Are pseudonymised data always personal data? For years, data protection authorities generally answered this question in the affirmative. However, the CJEU judgment of 4 September 2025 in EDPS v SRB (C-413/23 P) presents a more nuanced approach. The Court held that the status of the same data may depend on the specific entity involved. They […]
“If data are publicly available, they can be used freely” — this is one of the most common beliefs about collecting data online. However, from a GDPR perspective, this assumption is incorrect. On 7 July 2026, the European Data Protection Board adopted Guidelines 03/2026 on web scraping in the context of generative artificial intelligence. The […]
“The data have been anonymised, so the GDPR no longer applies.” This assumption is common in many organisations. However, not every operation described as anonymisation actually results in anonymous data. Effective anonymisation means that the data cease to be subject to the GDPR. Achieving this result, however, is considerably more difficult than simply removing names, […]
Personal data protection is most effective when it is built into a system from the design stage. Retrofitting compliance into a finished product is considerably more time-consuming and costly. Article 25 GDPR elevates the principle of privacy by design to a legal obligation. In addition, large-scale systems or systems involving a high risk to personal […]
“How much does GDPR implementation cost?” is a question that comes up in the first conversation with almost every client. And it is also the question most law firms answer with: “it depends.” That answer is true — but not very helpful for someone planning a budget. The problem is that “GDPR implementation” is not […]
Medical facilities process some of the most sensitive data there is — information about patients’ health. At the same time, ever since the GDPR came into force, the healthcare sector has raised the most interpretive doubts: how to reconcile medical records with the right to erasure, how to approach monitoring, when a procedure may be […]
Encryption is one of the most effective — and one of the most explicitly named — data protection measures in the GDPR. Article 32 mentions it by name, and yet the lack of encryption on lost and stolen devices remains one of the most common causes of fines imposed by the Polish supervisory authority (UODO). […]
Remote and hybrid work have become a permanent fixture in Polish companies — and with them come new challenges for personal data protection. When data leaves the office for home laptops, private Wi-Fi networks and printouts kept on the kitchen table, the risk of loss, disclosure or unauthorised access grows. The employer remains the data […]
Since 12 September 2025, new EU-wide rules on access to and sharing of data have applied, stemming from the Data Act. It is one of the most important regulations in the EU’s data strategy — and an area many companies still underestimate. The Data Act grants users of internet-connected devices broad rights to the data […]
Educational institutions process enormous amounts of personal data — and particularly sensitive data, because it concerns children. Names, grades, attendance, health information and diagnoses, images, e-register login data — all of it requires GDPR-compliant protection. At the same time, the GDPR grants children special protection, and the Polish supervisory authority (UODO) consistently scrutinises abuses in […]