PolandGDPR Article 9, Act Article 107(2), and Kodeks Pracy Article 22(1b), Biometric Data
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force since 25 May 2018.
A biometric privacy rule binding public and private bodies.
As of 24 August 2026.
What it requires
- Obtain an explicit General Data Protection Regulation (GDPR) Article 9(2) legal basis before processing biometric data of a person in Poland; unlawful processing of biometric data carries a raised criminal penalty ceiling under Act Article 107(2).
- Limit an employer's no-consent biometric processing of a Polish employee to controlling access to particularly sensitive information or specially protected premises, and restrict access to authorized, confidentiality-bound staff, per Kodeks pracy Article 22(1b).
What it reaches
Excludes recording-derived identifiersNo
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
General Data Protection Regulation (GDPR) Article 9(1) lists biometric data processed for unique identification as a special category.
Poland's own Act Article 107(2) independently names biometric data processed for unambiguous identification as one of the aggravating categories that raises the criminal penalty ceiling for unlawful processing from two to three years' deprivation of liberty, alongside racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, health data, and sexual life or orientation data.
Article 107(2)'s own in-force date is the Act's general commencement date, 25 May 2018, confirmed against the same Article 176 text used for the Act's comprehensive-regime instrument.
For employees specifically, Kodeks pracy Article 22(1b), read verbatim, permits biometric-data processing on consent only where the employee supplied it on their own initiative, plus a narrow no-consent carve-out for controlling access to particularly sensitive information or specially protected premises; only staff holding written authorization may process it, bound to confidentiality.
The current Kodeks pracy text is confirmed, but not the amending act or the precise date that provision was inserted, so no date is asserted for the Kodeks pracy limb specifically, only for the Act Article 107(2) limb this instrument's effective date reflects.
When LexLint raises it
processes_biometricsprocesses_voice
Read the law
Ustawa z 10 maja 2018 r., Art. 107(2) and Art. 176 (in-force date)
Kodeks pracy, Art. 22(1a)-22(1b) (no insertion date confirmed)
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.