What Is GDPR + Act of 10 May 2018 on the Protection of Personal Data?
Poland's Act of 10 May 2018 on the Protection of Personal Data implements the EU GDPR domestically and entered into force 25 May 2018. The current official consolidated text is dated 18 August 2026 and reflects amendments published in 2026, including a cybersecurity amendment (3 April 2026), a Data Governance Act implementation (23 July 2026), and an AI systems Act (11 August 2026, with a newly added Article 59a deferred to 28 October 2026) — the Act is amended, not in force in its original 2018 form, and provision-level effective dates matter. The Act's Polish-specific exceptions each disapply a different, non-identical subset of GDPR articles: a press/literary/artistic-expression carve-out disapplies most rights articles, but notably not Article 17 erasure; a narrower academic-expression carve-out disapplies only specified articles; separate public-task transparency/access, inter-agency-transfer, national-security/special-service, and presidential-processing provisions each disapply their own enumerated subset. No general "public-register processing" exemption from the six core rights was found — any public-register outcome depends on the specific register's own statute plus GDPR Articles 17(3), 23, 86, and 89.
At a glance
- Full name
- GDPR + Act of 10 May 2018 on the Protection of Personal Data
- Short code
- Poland GDPR + UODO Act
- Jurisdiction
- Poland
- Enacted
- 2018
- Last major update
- Consolidated text dated 18 August 2026 reflects amendments through Dz.U. 2026 poz. 252, 548, and 1003 (cybersecurity, Data Governance Act implementation, and AI systems Act, with a new Article 59a deferred to 28 October 2026)
- Regulator
- President of the Personal Data Protection Office (UODO)
- Private right of action
- Yes
Scope, who Poland GDPR + UODO Act covers
Protected data
Data subject rights
Access (GDPR Art. 15): confirmation of processing and generally a copy
Rectification (GDPR Art. 16): correction of inaccurate or incomplete data
Erasure (GDPR Art. 17): without undue delay where a ground applies, subject to Art. 17(3) exceptions
Restriction (GDPR Art. 18): four listed circumstances
Objection (GDPR Art. 21): situational objection, with an absolute right for direct marketing
Portability (GDPR Art. 20): consent- or contract-based automated processing only
Complaint to the President of UODO
Notable features
Poland's Article 63 lets the President of UODO require a Polish translation of foreign-language documentation submitted by a party, at that party's own cost — this is a conditional "may require" rule, not a blanket "everything must be in Polish" requirement. A related but distinct EU Data Governance Act regime designates UODO as the competent authority for notified "data intermediation services," but this is a supervisory-notification regime, not a general consumer data-broker deletion right.
Enforcement & penalties
Regulator: President of the Personal Data Protection Office (UODO)
Penalties: GDPR Article 83 structure applies to ordinary obligated entities: up to €10M or 2% of worldwide annual turnover (whichever higher) for the Art. 83(4) category, up to €20M or 4% for the Art. 83(5)-(6) category (which includes data-subject-rights violations). Poland's Act separately excludes public-finance-sector units, research institutes, and the National Bank of Poland from the GDPR fine schedule and instead applies a Polish-specific schedule under GDPR Article 83 conditions: up to PLN 100,000 for the entities listed in Article 102(1), up to PLN 10,000 for the public-finance units listed in Article 102(2). A separate procedural coercive fine of PLN 500-5,000 may apply for specified non-cooperation (e.g., refusing a required Polish translation) — distinct from the substantive GDPR fine schedule.
Private right of action: GDPR Article 82 grants a right to compensation for material or non-material damage. A complaint to UODO can be filed by paper or by a qualifying electronic method; anonymous complaints (lacking name and address) are left without consideration, and UODO states ordinary email is not a valid complaint channel. No single UODO-published universal resolution deadline was found; the Polish Act applies the Code of Administrative Procedure's general one/two-month deadlines (extendable, with an inaction-complaint remedy) to UODO proceedings, and GDPR Article 78(2)'s three-month figure triggers a judicial remedy rather than guaranteeing a final decision by that date.
Relevance to data brokers
No dedicated Polish consumer data-broker deletion or opt-out route has been located in official legislative and UODO sources. The general route is to identify the controller, submit an Article 15-21 request directly, then complain to UODO if the controller refuses, fails to respond, or responds inadequately. Poland's official PESEL-number reservation service is a fraud-prevention mechanism whose statute expressly provides that reservation-register data are not deleted — it is not an opt-out from the PESEL register or a general public-record deletion process.
Generate requests in under 60 seconds
Explore 1,034 US/global data brokers
FAQ
Who enforces GDPR in Poland?+
The President of the Personal Data Protection Office (UODO, Urząd Ochrony Danych Osobowych), which handles complaints, investigates, and can impose administrative fines under GDPR Article 83 and the Polish Act's provisions.
How do I file a complaint with UODO?+
By paper complaint at the UODO office or by post, or electronically via UODO's e-Delivery address using a qualified electronic signature, trusted signature, personal signature, or equivalent authentication required by the electronic-submission rules. A written complaint needs your name and address, the respondent's identifying details, a detailed description of the violation, the requested action, and a signature; anonymous complaints without a name and address are left without consideration, and UODO states ordinary email is not a valid channel.
Do I have to submit my complaint in Polish?+
The President of UODO may require a Polish translation of foreign-language documentation submitted by a party, at that party's own cost — this is a conditional power, not an absolute rule that every complaint must be filed in Polish.
Official sources & citations
Other international privacy regimes
Poland GDPR + UODO Act sits in a global ecosystem of data-protection laws. Start with these comparative frameworks, or visit the privacy research hub for the complete jurisdiction index: