GDPR — The Foundation of Data Protection in Business
The GDPR has been directly applicable in Poland since May 25, 2018. It applies to every business processing personal data — regardless of company size. Fines reach EUR 20 million or 4% of global turnover.
Data Controller Obligations
Maintaining records of processing activities (ROPA), ensuring a legal basis for each processing operation, fulfilling data subject rights (access, rectification, erasure, portability), entering data processing agreements (DPAs) with processors, implementing appropriate technical and organizational measures.
GDPR Documentation — Minimum
Data protection policy, ROPA, information clauses, DPAs, data subject request procedure, breach notification procedure (72h), risk analysis (DPIA for high-risk operations).
Data Protection Officer (DPO)
Mandatory when: processing by a public authority, core activities require regular large-scale monitoring, or special category data is processed at scale. Many employers appoint a DPO voluntarily — it facilitates compliance and UODO contact.
Most Common Violations in Polish Companies
Outdated information clauses on websites, collecting consent "just in case" (no minimization), storing data without time limits (no retention policy), unencrypted laptops, sending personal data emails to wrong recipients.
GDPR Audit — Where to Start
Processing inventory, legal basis verification, subcontractor agreement review, technical security assessment, employee training. An audit doesn't have to be expensive — but it must be regular.
Need a GDPR audit or complete documentation? Get in touch — I'll help implement compliance step by step.