As of January 1, 2014, the requirement of obligatory registration of personal data databases has been abolished. However, according to new wording of Data Protection Law, personal data owners are obliged to notify the Ombudsman about personal data processing which is of particular risk to the rights and freedoms of personal data subjects within 30 working days from commencement of such processing. Pursuant to the Notification Procedure, the following types of personal data processing requires obligatory notification to the Ombudsman:

• Racial, ethnic, national origin;
• Political, religious ideological beliefs;
• Participation in political parties and / or organizations, trade unions, religious organizations or civic organization of ideological direction;
• State of health;
• Sexual life;
• Biometric data;
• Genetic data;
• Criminal or administrative liability;
• Application of measures as part of pre-trial investigation;
• Any investigative procedures relating to an individual;
• Acts of certain types of violence used against an individual;
• Location and / or route of an individual.

The Notification Procedure envisages that the application for notification shall contain, inter alia the following information:

• Information about the owner of personal data;
• Information about the processor(s) of personal data;
• Information on the composition of personal data being processed;
• The purpose of personal data processing;
• Category(ies) of individuals whose personal data are being processed;
• Information on third parties to whom the personal data are transferred;
• Information on cross-border transfers of personal data;
• Information on the place (address) of processing of personal data;
• General description of technical and organizational measures taken by personal data owner in order to maintain the security of personal data.

Where any of information listed above is submitted to the Ombudsman and has changed, the owner of the personal data shall notify the Ombudsman on such changes within 10 days from the occurrence of such change.

Additionally, the Notification Procedure requires the owners of personal data to notify the Ombudsman regarding the termination of personal data processing which is of particular risk to the rights and freedoms of personal data subjects, within ten days of such termination.

The Notification Procedure requires owners and processors of personal data that process personal data, which is of particular risk to the rights and freedoms of personal data subjects, to notify the Ombudsman on establishing a structural unit or appointing a person (data protection officer) responsible for the organization of work related to the protection of personal data during the processing. Such notification shall be made within 30 days of establishing a structural unit or appointing a responsible person.

Information regarding the said notifications of the Ombudsman shall be published on the official website of the Ombudsman.