Since 12 September 2025, new EU-wide rules on access to and sharing of data have applied, stemming from the Data Act. It is one of the most important regulations in the EU’s data strategy — and an area many companies still underestimate. The Data Act grants users of internet-connected devices broad rights to the data […]
Educational institutions process enormous amounts of personal data — and particularly sensitive data, because it concerns children. Names, grades, attendance, health information and diagnoses, images, e-register login data — all of it requires GDPR-compliant protection. At the same time, the GDPR grants children special protection, and the Polish supervisory authority (UODO) consistently scrutinises abuses in […]
One of the most common questions in GDPR practice is: “how long can we keep the data?” The answer is: only as long as necessary — but there is no single, universal “GDPR retention period”. The GDPR sets no specific numbers. It is the controller who must determine the retention period for each purpose, drawing […]
The Polish Whistleblower Protection Act of 14 June 2024, which entered into force on 25 September 2024, requires companies with more than 50 employees to implement an internal channel for reporting breaches of law. Since 25 December 2024, external reporting channels to the Commissioner for Human Rights (RPO) and public authorities have also been operational. […]
Digital marketing runs on personal data — from email addresses in newsletter databases, through cookies tracking website behaviour, to advanced profiling and remarketing. Each of these elements is subject to the GDPR, and errors in their use are among the most frequently sanctioned violations — both by UODO and by European supervisory authorities (particularly the […]
The insurance sector is one of the most data-intensive industries — insurance operations are built on collecting, analysing, and processing personal data on a massive scale. Risk assessment (underwriting), premium calculation, claims handling, fraud detection, and distribution through agents and brokers all require access to policyholders’ personal data, often including special category data such as […]
The healthcare sector is one of the areas where personal data processing carries the highest risk. Health data belongs to the special categories of personal data (Article 9 GDPR), and its processing is subject to stricter rules than ordinary data. At the same time, healthcare requires intensive processing of such data — diagnostics, treatment, prevention, […]
CCTV cameras are standard equipment in offices, shops, warehouses, car parks, and residential estates today. For many organisations, video surveillance seems so obvious that they forget one thing — a CCTV recording is personal data. A person’s image captured on a recording enables identification, which means video surveillance is fully subject to the GDPR. In […]
Running an online shop involves intensive personal data processing at every stage — from account registration, through order fulfilment, to marketing and after-sales service. At the same time, e-commerce is a sector where UODO and European supervisory authorities are increasingly active in conducting audits, and customers are increasingly exercising their GDPR rights. This article covers […]
A GDPR compliance audit is a systematic review of personal data processing activities within an organisation, designed to assess whether the company meets the requirements of the data protection regulation. It is not a one-off exercise from 2018 — it is a process that should be repeated regularly, as business processes, technologies, and the legal […]