Poland Data Protection Act

Ustawa z dnia 10 maja 2018 r. o ochronie danych osobowych — Sejm of the Republic of Poland

Also known as: ustawa o ochronie danych osobowych, UODO Act, Dz.U. 2018 poz. 1000, Poland Act 10 2018, Polish Personal Data Protection Act

Official site Official change log Subscribe to Poland Data Protection Act (RSS)

Current version: Act of 10 May 2018 (as last amended by the Act of 3 July 2026 on AI systems); Published 3 July 2026. source
Status: In force
Next deadline: None announced
Who must comply: Protection of natural persons in the processing of personal data within the scope of the GDPR; the act names the public bodies that must appoint a data protection officer and sets national rules on certification, proceedings, fines and liability. source

How it is assessed: Controllers comply themselves; certification by bodies accredited by the Polish Centre for Accreditation is available under the GDPR. source
Authority: An act of the Polish Sejm; the President of the Personal Data Protection Office (UODO) is the supervisory authority under the GDPR and the law-enforcement directive. source
Enforced by: The UODO President fines under GDPR Article 83, with caps for public sector bodies, and unlawful processing is a crime punishable by up to two or three years' imprisonment. source
Last change: None recorded yet

Poland's national data protection statute, enacted to apply the EU General Data Protection Regulation in Polish law. It establishes the President of the Personal Data Protection Office (UODO) as the supervisory authority, and sets out national rules on certification, supervision proceedings, administrative fines, remedies and criminal liability for unlawful processing of personal data.

Recent changes

No changes recorded yet — we are watching, and nothing has been published.

Key dates

No upcoming dates

Show 1 earlier date

2018-05-25 The Act on the protection of personal data enters into force

Amendments

2026-07-03
Act of 10 May 2018 (as last amended by the Act of 3 July 2026 on AI systems) AmendmentCurrent text

Article 123 of the Act on artificial intelligence systems adds Article 59a: the UODO President cooperates with the Commission for the Development and Security of Artificial Intelligence; the change applies from 28 October 2026. source
2026-03-27
Amended by the Act of 27 March 2026 on data governance Amendment
Article 38 adds Article 34(2a): the UODO President becomes the competent authority for data intermediation services, registration of data altruism organisations and some non-personal data transfer duties under the Data Governance Act. source
More
- In force from 23 July 2026, three months after promulgation.
2026-01-23
Amended by the Act of 23 January 2026 (national cybersecurity system) Amendment

Article 16 rewrites Article 104: half of the fines for GDPR security breaches (Articles 5(1)(f), 25, 28(3)(c) and 32) go to the Cybersecurity Fund instead of the state budget; in force from 3 April 2026. source
2019-02-21
Amended by the Act of 21 February 2019 Amendment

Act amending various laws to ensure application of the GDPR, in force from 4 May 2019; it added the duty to provide data needed to calculate a fine (Article 101a). source
2018-05-10
Act of 10 May 2018 on the protection of personal data Major version

Published as Dz.U. 2018 poz. 1000 on 24 May 2018 and in force from 25 May 2018; it repealed, with some exceptions, the Act of 29 August 1997 on the protection of personal data. source

Who it applies to

The act applies to processing within the GDPR's scope and adds Polish rules, chiefly on data protection officers in public bodies, certification, proceedings and sanctions.

Scope: It applies to the protection of natural persons with regard to processing of personal data within the scope of Articles 2 and 3 of the GDPR (Article 1(1)). source
What it adds: It names the public entities that must appoint a data protection officer, and regulates accreditation of certification bodies by the Polish Centre for Accreditation and of code-of-conduct monitoring bodies (Article 1(2)). source

How compliance is assessed

Controllers comply themselves; certification by bodies accredited by the Polish Centre for Accreditation is available under the GDPR.

Certification: Certification bodies in data protection are accredited by the Polish Centre for Accreditation under the conditions the act sets (Article 1(2)(2)). source

Enforcement and penalties

The UODO President fines under GDPR Article 83, with caps for public sector bodies, and unlawful processing is a crime punishable by up to two or three years' imprisonment.

Up to PLN 100,000

Maximum fine for public finance sector units (Article 9(1)-(12) and (14) of the Public Finance Act), research institutes and the National Bank of Poland (Article 102(1)). source

Up to PLN 10,000

Maximum fine for public finance sector units under Article 9(13) of the Public Finance Act (Article 102(2)). source

Up to 3 years' imprisonment

Unlawful processing of special category data such as health, genetic, biometric or political opinion data; up to two years for other unlawful processing (Article 107). source

Up to 2 years' imprisonment

Obstructing a data protection inspection, or withholding the data needed to calculate a fine (Article 108). source

Who enforces: The President of the Personal Data Protection Office is the competent authority and the GDPR supervisory authority (Article 34(1)-(2)). source
Private sector fines: Entities other than public finance sector units, research institutes and the National Bank of Poland can be fined under and on the terms of GDPR Article 83 (Article 101). source

Documents

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to Poland Data Protection Act (RSS)

At a glance