PolandAct on the Protection of Personal Data of 10 May 2018
Ustawa z dnia 10 maja 2018 r. o ochronie danych osobowych, Dz.U. 2018 poz. 1000
In force since .
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Audit expectation
- periodic
- Who audits it
- Regulator
What it requires
- Establish a General Data Protection Regulation (GDPR) Article 6 lawful basis before processing personal data of a person in Poland; the Act adds no Polish derogation to the Article 6 list.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does Article 107(1) of the Act of reach a controller who processes personal data without a lawful basis under GDPR Article 6 but without knowing the processing is 'niedopuszczalne' (not permitted), or only one who knows it?
What it makes you log
Who may demand the log
Regulator
Logging duty
The Act has no controller-side duty to keep a register or log. In an inspection under Chapter 9 the inspector may examine documents and information and the IT systems used to process data, and under Article 84(2) the inspected controller must provide the means for the inspection, including copies or printouts of documents and information held on media and systems. The duty to designate a data protection officer (Articles 8 to 11) is a notification duty, not a record duty.
- Kind
- Implicit
- As of
- Provision
- Act of , Art. 84(1), points 2 and 3, and Art. 84(2)
- Trigger
- personal_data_processing
What this law does
Poland gives the General Data Protection Regulation (GDPR) domestic effect through the Act of on the Protection of Personal Data. It makes the Prezes Urzedu Ochrony Danych Osobowych (President of the Personal Data Protection Office, UODO) the supervisory authority under the Regulation. Chapter 9 gives the President inspection powers. Chapter 10 provides a civil-liability venue for GDPR Article 79 and 82 claims at the sad okregowy (district court).
Chapter 11 sets a two-track administrative-fine regime that distinguishes public-finance-sector bodies from other controllers. Article 107 makes unlawful processing of personal data a criminal offense. Article 108 makes obstructing an inspection of compliance with data protection law a criminal offense.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .