Enforcement in Poland
EU regulation
In 2021, the Polish DPA issued seventeen administrative fines. Most of them were connected with a failure of an entity to provide information to or cooperate with the Polish DPA , as well as not having sufficient technical and organisational measures to ensure information security.
The biggest fine of 2021 was imposed on a company that provides comprehensive, integrated media and telecommunications services. Its infringement consisted in the failure to implement appropriate technical and organisational measures to ensure the security of personal data processed in cooperation with a courier service provider. The large number of data breaches involved the loss of correspondence with personal data or the delivery of correspondence to the wrong recipient. The company’s data controller reported the breaches to the supervisory authority and notified the affected individuals two or even three months after they occurred. The company was fined EUR 245,000.
Another fine was issued on 14 October 2021. The Polish DPA had become aware of a data protection breach following a complaint against a bank. It turned out that correspondence sent by the bank through a courier service containing personal data (e.g. first name, surname, PESEL number, home address, account numbers and identification numbers of customers) had been lost. The bank had failed to report the incident to the Polish DPA and provide adequate notice to the data subjects and was fined EUR 78,000.
Another decision was issued against an insurance company for failing to report a personal data breach to the Polish DPA and failing to notify the data subject of the breach. The breach was caused by an employee of a financial intermediary sending an insurance needs analysis and an insurance offer, including data such as first name, surname, PESEL number, city, postal code and information on the subject of the insurance, by e-mail to the wrong recipient. The fine was EUR 35,300.
Another fine resulting from a failure to report a personal data breach to the Polish DPA was imposed on a generator, distributor and retailer of electricity. The breach involved sending an email with an unencrypted, non-password-protected attachment containing the personal data of several hundred people. The sender of the email was an associate of the company, which was fined EUR 30,000.
The last of the major fines imposed in 2021 concerned the National School of Judiciary and Public Prosecution, whose data controller failed to implement sufficient technical and organisational measures related to its training platform website. During a test migration to a new platform, the data of more than 50,000 individuals had been exposed on the Internet. The Polish DPA imposed a fine of EUR 22,200.
Poland regulation
Each year, the Polish DPA releases an annual activity report demonstrating a clear shift in recent years towards more intensive enforcement, closer monitoring of data breaches, and stronger engagement with data subjects’ rights.
The year 2022 was particularly noteworthy, as it marked a reversal of the downward trend in the total value of fines. At that time, a record penalty of EUR 1,000,000 was imposed on an electricity and gas trading company supplying both business and household customers. The company not only failed to implement appropriate technical and organisational measures but also did not adequately verify its data processor. As unauthorised individuals gained access to and extracted customer data, the Polish DPA held both the controller and the processor responsible for a breach affecting more than 100,000 individuals over the course of five days. Consequently, the processor was also fined EUR 53,000.
A significant decision concerned a telecom operator that sent a contract to an incorrect email address and failed to report the resulting personal data breach to the Polish DPA within the required 24-hour deadline. The company appealed the decision, arguing that the delayed notification of the personal data breach was caused by unintentional mistakes made by staff responsible for sending correspondence. The Polish DPA rejected this explanation, and the Regional Administrative Court ("WSA") agreed, stating that employee mistakes cannot justify missing the deadline and instead indicate poor internal procedures. WSA upheld the fine as proportionate and serving both punitive and preventive purposes.
In 2023, the Polish DPA imposed a fine of EUR 24 000 on insurance company for failing to report a data breach within the required 72-hour timeframe. The breach involved an unauthorized recipient receiving an email with sensitive personal data, including names, addresses, and insurance details. Despite being aware of the incident, the company did not notify the supervisory authority, leading to the fine. The decision highlights the importance of timely reporting and proper risk assessment to protect individuals' data rights.
In 2024, the Polish DPA imposed an administrative fine of EUR 326 000 on the bank for failing to report a personal data protection breach. The Polish DPA found out about the personal data protection breach at the Bank from the media. It involved the publicising of bank documents contained in a parcel abandoned on one of the housing estates, after it had previously been stolen from a courier company. The Polish DPA emphasized that the risk assessment of an individual's rights or freedoms should be viewed from the perspective of the person at risk, rather than the Controller's interests. Failing to report a data breach to both the affected individuals and the Polish DPA hinders an appropriate response and risk evaluation, potentially leading to serious consequences for the data subjects. The Bank appealed the decision to the WSA, which overturned the decision on the grounds that the time limit for imposing it had expired. The Polish DPA has filed a cassation complaint with the Supreme Administrative Court ("NSA"). Before the cassation appeal is examined, the Polish DPA has asked the NSA to consider submitting a preliminary reference to the Court of Justice of the European Union ("CJEU"). Referring the matter to the CJEU would help ensure a uniform interpretation of EU law and clarify its relationship with national administrative law, while also considering how the GDPR is applied across other Member States.
In 2024, the Polish DPA imposed a monetary penalty on an entity whose employee lost a memory stick. The memory stick contained partially encrypted personal data of another controller employee. The lost external data carrier contained unencrypted files with the employee's personal data in terms of name, home address, nationality, gender, date of birth, PESEL number, passport series and number, telephone number, email address, photograph (image) and salary details. In addition, the data medium also contained encrypted financial data files. It was found that the company failed to apply appropriate technical and organisational measures to protect personal data, which violated the principles of integrity, confidentiality and accountability. The controller was fined EUR 56,000.
In 2025, the total value of fines imposed by the Polish Data Protection Authority increased significantly. A major contribution to this rise came from the record EUR 6,412,896 fine imposed on a state owned postal operator, along with an additional EUR 23,751 fine for the Minister of Digital Affairs, for the unlawful disclosure of personal data from the PESEL national identification register, in connection with preparations for postal voting.
Another high‑profile decision concerned a global fast-food chain which received a fine of EUR 4,021,754. The infringements included outsourcing data processing without conducting a risk assessment, failing to implement adequate security measures, and failing to comply with the terms of the data processing agreement, which ultimately resulted in employees’ data being exposed in a publicly accessible repository.
A further substantial fine of EUR 4,374,165 was imposed on one of the banks for scanning customers’ identity documents without a proper assessment of necessity, leading to excessive data processing in violation of the principle of data minimisation.
An interesting judgment from 2025 is the ruling of the NSA (case no. III OSK 1101/24), which held that publishing personal data on closed social media groups (such as Facebook) cannot be considered a purely personal activity exempt from the GDPR, particularly where the user is not the administrator of the group.
