when UODO itself is demonstrating an increasingly high-volume enforcement posture in its existing remit. #### Other Developments UODO's enforcement profile remains high-volume and material, but now shows a judicial-constraint signal. UODO imposed over PLN 64 million in fines in 2025, including the three largest penalties in Polish data-protection enforcement history, and issued a March 2026 enforcement decision against a large courier company totalling more than PLN 11 million in administrative fines for GDPR-related failures. The scale of this activity establishes UODO as an increasingly assertive regulator by regional standards, a posture that makes the question of its role in AI-related personal-data supervision more consequential than it might be for a less active authority. Separately, the Provincial Administrative Court in Warsaw overturned UODO's PLN 27 million fine against Poczta Polska, an early signal that UODO's fining methodology may face increased judicial scrutiny going forward. Each of these findings is High confidence, sourced respectively to Tier-2 and Tier-3 material. #### Cross-Monitor Connections The KRiBSI/UODO competence dispute over AI-related personal-data supervision is directly relevant to any monitor tracking Poland's emerging AI-regulation framework, given that the same draft legislation determines both AI supervisory architecture and the scope of UODO's residual data-protection role within it. More broadly, the pattern of a national data-protection authority contesting its own role in an adjacent AI-governance framework is a structural development relevant to any cross-jurisdictional comparison of how EU Member States are allocating AI-supervision competence relative to existing GDPR supervisory authorities, though this cycle's evidence supports only the Poland-specific instance described above. No financial-integrity, world-payments, advennt, or crypto-specific overlap is asserted this cycle. #### Outlook How the KRiBSI/UODO competence split is finally allocated for AI systems processing personal data, and on what timeline the AI Systems Act completes its parliamentary passage, remains unresolved and is the single most consequential open question for Poland's data-protection trajectory. Separately, whether the Poczta Polska fine reversal materially affects UODO's future fining methodology or appeal-resistance drafting is also unresolved. A primary legislative text for the Draft Act on Artificial Intelligence Systems, and any parliamentary amendment addressing UODO's cooperation-rights concerns, would materially sharpen next cycle's assessment of how this competence dispute is likely to resolve. Read full brief · 899 words Standing brief, as of 23 August 2026. #### Regulatory Status Poland's data-protection landscape this cycle is defined by an unresolved institutional competence dispute: the Draft Act on Artificial Intelligence Systems, adopted by the Council of Ministers on 31 March 2026, would create KRiBSI as the primary national AI supervisory authority, with UODO retaining only a coordination role and no voting rights, an allocation UODO has publicly criticised despite the draft recognising UODO's exclusive competence over high-risk AI systems. Separately, UODO's enforcement activity remains high-volume: over PLN 64 million in fines in 2025 and a further PLN 11 million courier-firm fine in March 2026, though a Provincial Administrative Court decision overturning a PLN 27 million UODO fine against Poczta Polska signals emerging judicial constraint on UODO's fining methodology. #### Outlook The AI Systems Act's parliamentary passage, and whether it addresses UODO's cooperation and voting-rights concerns, is the principal development to watch. The Poczta Polska reversal's effect on UODO's future fining approach is a second thread to monitor. Read full brief · 164 words Key regulatory facts for Poland Regulatory Dimension Poland Standing Position Jurisdiction Poland (PL) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 65 sourced findings) Regulator & Framework Mature, non-derogating GDPR implementation with an active, well-resourced single supervisory authority and 8 years of enforcement practice. Lawful Processing & Special Data GDPR-aligned lawful basis and consent framework with active enforcement precedent; anonymisation/pseudonymisation guidance is comparatively thin. Data Subject Rights Full GDPR rights framework in force with confirmed enforcement precedent on erasure/objection; deadlines follow the standard one-month GDPR response window. Controller/Processor Duties Deep, multi-year enforcement record across DPIA/accountability, DPO, ROPA, security, breach-notification and retention obligations confirms these duties are actively supervised and litigated up to appellate courts. Primary Instruments Cited DataGuidance, EUR-Lex, IAPP, Poland Insight, RecordingLaw Last Confirmed / Updated 2026-11-04 (37 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Poland: D1 Regulator & Framework5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Mature, non-derogating GDPR implementation with an active, well-resourced single supervisory authority and 8 years of enforcement practice. Primary framework Act of 10 May 2018 on the Protection of Personal Data, implementing Regulation (EU) 2016/679 (GDPR) Supervisory authority [UODO (Prezes Urzędu Ochrony Danych Osobowych)](https://uodo.gov.pl/) Traffic-light rationale — Green Mature, non-derogating GDPR implementation with an active, well-resourced single supervisory authority and 8 years of enforcement practice. #### Sub-modules (5) #### Regulator And AuthorityGreen UODO's President is the GDPR supervisory authority; other bodies (UOKiK, Office of Electronic Communications) can take related but distinct enforcement action. Claims (4): - UODO's President is the competent GDPR supervisory authority in Poland, with powers to conduct compliance audits, issue administrative decisions and publish guidance. - The UODO President holds the rank of a government minister, is appointed by the Sejm with the Senate's consent for a four-year renewable term, and acts independently of government instruction on substantive data-protection decisions. - UODO President holds minister-equivalent rank under the Act of 10 May 2018, appointed by the Sejm with Senate consent for a four-year renewable term, and cannot receive government instructions on substantive data-protection decisions. - UODO's October 2026 decisions were issued by Prezes Mirosław Wróblewski, confirming continuity of the authority's statutory enforcement powers. #### Act And InstrumentsGreen Primary instrument is the Act of 10 May 2018, applying GDPR without major derogation. Claims (1): - The Act of 10 May 2018 on the Protection of Personal Data implements the GDPR in Poland and does not contain major derogations from the Regulation. #### Material ScopeGreen Material scope follows GDPR Art 2 - automated processing and structured manual filing systems of personal data. Claims (1): - As a non-derogating GDPR implementation, Poland's material scope of protected processing mirrors GDPR Article 2 (automated processing and structured filing systems). #### Territorial ScopeGreen Territorial scope follows GDPR Art 3 - applies to non-established controllers targeting or monitoring data subjects in Poland/EU. Claims (1): - Poland's territorial scope of application to non-established controllers mirrors GDPR Article 3, extending to entities targeting or monitoring data subjects in Poland. #### Regulator Registration And FilingGreen No general controller registration regime; however DPO appointments must be notified to UODO within 14 days of appointment. Claims (2): - Controllers and processors must notify the appointment of a DPO to PUODO within 14 days of the appointment. - UODO is the competent authority for data-intermediation services and data altruism organisations under the EU Data Governance Act, per Art 34 ust. 2a, added by the Act of 27 March 2026 on data management. #### Key findings (1) - Draft AI Systems Act would create KRiBSI as primary AI supervisory authority, with UODO retaining only a coordination role. — source on file Poland's data protection regime is a GDPR-implementation jurisdiction. The Act of 10 May 2018 on the Protection of Personal Data establishes the Prezes Urzędu Ochrony Danych Osobowych (President of the Personal Data Protection Office, UODO/PUODO) as the sole supervisory authority for GDPR matters, with audit, decision-making and guidance-issuing functions. The Act is described as containing no major derogations from the GDPR, meaning material and territorial scope track the GDPR baseline (Articles 2 and 3) directly. No new data since the standing brief. 1 periodic run re-emitted it unchanged. Sources and claims (9) - [DataGuidance](https://www.dataguidance.com/jurisdiction/poland) — UODO's President is the competent GDPR supervisory authority in Poland, with powers to conduct compliance audits, issue administrative decisions and publish guidance. - [DataGuidance](https://www.dataguidance.com/jurisdiction/poland) — The Act of 10 May 2018 on the Protection of Personal Data implements the GDPR in Poland and does not contain major derogations from the Regulation. - [EUR-Lex](https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng) — As a non-derogating GDPR implementation, Poland's material scope of protected processing mirrors GDPR Article 2 (automated processing and structured filing systems). - [EUR-Lex](https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng) — Poland's territorial scope of application to non-established controllers mirrors GDPR Article 3, extending to entities targeting or monitoring data subjects in Poland. - [IAPP](https://iapp.org/news/a/poland-notification-of-a-dpo-to-the-supervisory-authority) — Controllers and processors must notify the appointment of a DPO to PUODO within 14 days of the appointment. - [Poland Insight](https://polandinsight.com/polish-uodo-fine-rkw-noncooperation-2026/) — The UODO President holds the rank of a government minister, is appointed by the Sejm with the Senate's consent for a four-year renewable term, and acts independently of government instruction on substantive data-protection decisions. - [RecordingLaw](https://www.recordinglaw.com/world-laws/world-data-privacy-laws/poland-data-privacy-laws/) — UODO President holds minister-equivalent rank under the Act of 10 May 2018, appointed by the Sejm with Senate consent for a four-year renewable term, and cannot receive government instructions on substantive data-protection decisions. - [EdLaw Eduverse](https://edlaw.eduverse.com/docs/jurisdiction/nat/pl/uodo/README.md) — UODO is the competent authority for data-intermediation services and data altruism organisations under the EU Data Governance Act, per Art 34 ust. 2a, added by the Act of 27 March 2026 on data management. - [UODO](https://uodo.gov.pl/pl/138/4594) — UODO's October 2026 decisions were issued by Prezes Mirosław Wróblewski, confirming continuity of the authority's statutory enforcement powers. ### Poland: D2 Lawful Processing & Special Data4 sub-modulesGreenEnacted in forceModule confidence: Probable▾ GDPR-aligned lawful basis and consent framework with active enforcement precedent; anonymisation/pseudonymisation guidance is comparatively thin. Primary framework GDPR Articles 6, 7, 9; Act of 10 May 2018 Supervisory authority [UODO (Prezes Urzędu Ochrony Danych Osobowych)](https://uodo.gov.pl/) Traffic-light rationale — Green GDPR-aligned lawful basis and consent framework with active enforcement precedent; anonymisation/pseudonymisation guidance is comparatively thin. D2 · Lawful Processing — Full Module Record 4 sub-modules · 58 words · 4 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Poland: D3 Data Subject Rights5 sub-modulesGreenEnacted in forceModule confidence: Uncertain▾ Full GDPR rights framework in force with confirmed enforcement precedent on erasure/objection; deadlines follow the standard one-month GDPR response window. Primary framework GDPR Articles 12-22; Act of 10 May 2018 Supervisory authority [UODO (Prezes Urzędu Ochrony Danych Osobowych)](https://uodo.gov.pl/) Traffic-light rationale — Green Full GDPR rights framework in force with confirmed enforcement precedent on erasure/objection; deadlines follow the standard one-month GDPR response window. #### Sub-modules (5) #### Access RightGreen Article 15 access right applies without national modification. #### Rectification And ErasureGreen UODO has enforced erasure/'right to be forgotten' obligations where controllers processed data of objectors without legal basis. Claims (1): - UODO found that a company unlawfully continued processing personal data of individuals who were not its customers and who had objected to processing, in violation of the right to erasure/'right to be forgotten'. #### Restriction And ObjectionGreen UODO enforcement confirms the right to object must be operationalised effectively by controllers. Claims (1): - UODO found that a company unlawfully continued processing personal data of individuals who were not its customers and who had objected to processing, in violation of the right to erasure/'right to be forgotten'. #### Data PortabilityAmber Article 20 portability right applies without national modification; no PL-specific derogation or guidance beyond GDPR baseline identified. #### Deadlines And Response WindowsGreen The standard GDPR one-month (extendable to three-month) response window applies to controller responses to data subject requests. Poland applies the GDPR Chapter III data subject rights (access, rectification, erasure, restriction, objection, portability) without national derogation. UODO enforcement precedent (ClickQuickNow) confirms active enforcement of the right to object/erasure ('right to be forgotten') where a controller continued processing after an objection was received without a legal basis. Sources and claims (1) - [EDPB](https://www.edpb.europa.eu/news/national-news/2019/polish-dpa-withdrawal-consent-shall-not-be-impeded_en) — UODO found that a company unlawfully continued processing personal data of individuals who were not its customers and who had objected to processing, in violation of the right to erasure/'right to be forgotten'. ### Poland: D4 Controller/Processor Duties7 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Deep, multi-year enforcement record across DPIA/accountability, DPO, ROPA, security, breach-notification and retention obligations confirms these duties are actively supervised and litigated up to appellate courts. Primary framework GDPR Articles 5, 24-39; Act of 10 May 2018 Supervisory authority [UODO (Prezes Urzędu Ochrony Danych Osobowych)](https://uodo.gov.pl/) Traffic-light rationale — Green Deep, multi-year enforcement record across DPIA/accountability, DPO, ROPA, security, breach-notification and retention obligations confirms these duties are actively supervised and litigated up to appellate courts. D4 · Controller & Processor — Full Module Record 7 sub-modules · 77 words · 9 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Poland: D5 Cross-Border & Adequacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Core transfer mechanisms are harmonised and green at EU level, but Poland-specific friction exists around telecom data-retention law that UODO itself has flagged as inconsistent with EU standards, and this evidence set could not source distinct Polish-issued adequacy decisions (correctly, as this is an EU Commission competence). Primary framework GDPR Chapter V (Articles 44-49); EU Commission adequacy decisions Supervisory authority [UODO (Prezes Urzędu Ochrony Danych Osobowych)](https://uodo.gov.pl/) Traffic-light rationale — Amber Core transfer mechanisms are harmonised and green at EU level, but Poland-specific friction exists around telecom data-retention law that UODO itself has flagged as inconsistent with EU standards, and this evidence set could not source distinct Polish-issued adequacy decisions (correctly, as this is an EU Commission competence). D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 87 words · 2 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Poland: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Health, employment, education and credit-scoring/data-broker sub-sectors show active supervisory engagement; financial-sector-specific and insurance-specific DP overlays were not surfaced in this research pass. Primary framework GDPR (general); sector legislation (Education Law, Cybersecurity Act/NIS2 implementation, Telecommunications Law) applied alongside UODO oversight Supervisory authority [UODO (Prezes Urzędu Ochrony Danych Osobowych)](https://uodo.gov.pl/) Traffic-light rationale — Amber Health, employment, education and credit-scoring/data-broker sub-sectors show active supervisory engagement; financial-sector-specific and insurance-specific DP overlays were not surfaced in this research pass. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 71 words · 4 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Poland: D7 AdTech & Commercial Privacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Cookie/consent and direct-marketing enforcement are well evidenced; dark-pattern enforcement is emerging via UOKiK; opt-out signal, clean-room and cross-context advertising sub-modules lack Poland-specific evidence. Primary framework ePrivacy Directive 2002/58/EC (as transposed into Polish Telecommunications Law); GDPR Article 6/7 for marketing consent Supervisory authority [UODO (Prezes Urzędu Ochrony Danych Osobowych)](https://uodo.gov.pl/) Traffic-light rationale — Amber Cookie/consent and direct-marketing enforcement are well evidenced; dark-pattern enforcement is emerging via UOKiK; opt-out signal, clean-room and cross-context advertising sub-modules lack Poland-specific evidence. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 72 words · 3 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Poland: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ AI governance framework is actively in development (draft law, not yet finalised) with UODO's competence recognised but cooperation rules incomplete; biometric/genetic/surveillance-carveout sub-modules lack dedicated Poland-specific evidence. Primary framework GDPR Article 22; Regulation (EU) 2024/1689 (EU AI Act) as implemented via Poland's draft AI implementing law (KRiBSI) Supervisory authority [UODO (Prezes Urzędu Ochrony Danych Osobowych)](https://uodo.gov.pl/) Traffic-light rationale — Amber AI governance framework is actively in development (draft law, not yet finalised) with UODO's competence recognised but cooperation rules incomplete; biometric/genetic/surveillance-carveout sub-modules lack dedicated Poland-specific evidence. Periodic update · new data 2026-10-25 #### Algorithmic, Biometric & Surveillance Governance Poland has enacted its national implementing framework for the EU AI Act through the Act of 3 July 2026 on AI Systems. The centrepiece of this law is the establishment of a new institutional body, referred to by the acronym KRiBSI (the Commission for the Development and Safety of Artificial Intelligence), which the Act designates as Poland's sole market-surveillance authority for AI systems and its single point of contact for AI Act purposes. The law also establishes a national supervision, conformity-assessment, and regulatory-sandbox framework around KRiBSI's role. The composition of KRiBSI is notable for drawing representatives from several existing sectoral regulators rather than concentrating authority in a single pre-existing body. Representatives are drawn from UOKiK (the competition and consumer-protection authority), KNF (the financial-supervision authority), KRRiT (the broadcasting regulator), and UKE (the electronic-communications regulator), with members appointed by the Sejm for a five-year term. This multi-sectoral composition suggests an institutional design intended to bring cross-sectoral regulatory expertise to bear on AI-system oversight, spanning competition, financial, broadcasting, and telecommunications concerns. What is conspicuously absent from KRiBSI's voting membership is the Office for Personal Data Protection, UODO, Poland's dedicated data-protection authority. UODO is reported to hold only an advisory, non-voting role on KRiBSI, notwithstanding that a very substantial proportion of AI-system risk in practice arises precisely from how such systems process personal data, whether through training, inference, or profiling. UODO is understood to have publicly criticised this arrangement. The practical effect is that the authority with the deepest institutional expertise in personal-data risk assessment sits outside the body making binding market-surveillance decisions about AI systems, even where those decisions will frequently turn on personal-data processing questions that fall squarely within UODO's traditional area of competence. This is a structurally significant arrangement for how algorithmic governance and data-protection oversight will interact in Poland going forward. Decisions by KRiBSI about AI-system conformity, risk classification, or market restriction will be taken by a voting body that does not include the national data-protection regulator as a full member, which creates a structural question about how personal-data-specific input reaches KRiBSI's decision-making in a way that actually influences outcomes, as opposed to being heard only in an advisory capacity that carries no formal weight in the final vote. #### Outlook The precise working division of competence between KRiBSI and UODO, once implementing appointments to KRiBSI are made and the body becomes operationally active, has not yet been established and remains an open institutional question. Given UODO's reported public criticism of its advisory-only status, there is a live possibility that this division of labour becomes a point of ongoing institutional tension rather than settling quietly, though no particular resolution should be assumed. Confirmation of how KRiBSI's early decisions actually treat personal-data-related AI-system risk, once the body begins operating, is the key item to watch in subsequent reporting periods. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 82 words · 6 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Poland: D9 Children & Vulnerable Groups5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Age-verification-for-adult-content legislation is a live, not-yet-fully-effective development; the precise Article 8 age-of-consent figure for Poland could not be confirmed with a dedicated primary-source citation in this pass, and minor-profiling-ban / dependent-adult sub-modules lack direct evidence. Primary framework GDPR Article 8; Act of 10 May 2018; draft act on age verification for online adult content Supervisory authority [UODO (Prezes Urzędu Ochrony Danych Osobowych)](https://uodo.gov.pl/) Traffic-light rationale — Amber Age-verification-for-adult-content legislation is a live, not-yet-fully-effective development; the precise Article 8 age-of-consent figure for Poland could not be confirmed with a dedicated primary-source citation in this pass, and minor-profiling-ban / dependent-adult sub-modules lack direct evidence. D9 · Children's Privacy — Full Module Record 5 sub-modules · 91 words · 2 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Poland: D10 Enforcement & Redress6 sub-modulesGreenEnacted in forceModule confidence: Probable▾ UODO exhibits sustained, escalating enforcement activity with judicial oversight (both upholding and overturning decisions), indicating a mature and active enforcement ecosystem; collective-redress mechanisms specific to Poland were not confirmed in this pass. Primary framework GDPR Articles 58, 83, 84; Act of 10 May 2018 Supervisory authority [UODO (Prezes Urzędu Ochrony Danych Osobowych)](https://uodo.gov.pl/) Traffic-light rationale — Green UODO exhibits sustained, escalating enforcement activity with judicial oversight (both upholding and overturning decisions), indicating a mature and active enforcement ecosystem; collective-redress mechanisms specific to Poland were not confirmed in this pass. Periodic update · new data 2026-11-04 #### Enforcement & Redress Poland's data protection authority is understood to have issued two separate penalties this period grounded in its supervisory information-and-access powers rather than in findings on substantive data-processing conduct. The first, a decision dated 18 May 2026 against an association referred to as RKW and reported moving into enforcement on 26 October 2026, imposed a fine of PLN 10,082 for failing to respond to requests for information concerning an election-related application, relying on Article 58(1)(a) and (e) of the General Data Protection Regulation. The second, reported on 30 September 2026 under case reference DKE.561.7.2026, imposed a fine of PLN 31,507 on a Kraków-based entrepreneur for failing to provide information sought during an investigation into two websites; this decision is understood not yet to be final. In each case, the regulator's inquiry into the underlying data-processing conduct, the election-related application in the first matter and the two websites in the second, appears to remain open rather than resolved; the fines imposed so far address only the entities' non-cooperation with the authority's information-gathering process. #### Outlook Whether the RKW decision has become final or is subject to appeal, and whether the Kraków entrepreneur's fine will survive any appeal period, remain open at this time. The more significant development to watch for is whether either investigation progresses beyond a cooperation-based penalty to a substantive determination on the underlying processing activity, which would represent a materially different stage of enforcement than what has been confirmed so far. Periodic update · new data 2026-10-25 #### Enforcement & Redress UODO's enforcement activity in the period leading into this cycle shows a sustained and active supervisory posture across two distinct types of action. On 16 September 2026, UODO decided that wider inspections of health-data processing were warranted, a decision taken in the context of a data breach reported to have affected up to 1.3 million customers of an online sales platform. By 17 September 2026, UODO had received more than 50 complaints and over 2,000 controller notifications connected to that matter. UODO announced that the resulting additional inspections of health-data processing would continue through the end of 2026, indicating a sustained, sector-wide supervisory effort rather than a single, time-limited inquiry confined to the triggering breach alone. Separately, on 30 September 2026, UODO imposed an administrative fine of PLN 31,507 on a Kraków-based entrepreneur. The fine was imposed specifically for the entrepreneur's failure to provide information UODO needed to investigate two websites, including the identity of the controller operating them and whether personal data had been transferred outside Poland and the EU/EEA. This is a cooperation-failure penalty rather than a substantive-breach penalty: the entrepreneur was fined not for the underlying data-processing conduct itself, but for obstructing UODO's ability to investigate that conduct, which is itself a distinct category of enforcement risk that controllers and their advisers should not overlook relative to substantive compliance failures. Taken together, these two actions illustrate that UODO's enforcement cadence spans both proactive sector-wide inspection activity, triggered by a specific large-scale breach but extending beyond it, and targeted penalties for individual non-cooperation, suggesting an authority willing to use both tools concurrently rather than relying on one enforcement mechanism to the exclusion of the other. #### Outlook The health-data inspection sweep announced on 16 September 2026 is due to continue through the end of 2026; whether it has produced, or will produce, any formal enforcement decision within that window has not yet been confirmed and should be treated as an open item for subsequent reporting periods. The cooperation-failure fine imposed on 30 September 2026 stands as a concluded enforcement action but leaves open whether the underlying substantive investigation into the two websites' data-transfer practices will itself produce a further enforcement outcome once the entrepreneur's required cooperation, if provided, is assessed. Periodic update · new data 2026-10-18 #### Enforcement & Redress UODO's two most recently confirmed enforcement decisions, both dated shortly before this cycle's window, illustrate the authority's current approach to Article 83 administrative fines and are carried here for continuity. In a decision published 5 October 2026, UODO fined an administrator 29,112 PLN for failing to execute a prior UODO order to fulfil an information obligation toward a complainant. This is a procedurally distinct basis for a fine: rather than penalising the original substantive violation, UODO imposed the penalty specifically for non-compliance with its own prior administrative order, under GDPR Article 83 as applied by UODO. The structural significance of this decision is that it demonstrates UODO treats non-execution of its orders as an independently sanctionable act, meaning a controller already subject to a UODO order faces compounding exposure if it does not comply, rather than resolving its position through continued inaction. Separately, UODO's first-ever penalty specifically addressing private home-CCTV GDPR non-compliance, a 26,711 PLN fine, became final after the subject did not appeal to the Provincial Administrative Court. This decision's final status (as opposed to still being subject to appeal) is itself significant for enforcement-and-redress tracking: a final UODO decision represents the conclusion of the administrative enforcement path, with judicial review having been available but not pursued. UODO's underlying legal reasoning relied on a narrow interpretation of the household exemption under GDPR, grounded in a Court of Justice of the European Union ruling dated 11 December 2014, under which private surveillance extending beyond the strictly personal or household sphere can fall within GDPR's scope rather than being excluded from it. The 11 December 2014 CJEU precedent concerned a private individual's CCTV system that also captured a public street, establishing that household-exemption coverage does not extend to surveillance capturing space beyond the purely personal domain; UODO's reliance on this reasoning for a private home-CCTV case indicates the authority continues to apply this narrow household-exemption standard to residential surveillance enforcement. Both decisions, while dated outside the current reporting window itself (5 October and 22 August 2026 respectively, against a window opening 11 October 2026), are carried forward here because they represent UODO's most recent confirmed exercises of its Article 83 enforcement powers and establish the baseline against which any decision dated inside the window would be read. No dated development specifically inside the 11-18 October 2026 window was located for the enforcement-and-redress module this cycle. #### Outlook The enforcement-and-redress posture to watch is whether UODO issues further decisions applying the same two reasoning patterns evident in these two carried-forward cases: fines for non-execution of prior orders, and a narrow household-exemption standard for private surveillance. No specific forthcoming decision or inspection-plan item dated inside the window was confirmed this cycle, so the module's trajectory remains one of continuity with UODO's established enforcement practice rather than a new development. Periodic update · new data 2026-10-11 #### Enforcement & Redress UODO's 2026 enforcement record shows continued high intensity across multiple sectors, punctuated by one significant judicial reversal. UODO fined DPD Polska PLN 11 million in a decision announced 23 February 2026, for violations of GDPR Article 28(3) concerning processor obligations and for inadequate organisational measures — among the largest Polish data-protection fines to date. UODO also fined Restaurant Partner Polska, the company operating the Glovo delivery platform in Poland, almost PLN 5.9 million for requiring users to upload scans of their identity cards without a legal basis, a finding that the practice breached the data-minimisation principle; UODO ordered erasure of the scans already collected as part of the decision. Smaller enforcement actions continued through the year: a PLN 15,500 fine against a court bailiff on 31 August 2026 for DPO-related violations, and a PLN 31,507 fine against a Kraków-based entrepreneur on 30 September 2026, not yet final, for failing to cooperate with UODO's proceedings. The most consequential development for the durability of UODO's enforcement record, however, is judicial rather than administrative: the Provincial Administrative Court in Warsaw overturned UODO's PLN 27 million fine against Poczta Polska, a decision reported 11 March 2026, concerning Poczta Polska's processing of personal data during the 2020 postal presidential election. This was one of UODO's largest-ever fines, and its reversal by a court — with appeal status unresolved — demonstrates that UODO's highest-value and most politically sensitive enforcement decisions remain genuinely contestable rather than final once issued. Separately, national law caps administrative fines on public authorities and bodies at PLN 100,000, and at PLN 10,000 for cultural institutions, a standing variance from the general GDPR Article 83 fine ceiling that constrains UODO's leverage against public-sector controllers specifically. #### Outlook The Poczta Polska reversal is the single development most likely to shape UODO's enforcement posture going forward: whether UODO appeals, and whether the Provincial Administrative Court's reasoning is echoed in future challenges to large UODO fines, will determine whether 2026's run of high-value enforcement actions continues at the same pace or faces increasing judicial resistance. The continuing cadence of smaller, more procedurally straightforward fines — DPO violations, non-cooperation — suggests that UODO's core day-to-day enforcement activity is not itself destabilised by the setback in the Poczta Polska case. Periodic update · new data 2026-09-28 #### Enforcement & Redress Poland's data-protection enforcement environment continues on an escalating trajectory into 2026. Secondary reporting characterises 2025 as a record enforcement year for UODO, with over PLN 64 million in fines issued across the year; this figure has not yet been directly corroborated against UODO's own published annual report, and its precise official total remains an open question. Regardless of that outstanding corroboration, 2026 enforcement activity has already produced a large individual decision that reinforces the escalating-intensity picture: UODO fined DPD Polska PLN 11 million on 23 February 2026 following an ex officio inspection of courier-delivery data processing. The penalty was split between deficient governance of data-processing agreements, at PLN 6.251 million, and inadequate technical and organisational access controls, at PLN 5.209 million, indicating UODO's willingness to impose substantial fines across multiple distinct GDPR failure categories within a single decision. A second material 2026 decision, against a delivery platform (Glovo), imposed a fine of almost PLN 5.9 million for requiring users to upload ID-card scans for anti-fraud purposes without a legal basis, in breach of the data-minimisation principle, with UODO ordering erasure of the collected scans. Both decisions are Probable-confidence findings resting on law-firm and vendor secondary reporting rather than a directly retrieved primary UODO decision page, a sourcing gap that, if closed, would allow these findings to move toward Confirmed status. Alongside the fine-driven enforcement track, Poland implemented Directive (EU) 2020/1828 in August 2024, amending the Polish Class Actions Act to permit authorised consumer organisations to bring representative GDPR actions seeking injunctive relief and compensation. This collective-redress mechanism is a standing feature of the enforcement-and-redress landscape rather than a new development this cycle, but it means UODO's own administrative fining power now operates alongside a private collective-litigation route as a second enforcement channel available to affected data subjects. #### Outlook Corroboration of UODO's official 2025 total-fines figure against its own published annual report is the most useful confirmation to watch for, given the current reliance on secondary reporting. Continued 2026 enforcement volume, and any use of the August 2024 collective-redress mechanism in a GDPR-specific representative action, would both be significant markers of how Poland's dual administrative-and-collective enforcement architecture is maturing in practice. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 127 words · 25 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (37 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy granted Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties