Poland. Comprehensive data protection. Act
UODO Act 2018Act of 10 May 2018 on the Protection of Personal Data (Ustawa o ochronie danych osobowych)
Partly verified
Medium confidence. No verification notes recorded.§1Summary
- Synopsis
Poland's 2018 Act establishes the UODO President as supervisory authority, sets procedure and fines, and is supplemented by a 2019 omnibus law aligning over 160 sector acts. Employee data rules sit in the Labour Code.
- Key themes
- Unique features
Age of digital consent (GDPR Art 8): 16 (no national derogation). Fines on public bodies capped at PLN 100,000 (PLN 10,000 for some); criminal offences for unlawful processing (Art 107); employee monitoring and biometrics rules in Labour Code Arts 22^1–22^3.
- SaaS relevance
Applies alongside the GDPR to any SaaS provider established in, or targeting users in, this country; national rules on age of consent, employee data and offences shape onboarding and HR-related features.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Authority 72h; individuals without undue delay (GDPR Arts 33-34)
- DPO
- Conditional
- Cross-border transfers
- GDPR Chapter V (adequacy/SCCs/BCRs)
- Maximum penalty
- GDPR Art 83: €20m or 4% global turnover; public bodies PLN 100,000
§3Dates
- Key dates
- Adopted
- In force
- Dz.U. 2018 poz. 1000; sectoral alignment by Act of 21 February 2019
§4Text and authority
- Text
- Authoritative text isap.sejm.gov.pl
- Authority
- Prezes Urzędu Ochrony Danych Osobowych (UODO)
§5Where it applies
- Domestic law of
- Poland
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence. No verification notes recorded.