Nearly a million złoty in fines — and not for a data leak, but for who held the DPO role in the company and how it was organised. The President of Poland’s Data Protection Authority (UODO) fined Poczta Polska (the Polish postal operator) PLN 978,128 (around EUR 232,000) for failing to ensure the independence of […]
The right to data portability is one of the most “digital” rights granted by the GDPR — and one of the most frequently confused. It lets a person retrieve their data in a machine-readable format and move it to another provider, without having to re-enter everything from scratch. Its purpose is to increase users’ control […]
Encryption is one of the most effective — and one of the most explicitly named — data protection measures in the GDPR. Article 32 mentions it by name, and yet the lack of encryption on lost and stolen devices remains one of the most common causes of fines imposed by the Polish supervisory authority (UODO). […]
Remote and hybrid work have become a permanent fixture in Polish companies — and with them come new challenges for personal data protection. When data leaves the office for home laptops, private Wi-Fi networks and printouts kept on the kitchen table, the risk of loss, disclosure or unauthorised access grows. The employer remains the data […]
Since 12 September 2025, new EU-wide rules on access to and sharing of data have applied, stemming from the Data Act. It is one of the most important regulations in the EU’s data strategy — and an area many companies still underestimate. The Data Act grants users of internet-connected devices broad rights to the data […]
Educational institutions process enormous amounts of personal data — and particularly sensitive data, because it concerns children. Names, grades, attendance, health information and diagnoses, images, e-register login data — all of it requires GDPR-compliant protection. At the same time, the GDPR grants children special protection, and the Polish supervisory authority (UODO) consistently scrutinises abuses in […]
One of the most common questions in GDPR practice is: “how long can we keep the data?” The answer is: only as long as necessary — but there is no single, universal “GDPR retention period”. The GDPR sets no specific numbers. It is the controller who must determine the retention period for each purpose, drawing […]
Legitimate interest under Article 6(1)(f) GDPR is one of the six legal bases for processing personal data — and the one most often misused. Controllers reach for it whenever they would rather not ask for consent and see no other basis, treating it as a “default” fallback. That is a serious mistake. Relying on legitimate […]
The Polish Whistleblower Protection Act of 14 June 2024, which entered into force on 25 September 2024, requires companies with more than 50 employees to implement an internal channel for reporting breaches of law. Since 25 December 2024, external reporting channels to the Commissioner for Human Rights (RPO) and public authorities have also been operational. […]
Digital marketing runs on personal data — from email addresses in newsletter databases, through cookies tracking website behaviour, to advanced profiling and remarketing. Each of these elements is subject to the GDPR, and errors in their use are among the most frequently sanctioned violations — both by UODO and by European supervisory authorities (particularly the […]