Handles health records, in Poland

Art. 11 ustawy z dnia 5 lipca 2018 r. o krajowym systemie cyberbezpieczeństwa (Dz.U. 2026 poz. 20), w brzmieniu nadanym ustawą z dnia 23 stycznia 2026 r. (Dz.U. 2026 poz. 252) · Read the law's page

• Notify the competent CSIRT without delay, and in any event within 24 hours of detecting a significant incident, with an early warning. That is the competent sectoral CSIRT, except that until the competent authority announces that the sectoral CSIRT has reached operational capability (the authority must set it up within 18 months of 3 April 2026) the report goes to CSIRT MON, CSIRT NASK or CSIRT GOV, and the same recipient rule governs every report under Articles 11 to 12b; the transitional rule does not apply to a sector whose sectoral cybersecurity team was set up before 2025 (Article 44 of the amending Act).
• Follow with a fuller notification within 72 hours of detection, a periodic report on the CSIRT's request, and a final report no later than one month after the 72-hour notification.
• If you provide a trust service, report a significant incident to the competent sectoral CSIRT without delay, and in any event within 24 hours of detecting it, as a notification (Article 11(1a)).
• If the handling of a significant incident has not ended when the final report falls due, submit a progress report on the handling to the competent sectoral CSIRT, and submit the final report no later than one month after the handling of the incident ends (Article 12b).
• Where a serious cyber threat arises, inform the users of your services who may be affected of the preventive measures they can take, and inform them of the threat itself unless doing so would increase the risk to information-system security; where a significant incident has an adverse effect on your service, inform the affected users of the incident.
• An entity that was an operator of an essential service before 3 April 2026 has had to report under the new Articles 11 to 12b since 3 October 2026 (Article 33(4) of the amending Act); every other essential or important entity has until 3 April 2027. Article 11 binds an essential entity or important entity classified against the Załącznik nr 1 or Załącznik nr 2 sector lists, which name an online marketplace, an internet search engine and a social-networking-service platform among the digital service providers it reaches expressly; the wider sector classes are reached as on this jurisdiction's companion risk-management row.

Art. 8 ustawy z dnia 5 lipca 2018 r. o krajowym systemie cyberbezpieczeństwa (Dz.U. 2026 poz. 20), w brzmieniu nadanym ustawą z dnia 23 stycznia 2026 r. (Dz.U. 2026 poz. 252) · Read the law's page

• Implement an information security management system in the information system used in the processes affecting your provision of the service, covering systematic risk assessment and risk management, physical, personnel and supply-chain security, business continuity and disaster-recovery planning, continuous monitoring, effectiveness evaluation, cybersecurity training and basic cyber-hygiene, cryptography, secure communications and multi-factor authentication where appropriate, asset management, and access control.
• Have the entity's management implement and oversee the system, proportionate to the assessed risk, the entity's size, the cost of implementation, and the likelihood and severity of an incident.
• From 3 April 2027, twelve months after the Act's entry into force on 3 April 2026, Article 8 binds an essential entity or important entity classified against the Załącznik nr 1 or Załącznik nr 2 sector lists, which name an online marketplace, an internet search engine and a social-networking-service platform (Załącznik nr 2, Dostawcy usług cyfrowych) among the digital service providers it reaches expressly. Such a provider is an important entity under Article 5(2) point 2 when it meets or exceeds the medium-enterprise size threshold of Article 2(1) of Annex I to Regulation (EU) No 651/2014, and the Act binds it only where Poland is its main place of business or, with no establishment in the European Union, where it has designated a representative in Poland (Article 5a(3), (7) and (9)). The wider sector classes the Załączniki also reach (critical-facility operators, energy, transport, health, finance, telecommunications and digital-infrastructure providers, and public administration) are reached too, by meeting the Article 5 criteria: entry in the register of essential and important entities records that status and does not create it (Article 7d(5)). Banking and financial-market-infrastructure entities are excluded from this Article's system duty, apart from the systematic risk assessment and risk management of Article 8(1) point 1 and the basic cyber-hygiene principles of point 2(j) (Article 8i(1)).