Poland

AI governance official source

Personal Data Protection Office's investigation into Glovo over alleged unlawful data collection practices of identity documents

On 19 February 2026, Poland’s Personal Data Protection Office (UODO) announced a fine of PLN 5.898 million against Glovo over the unlawful data collection practices in its mobile application. The authority found that the company unlawfully required users to submit scans or photos of identity cards or passports for fraud verification, including suspected theft, counterfeit payments, or mismatched card details, relying incorrectly on legitimate interest under Article 6(1) of the General Data Pr...

Personal Data Protection Office's proposal to introduce law to address dissemination of harmful deepfake content

On 18 September 2025, the President of the Personal Data Protection Office (UODO) presented a proposal to introduce a law protecting individuals from harmful deepfakes. The proposal focuses on technology companies and social media platforms hosting manipulated images, audio, or video of identifiable persons. It proposes legal accountability for creating and sharing deepfakes, stronger personal data protection, mandatory platform detection and labelling systems, rapid removal of illegal conten...

Data Protection Authority investigation into election-related privacy breaches

On 7 May 2025, the Polish Office for Personal Data Protection (UODO) announced that it is investigating potential breaches of data protection law during the presidential election campaign. The announcement emphasises that political candidates and election committees are subject to data protection obligations and that public figures are not exempt. The Office is examining several incidents in which personal data, including names, addresses, and sensitive contextual information such as health s...

Office for the Protection of Personal Data updated guide on obligations of administrators related to personal data protection breaches

On 20 February 2025, the Personal Data Protection Office (UODO) adopted the updated version of its guide on personal data breaches, which includes new General Data Protection Regulation (GDPR) interpretations, revised risk assessment criteria, and updated reporting procedures. The guide outlines a range of cybersecurity measures, such as ransomware protection, phishing detection, and encryption practices, and clarifies the 72-hour notification deadline and exceptions. A new section addresses...

Office of the Data Protection Commissioner guidance including recommendations against use of DeepSeek due to data protection concerns

On 6 February 2025, the Office of Data Protection Commissioner (UODO) adopted an outline cautioning against the use of DeepSeek over data protection concerns. It was highlighted that the chatbot, developed by Chinese companies Hangzhou DeepSeek AI and Beijing DeepSeek AI, has been downloaded 3.6 million times in two weeks. UODO warned that user data may be stored on servers in China, which lacks an adequacy decision from the European Union (EU). It was also highlighted that Chinese authoriti...

Ministry of Digital Affairs guidelines on implementation procedure for content moderation under European Union's Digital Services Act

On 13 January 2025, the Ministry of Digital Affairs adopted guidelines on the implementation procedure for content moderation under European Union's Digital Services Act (DSA) in Poland. It was highlighted that DSA aims to hold digital companies accountable for platform content, focusing on combating illegal content and enhancing transparency. Currently, platforms including Facebook manage illegal content independently, but the DSA introduces state involvement through administrative procedure...

Office for Personal Data Protection lawsuit against Bank Millennium over data processing practices

On 8 January 2025, the Supreme Administrative Court in Warsaw (NSA) issued a ruling against Bank Millennium, thereby affirming the stance previously adopted by the President of the Office for Personal Data Protection (UODO). The court dismissed the bank's cassation appeal, thereby upholding the decision that the bank could not process the personal data of former customers under Article 6(1)(f) of the General Data Protection Regulation (RODO) to defend against potential future claims. The UODO...

Ministry of Digital Affairs brochure on forbidden AI systems

On 31 December 2024, the Ministry of Digital Affairs in Poland closed the consultation process for the implementation of the Regulation on Artificial Intelligence (AI Act), focusing on the prohibition of goods and services related to ML and AI development. This national-level action aims to align with the European Union's efforts to create a uniform regulatory framework for AI and educate the affected people and businesses about the regulation. The consultation seeks to gather input on prohib...

PDPO investigation into ClickQuickNow's compliance with GDPR

On November 12, 2024, Poland's Supreme Administrative Court upheld a fine of PLN 201,559.50 against ClickQuickNow, dismissing the company’s appeal and confirming the earlier decision by the President of the Personal Data Protection Office (PDPO) concerning violations of the GDPR, including making it unnecessarily difficult to withdraw consent for personal data processing and failing to comply with the “right to be forgotten.” The Court agreed that ClickQuickNow employed misleading and overly ...

Personal Data Protection Office investigation into Meta over publishing advertisements using Omenaa Mensah's data in Poland

On 10 December 2024, the Provincial Administrative Court in Warsaw (WSA) denied the appeal filed by Meta Platforms Ireland Limited, which sought to suspend the enforcement of orders issued by the President of the Office for Personal Data Protection (PUODO) banning the dissemination of purportedly false advertisements. The legal dispute pertained to allegations of unauthorised use of personal data and images of journalist Omena Mensah and entrepreneur Rafał Brzoska in advertisements deemed to ...

Personal Data Protection Office's Sectoral Inspections Plan 2024

On 12 February 2024, the Personal Data Protection Office in Poland announced its plan for sectoral inspections for the year. Specifically, the Office will focus on entities processing data using Internet applications, among other sectors.

Ministry of Digital Affairs order on designation of authorities for the enforcement of fundamental rights protections in the EU Artificial Intelligence Act

On 31 October 2024, the Ministry of Digital Affairs designated three public bodies to oversee and enforce protections of fundamental rights related to high-risk artificial intelligence (AI) systems, as defined under Article 6 of the EU AI Act. Article 77(1) of the AI Act grants certain public authorities in EU Member States the responsibility to protect fundamental rights, including the right to non-discrimination, in relation to AI systems. These authorities are permitted to access documenta...

Nowe prawo ma wspomóc rozwój AI w Polsce - Ministerstwo Cyfryzacji

UODO lawsuit over data leak from pandabuy website

On 15 October 2024, the District Court for Warsaw-Śródmieście mandated the District Prosecutor's Office for Warszawa Śródmieście-Północ to investigate the data leak impacting Polish customers of the pandabuy platform. On 29 April 2024, the Personal Data Protection Office (UODO) had notified the prosecutor's office of a suspected crime involving the unauthorised leak of personal data from pandabuy platform, which included names, email addresses, phone numbers, and other information belonging t...

Draft Act on Data Management

On 2 October 2024, the Polish government closes its public consultation on the Draft Act on Data Management (UC67). This Draft Act would align national regulations with the EU Data Governance Act (DGA), facilitating the sharing of both personal and non-personal data across various sectors. This Draft Act would align national regulations with the EU Data Governance Act (DGA), facilitating the sharing of both personal and non-personal data across various sectors. The Act proposes the establishm...

Poland-United States of America Memorandum of Understanding concerning Cybersecurity and Emerging Technology Cooperation

On 1 October 2024, the Department of Homeland Security (DHS) of the United States of America and the Polish Ministry of Digital Affairs (MDA) signed a Memorandum of Understanding (MOU) to enhance their collaboration in the fields of cybersecurity and emerging technology. The objective of this agreement is to establish a structured framework for future policy and operational cooperation across a range of domains, including cyber policy and strategy, Secure by Design principles, information sha...

UODO investigation into the President of the District Court of Zgierz over alleged Dara Protection Breach

On 30 September 2024, the Supreme Administrative Court (NSA) dismissed the cassation appeal of the President of the District Court in Zgierz and upheld the decision of the Provincial Administrative Court (WSA) in Warsaw. It confirms the Polish Data Protection Authority's (UODO) decision to impose a financial penalty for inadequate data protection measures. The investigation was started based on a personal data breach involving the loss of an unencrypted pen drive containing the data of 400 in...

UODO investigation into Morele.net over allegedly violating GDPR provisions

On 16 September 2024, the Provincial Administrative Court (WSA) dismissed Morele.net's complaint against the Personal Data Protection Office (UODO) regarding its decision finding that Morele.net had violated several GDPR provisions and imposing a fine of over PLN 3.8 million. The case was reconsidered after the Supreme Administrative Court (NSA) annulled a previous ruling from 2023, which had initially dismissed Morele.net's appeal against a smaller fine of 2.8 million PLN imposed in 2019. Th...

UODO National Inquiry on data access rights under GDPR as part of EDPB Coordinated Enforcement Framework

On 31 July 2024, the Office for Personal Data Protection closes its consultation on the national study focusing on the exercise of the right of access to personal data by controllers. This study invites administrators to participate in a survey developed within the European Data Protection Board's (EDPB) Coordinated Enforcement Framework (CEF). The survey aims to promote GDPR compliance and disseminate best practices among organisations. This initiative, part of a broader effort involving 31 ...

Act on National Cybersecurity System

On 7 October 2024, the Poland Ministry of Digital Affairs published an announcement on the Amendment to the Act on the National Cybersecurity System after conducting a public consultation from 24 April to 24 May 2024. The Act would emphasise the integration of the NIS 2 Directive and the implementation of the 5G Cybersecurity Toolbox to ensure compliance with EU standards and to enhance Poland's digital security resilience. The Ministry of Digital Affairs aims to improve supervision over crit...

UODO guidelines on protecting children's privacy and images on the internet

On 8 July 2024, the Office for Personal Data Protection (UODO) published a guide to support institutions, organisations, and adults in protecting children's privacy and images on the internet. The guide outlines the legal and ethical considerations of sharing children's images online. Furthermore, the guide lists potential risks such as hate speech, cyberbullying, and identity theft and emphasises raising awareness about children's privacy in digital environments.

UODO guidelines on personal data protection in the workplace

On 21 June 2024, the Polish Data Protection Authority (UODO) closed its consultation on guidelines for personal data protection in the workplace. The guideline explains how employers should handle the personal data of job candidates and employees in compliance with the General Data Protection Regulation (GDPR). It covers data processing during recruitment and employment, including various employment arrangements. Further, it emphasises that employers should only collect data authorised by law...

Lawsuit against Polish National Data Protection Regulation over alleged violation of right to privacy

On 28 May 2024, the European Court of Human Rights delivered a decision regarding the Polish legislation on secret surveillance and data retention. The case, brought forward by five Polish nationals, challenged the national laws authorising operational control and the retention of telecommunications, postal, and digital communications data for potential future use by national authorities. The Court found three violations of Article 8 of the European Convention on Human Rights, highlighting th...

Implementation Legislation of the EU Data Act (Directive (EU) 2020/1828)

On 30 April 2024, the Ministry of Digital Affairs in Poland closed its public consultation on a Bill implementing the EU Data Act (Directive (EU) 2020/1828) into Polish national Law. The pre-consultation aimed to gather initial opinions all stakeholders on how best to integrate the Data Act into Poland's legal system. Stakeholders were invited to share information on whether one or more authorities should be entrusted with the application and enforcement of the Data Act and if a new market su...

Bill on designation of market surveillance authority and notifying authority under EU AI Act

On 23 April 2024, the Ministry of Digitization in Poland closed the consultation on a Bill on the designation of market surveillance authority and notifying authority under the European Union Artificial Intelligence Act (AI Act). The Ministry gathered initial opinions from AI sector stakeholders on how best to integrate the Act into Poland's legal system. Stakeholders were invited to share information on whether a new market surveillance authority under Polish law should be established or new...

Data Protection Authority Statement Regarding Processing of Employee Health Data by Medical Entities

On 15 March 2024, the Polish Data Protection Authority (UODO) issued a statement on the processing of health data by medical entities in a dual role as both employers and medical service providers. This was the case in the judgment of 21 December 2023 in the case of sygn. C-667/21 Krankenversicherung Nordrhein. According to the judgment of the Court of Justice of the European Union, if a medical entity processes health data of one of its employees not as an employer, but as a medical service,...

Public Lawsuit involving Mayor of Aleksandrow Kujawski regarding data protection contract with processor

On 28 February 2024, the Supreme Administrative Court of Poland upheld a decision of the Warsaw Administrative Court. The ruling confirmed a penalty of PLN 40’000 imposed on the Mayor of Aleksandrow Kujawski for violating Art.28 of the General Data Protection Regulation (GDPR). The case revolved around the Mayor's failure to enter into a data processing agreement with the company hosting the Public Information Bulletin (BIP) resources of the Aleksandrow Kujawski Municipal Office, and the enti...

Personal Data Protection Office order approving additional requirements for entities certifying compliance of personal data processing with GDPR

On 8 December 2023, the Personal Data Protection Office (PDPO) approved additional requirements for the accreditation of certifying entities. The order aims to verify the compliance of personal data processing operations carried out by controllers and processors. The certification, which is voluntary, is intended to increase transparency and improve compliance with personal data protection standards, taking into account the specificity of various sectors. Entities that receive a certificate w...

UODO investigation into Link4 regarding failure to report a data breach

On 23 November 2023, the Polish Personal Data Protection Office (UODO) announced it fined the insurance company Link4 for failure to report a data breach. The company sent a damage compensation message to an unauthorised recipient, containing various personal data. The company was informed by the unauthorised recipient about the event but did not take any action. Later, the company explained that the message was sent as a result of human error. The fine amounts to PLN 103'752.

Office of Competition and Consumer Protection Investigation into Allegro for Alleged Abuse of Dominance through Self-Preferencing

On 29 December 2022, the Polish Office of Competition and Consumer Protection (UOKiK) sanctioned the online shopping platform Allegro with a fine of PLN 206 million for abusing its dominant position through self-preferencing. Allegro is both an intermediary platform in e-commerce (allegro.pl), and also sells goods on its own online store, called Official Allegro Store (OSA). OSA was the largest seller on allegro.pl. UOKiK decided to sanction Allegro for using non-public information from the s...

Personal Data Protection Office addresses legal gap in GDPR compliance

The Personal Data Protection Office (UODO) in Poland noticed a legal gap while adjusting the provisions of the GDPR to the activities of psychological and pedagogical counselling centers. Currently, the Polish Education Law and the implementing acts related to it only cover partial protection of personal data contained in the documentation kept by the counselling centers. Therefore, the UODO President sent a formal request to the Minister of Education and Science to consider a comprehensive l...

Content moderation restriction in draft Polish "free speech law"

The Draft of the law on the protection of freedom of speech on social networking websites is announced by the Polish Minister of Justice. According to the drafted law, the social networks would be forbidden to delete entries or block the accounts of Polish users if their content does not violate Polish law. Moreover, a five-person Freedom of Speech Council would be established to monitor the constitutional freedom of expression on social networking sites. The law also requests the social med...

Sztuczna inteligencja - UODO

Urząd Ochrony Danych Osobowych oraz Społeczny Zespół Ekspertów przy Prezesie UODO zapraszają na webinarium „Od AI Act do krajowych regulacji. Nowe wyzwania dla ochrony danych osobowych”, które odbędzie się 30 września 2026 r. w godz. ...

Kolejne przepisy Rozporządzenia o Sztucznej Inteligencji (AI Act) już obowiązują - Ministerstwo Cyfryzacji

AI Act obowiązuje. Co zmienia europejska regulacja sztucznej inteligencji i dlaczego ma znaczenie? - Instytut Łączności

Od 2 sierpnia zaczął obowiązywać niemal cały AI Act - pierwsza w historii UE tak kompleksowa regulacja dotycząca sztucznej inteligencji . Choć część najbardziej wymagających przepisów dla systemów wysokiego ryzyka została odroczona, ...

AI Act już obowiązuje. Jak korzystać z AI w świetle nowych przepisów? - Instytut Łączności

Sztuczna inteligencja (SI) jest rozwijana i stosowana w praktyce od ponad 70 lat, ale dopiero generatywna SI (genSI) wywołała masowe zainteresowanie tą technologią. Powód jest prosty: klasyczna SI analizuje i przewiduje, a generatywna tworzy ...

AI Act - co się zmieniło 2 sierpnia 2026 roku? - Ministerstwo Cyfryzacji

Od 2 sierpnia 2026 r. podmioty stosujące systemy generujące treści mają obowiązek poinformowania odbiorców o tym, że dany materiał został wygenerowany lub zmodyfikowany przy użyciu AI .

AI Act - co się zmieniło 2 sierpnia 2026 roku? - Zielona Linia

Od 2 sierpnia 2026 r. podmioty stosujące systemy generujące treści mają obowiązek poinformowania odbiorców o tym, że dany materiał został wygenerowany lub zmodyfikowany przy użyciu AI .

AI Act - co się zmieniło 2 sierpnia 2026 roku? - Samorzad.gov.pl

Od 2 sierpnia 2026 r. podmioty stosujące systemy generujące treści mają obowiązek poinformowania odbiorców o tym, że dany materiał został wygenerowany lub zmodyfikowany przy użyciu AI .