Operates a social platform, in Poland

Ustawa o radiofonii i telewizji art. 47p (tekst jednolity Dz.U. 2022 poz. 1722) · Read the law's page

• Applies to video-sharing platform providers established in Poland.
• Create and operate effective technical safeguards, including parental-control systems or other appropriate measures, protecting minors from programmes, user-generated video or other content that could harm their proper physical, psychological or moral development, in particular pornographic content or unjustified violence.
• Let a platform user classify the programmes, user-generated video or other content they upload, and apply those same technical safeguards to it.
• Do not process minors' personal data collected or generated for this child-protection duty for commercial purposes such as direct marketing, profiling or behaviourally targeted advertising, on your platform, another video-sharing platform or a media service.

Prawo autorskie art. 22(1)-22(8), tekst jednolity Dz.U. 2025 poz. 24, dodane ustawa z dnia 26 lipca 2024 r. (Dz.U. 2024 poz. 1254) · Read the law's page

• Treat the access you give to a work a user posted as your own public communication of that work: get the rights holder's authorization, or be able to show the conditions that avoid liability for infringement.
• To avoid liability for a work communicated without authorization, show that you made best efforts to obtain authorization, made best efforts to prevent access to the work where the rights holder gave you the relevant and necessary information, and acted promptly on a duly substantiated request to block or remove it and, where the rights holder gave you that information, made best efforts to prevent access to it in the future.
• If your service has been available in the European Union or the European Economic Area for less than three years and your annual turnover is no more than 10 million euro, show only best efforts to obtain authorization and prompt action on a duly substantiated block or removal request; if your average monthly visitors in the previous calendar year exceed 5 million, also show best efforts to prevent access once the rights holder has given you the information.
• Do not let cooperation with rights holders make lawfully posted works unavailable, in particular works used under the permitted-use exceptions, and tell the user promptly each time you block access to or remove a work they posted.
• On a rights holder's request, give information on how you cooperate with rights holders and on the use of the works you are authorized to communicate, as needed to set the remuneration due.
• Give users a free, electronic complaint route for blocked or removed works; decide each complaint without undue delay on the basis of the complaint and the rights holder's information; restore access promptly where the complaint is justified, including where the work was posted with the rights holder's consent or under the permitted-use exceptions; give a written, reasoned answer where you reject a complaint; and do not reject a complaint by automated means.
• Do not identify individual users or process their personal data in carrying out these steps unless other law provides otherwise, and tell users the conditions of using the service, including the possibility of using works under the permitted-use exceptions.

Art. 11 ustawy z dnia 5 lipca 2018 r. o krajowym systemie cyberbezpieczeństwa (Dz.U. 2026 poz. 20), w brzmieniu nadanym ustawą z dnia 23 stycznia 2026 r. (Dz.U. 2026 poz. 252) · Read the law's page

• Notify the competent CSIRT without delay, and in any event within 24 hours of detecting a significant incident, with an early warning. That is the competent sectoral CSIRT, except that until the competent authority announces that the sectoral CSIRT has reached operational capability (the authority must set it up within 18 months of 3 April 2026) the report goes to CSIRT MON, CSIRT NASK or CSIRT GOV, and the same recipient rule governs every report under Articles 11 to 12b; the transitional rule does not apply to a sector whose sectoral cybersecurity team was set up before 2025 (Article 44 of the amending Act).
• Follow with a fuller notification within 72 hours of detection, a periodic report on the CSIRT's request, and a final report no later than one month after the 72-hour notification.
• If you provide a trust service, report a significant incident to the competent sectoral CSIRT without delay, and in any event within 24 hours of detecting it, as a notification (Article 11(1a)).
• If the handling of a significant incident has not ended when the final report falls due, submit a progress report on the handling to the competent sectoral CSIRT, and submit the final report no later than one month after the handling of the incident ends (Article 12b).
• Where a serious cyber threat arises, inform the users of your services who may be affected of the preventive measures they can take, and inform them of the threat itself unless doing so would increase the risk to information-system security; where a significant incident has an adverse effect on your service, inform the affected users of the incident.
• An entity that was an operator of an essential service before 3 April 2026 has had to report under the new Articles 11 to 12b since 3 October 2026 (Article 33(4) of the amending Act); every other essential or important entity has until 3 April 2027. Article 11 binds an essential entity or important entity classified against the Załącznik nr 1 or Załącznik nr 2 sector lists, which name an online marketplace, an internet search engine and a social-networking-service platform among the digital service providers it reaches expressly; the wider sector classes are reached as on this jurisdiction's companion risk-management row.

Ustawa z dnia 4 września 2026 r. o zmianie ustawy o świadczeniu usług drogą elektroniczną oraz niektórych innych ustaw (Dz.U. 2026 poz. 1296) · Read the law's page

• When the competent authority asks for it in a proceeding, give it all the information and documents it needs, within the deadline the request sets.
• Submit to an inspection by the competent authority: give the inspector the information needed, access to premises during working hours, and the documents, emails, data carriers and access to systems and databases the inspector asks for.
• Carry out a decision that finds a breach of the Regulation: stop the infringement, make any statement the decision orders, publish the decision at your own cost where it so orders and, where no other effective measure exists, take the warning and access-prevention measures it lists.
• Carry out commitments you have undertaken when the authority makes them binding by decision, by the deadline it sets, and report on how far you have carried them out.
• Comply with the obligations of Regulation (EU) 2022/2065 that the Act lists as subject to an administrative fine: for every provider of intermediary services, Articles 9(1) and (5), 11, 12, 13(1), (2) and (4), 14(1) to (4) and 15(1); for a hosting service, Articles 16(1), (2) and (4) to (6), 17(1), (3) and (4) and 18; for an online platform, Articles 20(1) and (3) to (6), 21(1) second subparagraph, 22(1) and (6), 23, 24(1) to (3) and (5), 25(1), 26, 27, 28(1) and (2), 30, 31 and 32; and for an online search engine, Article 24(3).

Art. 8 ustawy z dnia 5 lipca 2018 r. o krajowym systemie cyberbezpieczeństwa (Dz.U. 2026 poz. 20), w brzmieniu nadanym ustawą z dnia 23 stycznia 2026 r. (Dz.U. 2026 poz. 252) · Read the law's page

• Implement an information security management system in the information system used in the processes affecting your provision of the service, covering systematic risk assessment and risk management, physical, personnel and supply-chain security, business continuity and disaster-recovery planning, continuous monitoring, effectiveness evaluation, cybersecurity training and basic cyber-hygiene, cryptography, secure communications and multi-factor authentication where appropriate, asset management, and access control.
• Have the entity's management implement and oversee the system, proportionate to the assessed risk, the entity's size, the cost of implementation, and the likelihood and severity of an incident.
• From 3 April 2027, twelve months after the Act's entry into force on 3 April 2026, Article 8 binds an essential entity or important entity classified against the Załącznik nr 1 or Załącznik nr 2 sector lists, which name an online marketplace, an internet search engine and a social-networking-service platform (Załącznik nr 2, Dostawcy usług cyfrowych) among the digital service providers it reaches expressly. Such a provider is an important entity under Article 5(2) point 2 when it meets or exceeds the medium-enterprise size threshold of Article 2(1) of Annex I to Regulation (EU) No 651/2014, and the Act binds it only where Poland is its main place of business or, with no establishment in the European Union, where it has designated a representative in Poland (Article 5a(3), (7) and (9)). The wider sector classes the Załączniki also reach (critical-facility operators, energy, transport, health, finance, telecommunications and digital-infrastructure providers, and public administration) are reached too, by meeting the Article 5 criteria: entry in the register of essential and important entities records that status and does not create it (Article 7d(5)). Banking and financial-market-infrastructure entities are excluded from this Article's system duty, apart from the systematic risk assessment and risk management of Article 8(1) point 1 and the basic cyber-hygiene principles of point 2(j) (Article 8i(1)).