The insurance sector is one of the most data-intensive industries — insurance operations are built on collecting, analysing, and processing personal data on a massive scale. Risk assessment (underwriting), premium calculation, claims handling, fraud detection, and distribution through agents and brokers all require access to policyholders’ personal data, often including special category data such as […]
The right to erasure — commonly known as the right to be forgotten — is one of the most well-known and simultaneously most frequently misunderstood rights under the GDPR. Many individuals believe they can demand the deletion of their data in any situation, and the controller must comply immediately. Conversely, many companies refuse deletion requests […]
Privacy by design (data protection by design) and privacy by default (data protection by default) are two principles that the GDPR elevates to the status of legal obligations. Article 25 GDPR requires the controller to take data protection into account at every stage of designing systems, products, and processes — not as an afterthought, but […]
The healthcare sector is one of the areas where personal data processing carries the highest risk. Health data belongs to the special categories of personal data (Article 9 GDPR), and its processing is subject to stricter rules than ordinary data. At the same time, healthcare requires intensive processing of such data — diagnostics, treatment, prevention, […]
CCTV cameras are standard equipment in offices, shops, warehouses, car parks, and residential estates today. For many organisations, video surveillance seems so obvious that they forget one thing — a CCTV recording is personal data. A person’s image captured on a recording enables identification, which means video surveillance is fully subject to the GDPR. In […]
Selecting the correct legal basis for processing personal data is one of the most important decisions a data controller makes — and simultaneously one of the most common causes of violations identified by UODO. An incorrectly chosen legal basis can render the entire processing activity unlawful, even if the organisation meets all other GDPR requirements. […]
Running an online shop involves intensive personal data processing at every stage — from account registration, through order fulfilment, to marketing and after-sales service. At the same time, e-commerce is a sector where UODO and European supervisory authorities are increasingly active in conducting audits, and customers are increasingly exercising their GDPR rights. This article covers […]
Appointing a Data Protection Officer (DPO) — mandatory for many organisations, recommended for all — poses a practical question: hire a DPO as an employee or use an outsourced service? The GDPR expressly permits both models (Article 37(6)), and the choice depends on the size of the organisation, the scope of data processing, the budget, […]
A GDPR compliance audit is a systematic review of personal data processing activities within an organisation, designed to assess whether the company meets the requirements of the data protection regulation. It is not a one-off exercise from 2018 — it is a process that should be repeated regularly, as business processes, technologies, and the legal […]
On 3 April 2026, the amended Act on the National Cybersecurity System (KSC) entered into force in Poland, implementing the EU’s NIS2 Directive (Directive (EU) 2022/2555). This is a fundamental change — the previous legislation covered approximately 400 operators of essential services, while the new rules extend to over 42,000 entities. For many organisations, NIS2 […]