Many companies know that they should periodically review their GDPR compliance. Far fewer organisations, however, know what such an audit looks like in practice. The same questions usually arise. How long does an audit take? What documents should be prepared? Who should participate? And most importantly — what does the company receive at the end? […]
Transport and logistics rely on the efficient flow of information. Personal data are involved at almost every stage of this process. Companies process driver data, vehicle location data, working-time information and shipment recipient data. They also use telematics systems, mobile applications and external carriers. In this sector, the GDPR intersects with transport regulations, employment law […]
Are pseudonymised data always personal data? For years, data protection authorities generally answered this question in the affirmative. However, the CJEU judgment of 4 September 2025 in EDPS v SRB (C-413/23 P) presents a more nuanced approach. The Court held that the status of the same data may depend on the specific entity involved. They […]
“If data are publicly available, they can be used freely” — this is one of the most common beliefs about collecting data online. However, from a GDPR perspective, this assumption is incorrect. On 7 July 2026, the European Data Protection Board adopted Guidelines 03/2026 on web scraping in the context of generative artificial intelligence. The […]
“The data have been anonymised, so the GDPR no longer applies.” This assumption is common in many organisations. However, not every operation described as anonymisation actually results in anonymous data. Effective anonymisation means that the data cease to be subject to the GDPR. Achieving this result, however, is considerably more difficult than simply removing names, […]
Personal data protection is most effective when it is built into a system from the design stage. Retrofitting compliance into a finished product is considerably more time-consuming and costly. Article 25 GDPR elevates the principle of privacy by design to a legal obligation. In addition, large-scale systems or systems involving a high risk to personal […]
“How much does GDPR implementation cost?” is a question that comes up in the first conversation with almost every client. And it is also the question most law firms answer with: “it depends.” That answer is true — but not very helpful for someone planning a budget. The problem is that “GDPR implementation” is not […]
Medical facilities process some of the most sensitive data there is — information about patients’ health. At the same time, ever since the GDPR came into force, the healthcare sector has raised the most interpretive doubts: how to reconcile medical records with the right to erasure, how to approach monitoring, when a procedure may be […]
Encryption is one of the most effective — and one of the most explicitly named — data protection measures in the GDPR. Article 32 mentions it by name, and yet the lack of encryption on lost and stolen devices remains one of the most common causes of fines imposed by the Polish supervisory authority (UODO). […]
Remote and hybrid work have become a permanent fixture in Polish companies — and with them come new challenges for personal data protection. When data leaves the office for home laptops, private Wi-Fi networks and printouts kept on the kitchen table, the risk of loss, disclosure or unauthorised access grows. The employer remains the data […]