Processes personal data, in Poland

Regulation (EU) 2016/679, Art. 83; Ustawa z 10 maja 2018 r., Arts. 98, 101-108 · Read the law's page

• Compensate any person in Poland who suffered material or non-material damage from your infringement, as controller or processor, under GDPR Article 82.

Regulation (EU) 2016/679, Art. 9; Ustawa z 10 maja 2018 r., Art. 107(2); Kodeks pracy, Art. 22(1b) · Read the law's page

• Obtain an explicit GDPR Article 9(2) legal basis before processing biometric data of a person in Poland.
• Rely on a Polish employee's consent to process their biometric data only where the employee supplied the data on their own initiative, and let only people you have authorized in writing process it, bound to confidentiality, under Kodeks pracy Article 22(1b); processing needed to control access to particularly important information or to premises that need special protection is also permitted under Article 22(1b).

Regulation (EU) 2016/679, Arts. 12-21; Ustawa z dnia 10 maja 2018 r. o ochronie danych osobowych, Arts. 92-97 · Read the law's page

• Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Poland within one month of receipt, except that most of these rights do not apply to press, literary and artistic activity, and a controller performing a public task may withhold the access information where that is necessary for the aims in GDPR Article 23(1).

Regulation (EU) 2016/679, Arts. 33-34 · Read the law's page

• Notify UODO without undue delay, and within 72 hours where feasible, after becoming aware of a personal-data breach affecting a person in Poland, unless the breach is unlikely to risk their rights and freedoms, and notify affected individuals without undue delay where the breach is likely to result in a high risk to them.
• If you process personal data on behalf of a controller, notify the controller without undue delay after becoming aware of a personal data breach (Article 33(2)).

Regulation (EU) 2016/679, Arts. 44-49 · Read the law's page

• Rely on an adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in Poland outside the EEA.

Ustawa z dnia 10 maja 2018 r. o ochronie danych osobowych, Dz.U. 2018 poz. 1000 · Read the law's page

• Establish a GDPR Article 6 lawful basis before processing personal data of a person in Poland; the Act adds no Polish derogation to the Article 6 list.