Since the GDPR came into force in May 2018, the President of the Polish Data Protection Authority (UODO) has imposed dozens of administrative fines on Polish companies and public institutions. The total amount of fines is growing year on year — and an analysis of UODO decisions provides valuable insights into which mistakes most frequently […]
The Record of Processing Activities (ROPA) is one of the fundamental documents required by the GDPR. It is an internal inventory of all personal data processing activities within the organisation — a “data map” that shows what data is processed, for what purpose, on what legal basis, to whom it is disclosed, and how long […]
Every company that uses external service providers processing personal data on its behalf — an accounting firm, a hosting provider, a CRM system vendor, a marketing agency, an IT company, a cloud provider — is required to enter into a data processing agreement (DPA) with that entity. This obligation arises from Article 28 of the […]
The information obligation is one of the cornerstones of the GDPR and, at the same time, one of the most frequently mishandled requirements. Every company, institution, and organisation that processes personal data must inform the individuals concerned — and that information must meet strictly defined requirements. The document conveying this information is commonly referred to […]
The General Data Protection Regulation (GDPR) is the most important piece of legislation governing personal data protection in Europe. It has been in force since 25 May 2018 and applies to virtually every company, institution, and organisation that processes the personal data of individuals in the European Union. This guide explains the key aspects of […]