Poland

Article 202 section 4b criminalizes producing, distributing, presenting, storing, or possessing pornographic content that depicts a generated or digitally processed image of a minor participating in a sexual act, reaching fabricated and AI-generated child sexual abuse material regardless of whether any real child appears in it. Section 4c extends the same penalty to a person who, for sexual gratification, participates in the presentation of such content.

General Data Protection Regulation (GDPR) Article 9(1) lists biometric data processed for unique identification as a special category.

Poland's own Act Article 107(2) independently names biometric data processed for unambiguous identification as one of the aggravating categories that raises the criminal penalty ceiling for unlawful processing from two to three years' deprivation of liberty, alongside racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, health data, and sexual life or orientation data.

Article 107(2)'s own in-force date is the Act's general commencement date, 25 May 2018, confirmed against the same Article 176 text used for the Act's comprehensive-regime instrument.

For employees specifically, Kodeks pracy Article 22(1b), read verbatim, permits biometric-data processing on consent only where the employee supplied it on their own initiative, plus a narrow no-consent carve-out for controlling access to particularly sensitive information or specially protected premises; only staff holding written authorization may process it, bound to confidentiality.

The current Kodeks pracy text is confirmed, but not the amending act or the precise date that provision was inserted, so no date is asserted for the Kodeks pracy limb specifically, only for the Act Article 107(2) limb this instrument's effective date reflects.

A controller must notify UODO within 72 hours of becoming aware of a personal-data breach, and notify the affected individual without undue delay where the breach is likely to result in a high risk. No Poland-specific derogation from this timeline or threshold was identified in the Act's own chapters.

Poland gives the General Data Protection Regulation (GDPR) domestic effect through the Act of 10 May 2018 on the Protection of Personal Data, read in full from its 48-page consolidated text.

It establishes the Prezes Urzedu Ochrony Danych Osobowych (President of the Personal Data Protection Office, UODO) as supervisory authority with inspection powers (Rozdzial 9, Arts. 78-91), a civil-liability venue for GDPR Article 79/82 claims at the sad okregowy (Rozdzial 10, Arts. 92-100), a two-track administrative-fine regime distinguishing public-finance-sector bodies from other controllers (Rozdzial 11, Arts. 101-106), and its own criminal offenses for unlawful processing and for obstructing a UODO inspection (Arts. 107-108).

A transfer of personal data outside the EEA requires an adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation, backed by the Article 83(5) top fine tier. Reading the Act's operative chapters (Rozdzialy 1-11) end to end found no Poland-specific derogation from this framework.

General Data Protection Regulation (GDPR) Articles 12-23 govern access, rectification, erasure, restriction, portability, objection, and Article 22 automated-decision rights, exercisable against the controller.

Poland's Act adds the enforcement forum: a GDPR Article 79 or Article 82 claim is heard by the sad okregowy, UODO must be notified of any such filing and final judgment (Art. 94), proceedings are stayed if UODO has an open matter on the same violation (Art. 95), and a final UODO decision or court ruling finding a violation binds a later damages court on that finding (Art. 97).

UODO is Poland's supervisory authority. The Act creates a distinct two-track fine structure: Article 101 lets UODO fine any controller other than a public-finance-sector unit, research institute, or the National Bank of Poland under ordinary General Data Protection Regulation (GDPR) Article 83 terms, while Article 102 caps fines for those three categories at 100,000 or 10,000 PLN.

GDPR Article 82 arms an individual with a direct private right of action, and Article 98 gives UODO its own standing to bring or join a data subject's civil claim, with that person's consent, at any procedural stage.

Article 267 criminalizes obtaining unauthorized access to information not intended for the accessor by opening a sealed letter, connecting to a telecommunications network, or bypassing or circumventing an electronic, magnetic, IT, or other special safeguard protecting it, and separately criminalizes unauthorized access to the whole or part of an IT system, planting or using an eavesdropping, visual, or other device or software to obtain information, and disclosing information obtained that way.

Article 268 and 268a criminalize destroying, damaging, deleting, or altering a record of significant information or IT data, or hindering a person's or a system's ability to use it. Article 269 raises the penalty where the IT data affects national defense, communications security, or government or local-government functioning.

Article 269a criminalizes materially disrupting an IT system's or network's operation through unauthorized transmission, destruction, deletion, damage, hindrance, or alteration of data.

Article 269b criminalizes producing, obtaining, selling, or making available a device or computer program adapted to commit the offenses in Articles 165(1)(4), 267(1) to (3), 268a, 269, 269a, 270, or 270a, or a password, access code, or other data enabling unauthorized access to an IT system or network, with an exemption at Article 269b(1a) for a person acting solely to secure a system or to develop a securing method.

Article 26(2), added by the Act of 26 July 2024 transposing the EU Digital Single Market Copyright Directive, lets a cultural-heritage institution or a body covered by Article 7(1)(1), (2), or (4) to (8) of the Law on Higher Education and Science reproduce a work to text-and-data-mine it for scientific research, without a rightsholder opt-out, so long as the activity is not carried out for direct or indirect financial gain; the reproductions may be retained only under access controls limited to authorized persons, and the rightsholder may apply only the measures necessary to keep the network or database where they are stored secure.

Article 26(3) lets anyone reproduce a disseminated work for text-and-data-mining, unless the rightsholder has reserved that use. A reservation must be express, and for a work made publicly available so that anyone can access it at a place and time of their choosing, it must be in a machine-readable format together with metadata. Reproductions made under Article 26(3) may be retained only as long as necessary for the mining purpose.

A database's producer, the person bearing the investment risk of making it, holds an exclusive and transferable right to extract or reuse the whole or a substantial part, by quality or quantity, of its contents, running 15 years from the year the database was made, or from the year it was first made available to the public if that happens within the initial term, restarting on any subsequent substantial new investment.

A lawful user may extract or reuse an insubstantial part for any purpose without the producer's permission, but Article 8(2) separately bars repeated and systematic extraction or reuse, of even an insubstantial part, that conflicts with the database's normal exploitation or unreasonably prejudices the producer's legitimate interests, and a contract term contrary to the lawful user's Article 7 rights is void.

On infringement, the producer may seek an injunction, removal of the infringement's effects, damages on general principles or as a statutory multiple, restitution of profits, and a court order for publication of the judgment.

Article 8 requires an essential entity or an important entity to implement an information security management system in the information system used in the processes affecting its provision of the service, covering fourteen baseline categories of technical and organisational measure: risk-assessment and information-security policy, secure system acquisition and development, physical and environmental security, personnel security, ICT supply-chain security, business continuity and disaster-recovery planning, continuous monitoring, effectiveness evaluation, cybersecurity training, basic cyber-hygiene, cryptography, secure communications and multi-factor authentication, asset management, and access control, transposing NIS2 Article 21.

Załącznik nr 2 names an online-marketplace provider, an internet search-engine provider and a social-networking-service-platform provider among the digital service providers this duty reaches expressly. The Act entered into force on 3 April 2026, but Article 33(1) of the amending Act gives an entity that already meets the essential-entity or important-entity criteria on that date twelve months, until 3 April 2027, to carry out this duty.

An entity already regulated as an operator usługi kluczowej (essential service operator) under the pre-amendment Act continues applying the prior Article 8 regime until it has deployed the new system.

Article 11 requires an essential entity or an important entity to notify the competent sectoral CSIRT of a significant incident on a graduated clock, transposing NIS2 Article 23. It requires an early warning without delay and no later than 24 hours after detection. It requires a fuller notification within 72 hours of detection, and a periodic report on the CSIRT's request. It requires a final report no later than one month after the 72-hour notification.

New Article 11(2a) requires the entity to inform affected users of a serious cyber threat and of the preventive measures they can take, and new Article 11(2b) requires informing users of a significant incident that adversely affects the service.

The Act entered into force on 3 April 2026, but Article 33(1) of the amending Act gives an entity that already meets the essential-entity or important-entity criteria on that date twelve months, until 3 April 2027, to carry out this duty; Article 33(4) accelerates that clock to six months, until 3 October 2026, for an entity already regulated as an operator usługi kluczowej (essential service operator) under the pre-amendment Act.

Broadcasting a programme or other transmission that endangers a minor's physical, psychological, or moral development is prohibited, in particular one carrying pornographic content or unjustifiably exposing violence. A programme or other transmission carrying scenes or content that could negatively affect a minor's proper physical, psychological, or moral development, other than the content the outright ban already covers, may be broadcast only between 23:00 and 06:00.

A broadcaster must classify and label such a programme or transmission with an appropriate graphic symbol throughout its television broadcast, indicating that its content could negatively affect a minor's development.

A video-sharing platform provider must create and operate effective technical safeguards, including parental-control systems or other appropriate measures, protecting minors from programmes, user-generated video, or other content that could harm their proper physical, psychological, or moral development, in particular pornographic content or content unjustifiably exposing violence, and must let a platform user classify the programmes, user-generated video, or other content they upload and apply those same technical safeguards to it.

Personal data of minors collected or otherwise generated by a video-sharing platform provider for this child-protection duty may not be processed for commercial purposes such as direct marketing, profiling, or behaviourally targeted advertising, or otherwise used for those purposes in supplying that platform, another video-sharing platform, or a media service.

A press publication's publisher, established in Poland or in an EU or EFTA/EEA state, holds the exclusive right to reproduce the publication for online use and to make it available online, without prejudice to the underlying authors' and other rightsholders' own rights, per Article 99(7). The right does not reach an individual's private, non-commercial use, a hyperlink to the publication, or single words or very short, insignificant extracts of it, per Article 99(7)(3).

The right lasts two years from the calendar year following the publication's first dissemination, per Article 99(8). Authors of works contained in the publication are entitled to 50 percent of the remuneration due to the publisher for exercising the right, paid within 30 days of the publisher's own receipt, per Article 99(9).

Where the publisher and a service provider fail to agree remuneration within three months of an offer to contract, either side may apply to the President of the Office of Electronic Communications for mediation, per Article 99(12).

Article 25 lets the press, radio, and television redistribute, for informational purposes, already-disseminated reports on current events, articles on current political, economic, or religious topics unless expressly reserved against further distribution, current statements and reporters' photographs, short extracts of the reports and articles just named, reviews of disseminated publications and works, and short summaries of disseminated works.

The author is entitled to remuneration for the reproduced articles and reporters' photographs, and the same rules apply to making a work available online in a way that lets anyone access it at a place and time of their own choosing.

Article 29 permits quoting excerpts of disseminated works, and reproducing a disseminated visual, photographic, or other short work in its entirety, within works that form an independent whole, to the extent justified by the purposes of explanation, polemic, critical or scientific analysis, teaching, or the rights of the genre of creativity.