RODO (GDPR) for companies in Poland 2026 — duties, audit, fines

RODO (General Data Protection Regulation 2016/679, known in Poland as RODO and internationally as GDPR) has been in force in Poland since 25 May 2018 and binds every entity that processes personal data of natural persons — from a sole proprietorship with a customer list to a large company employing hundreds of people. In 2026, the practice of the supervisory authority focuses on three areas: marketing consent and profiling, security of IT systems and incident handling, and proper information for the people whose data is processed. Non-compliance is costly — UODO (Poland's Personal Data Protection Office) fines reach EUR 20 million or 4% of annual turnover.

Who has to apply RODO

RODO applies to every data controller and every processor. The controller is the company that decides on the purposes and means of processing — the employer in relation to employees, the online store in relation to buyers, the accounting office in relation to its own clients. The processor is the entity that processes data on behalf of the controller — e.g. a CRM provider, a hosting company, a law firm handling debt collection.

There is no minimum company size. A sole-trader wedding photographer, a personal trainer with contacts in their phone and an e-commerce platform with a million users are subject to the same rules — they only differ in the scope of documentation duties and the scale of security measures required.

Seven principles that must not be broken

Article 5 of RODO lists the principles that every controller must comply with. In practice, auditors reduce them to seven rules:

• lawfulness, fairness and transparency — processing is based on a specific legal basis (consent, contract, legal obligation, public interest, legitimate interest of the controller, vital interests of the data subject), and the person knows what is happening with their data;
• purpose limitation — data collected for recruitment may not be used for a newsletter without a separate consent;
• minimisation — we only collect what is really needed (e.g. we do not ask an online-store customer for their PESEL to issue a business invoice);
• accuracy — data must be up to date, and outdated data must be corrected or deleted;
• storage limitation — once the purpose has been achieved, data must be deleted or anonymised, apart from periods required by regulations (e.g. 5 years for tax documents);
• integrity and confidentiality — appropriate technical and organisational safeguards;
• accountability — the controller must be able to prove compliance; it is not enough to declare it.

Documentation required by UODO

Every company should identify what data it processes, for what purpose and on what legal basis. From this analysis a register of processing activities (RCPD) is created, and — if there is processing on behalf of other entities — a register of categories of processing activities (RKPD). Some companies are required to keep both registers in parallel.

The minimum set of documents in a mid-sized company includes:

• an internal data protection policy together with procedures;
• a register of processing activities;
• information clauses for various categories of persons (customer, employee, candidate, newsletter subscriber);
• data processing agreements with every supplier to whom data is transferred (hosting, bookkeeping, SaaS);
• a procedure for handling data subject requests (access, rectification, erasure, portability, objection);
• a procedure for handling incidents and personal data breaches;
• risk analyses and — where required — a data protection impact assessment (DPIA).

RODO audit — how to conduct one

A RODO audit is an inventory of the actual state of affairs compared with the requirements of the regulation. A properly designed audit has five stages:

1. process mapping — identifying where in the company personal data appears at all (ERP, CRM, email, cloud, local drives, paper documents);
2. analysis of legal grounds — for each processing activity, indicating whether it is based on consent, contract, obligation or legitimate interest;
3. document review — information clauses, consents, policies, processing agreements;
4. risk analysis — assessment of the probability and severity of potential breaches and the adequacy of safeguards;
5. a report with recommendations — hierarchy of actions, deadlines, responsible persons.

An audit should be repeated every 12–24 months and whenever a significant change occurs — the roll-out of a new system, the launch of e-commerce, a large-scale recruitment process, a change of IT provider.

DPO — who must appoint one

A Data Protection Officer (DPO) must be appointed by three categories of entities:

• public authorities and bodies (apart from courts);
• controllers and processors whose core activity consists of operations which require regular and systematic monitoring of individuals on a large scale (e.g. marketing platforms, large portals, telemedicine systems);
• controllers and processors whose core activity consists of large-scale processing of special categories of data (health, biometric, concerning sexual orientation, origin or beliefs).

A small or medium-sized company with HR, a few processes and several hundred clients usually does not have to appoint a DPO. It may do so voluntarily — and will then be subject to the same requirements of independence and reporting to UODO as a mandatory entity. A DPO can be employed under an employment contract or engaged under a contract with an external specialist.

Data breach — what to do in the first 72 hours

A personal data breach (incident) occurs whenever data is lost, disclosed to an unauthorised person, altered or destroyed — regardless of whether the effect is already visible. The scenarios are mundane: a lost employee laptop, a phishing attack resulting in email account takeover, a bulk email with recipients in "To" instead of "Bcc".

The response has several steps:

1. immediately contain the situation (block the account, cut off access, change passwords);
2. check what data was disclosed and how many people it concerned;
3. assess the risk to the rights and freedoms of the individuals concerned;
4. if the risk is real — report the breach to UODO within 72 hours of detection (form available at uodo.gov.pl);
5. if the risk is high — notify the people affected and describe the remedial measures proposed by the controller;
6. record every incident in an internal register — even if it did not require notifying UODO.

UODO fines — what the supervisory authority watches

The President of UODO may impose an administrative fine of up to EUR 10 million or 2% of worldwide annual turnover (for less serious breaches, e.g. documentation gaps, an incorrect DPO) or up to EUR 20 million or 4% of worldwide annual turnover (for serious ones — lack of a legal basis for processing, breach of RODO principles, disregard of data subjects' rights). The higher of the two amounts applies.

In recent years UODO has fined, among other things, for inadequate security of an application leaking customer data, for processing CCTV recordings without a legal basis, and for negligence in recruitment processes. Regardless of the administrative fine, a person affected by an incident may seek damages in a civil court.

Marketing, cookies and consent in 2026

Marketing communication remains the most problematic area of RODO. In Poland, alongside the regulation, the Act on the Provision of Electronic Services and the Electronic Communications Law (formerly the Telecommunications Law) also apply. Together they require that:

• the sending of a commercial email or SMS has a separate, voluntary and clearly described consent;
• cookie consent is active (not implied by "scroll" or "continue"), with an easy option to refuse;
• every recipient has a simple way to unsubscribe (link in the footer, keyword in SMS);
• the controller records who gave consent and when — so that it can be proven.

Practice shows that a well-designed cookie banner and a newsletter sign-up form with separate consent fields are an investment that pays off during the very first UODO inspection.

How Good Balance helps

As part of our legal consultation, the Good Balance team conducts RODO audits, prepares policies and procedures, drafts information clauses, processing agreements and the register of activities, and supports clients with incidents — from risk assessment to reporting to UODO. For companies required to appoint a DPO, we offer outsourcing of the officer function and training for employees. If you have received a letter from UODO, we will help prepare a reply and a defence against the fine.