Poland

Where the law applies comes from Article 3 of Regulation (EU) 2016/679. The duty to name a representative comes from Article 27. The Polish layer on top is the Act of 10 May 2018 on the protection of personal data. Article 8 of that Act refers back to Article 37 of the Regulation for when an officer is required. Article 9 lists the Polish public bodies that must always appoint one: public finance sector units, research institutes, and the National Bank of Poland. Article 10(1) creates the filing duty. Article 10(2) allows the filing to be made by an attorney with an electronic power of attorney.

Here is what we found industry by industry, checked on 18 August 2026. FINANCE (banking, payments, insurance, securities): the financial supervisor's cloud notice of 23 January 2020 recommends keeping data in data centres located in European Economic Area states. It says operators of critical infrastructure and providers of key services should use data centres located in Poland in the first instance. Using data centres outside the Area is possible where the supervised firm assesses and accepts the risk. Rated data can leave only if conditions are met GOVERNMENT AND CLASSIFIED: the state runs its own cloud service at chmura.gov.pl. Classified information sits under a separate accreditation system and is closed. We could not open a binding text for either, so we state no rule. HEALTH, TELECOM, GEOSPATIAL, GAMBLING, EDUCATION, DEFENCE: we found no rule about keeping data in the country on an official Polish website, checked 18 August 2026, confidence medium. We could not confirm the telecoms record-keeping rules, or any territorial condition attached to them. We flag that as unconfirmed rather than reporting it as absent.

Chapter V of Regulation (EU) 2016/679 governs this. The 2021 Standard Contractual Clauses, Decision (EU) 2021/914, remain the set in force and are unchanged. The promised extra clauses, for recipients already directly caught by the Regulation, are still not adopted as at 18 August 2026. Binding corporate rules remain available. The narrow exceptions in Article 49 cannot be used for routine or bulk flows. You are still expected to write a transfer impact assessment after Schrems II. The European Data Protection Board's Guidelines 02/2024 confirm that an order from a non-European authority is not by itself a lawful reason to hand data over. The European Union-United States Data Privacy Framework is in force and legally valid today, but it is under pressure. The Latombe case was dismissed by the General Court on 3 September 2025 and is on appeal to the Court of Justice. On 31 July 2026 the European Data Protection Board formally asked the Commission to examine whether recent United States developments affect the decision's validity. It has not been suspended. Do not build on it as your only route.

Here is the evidence that it works, not just that it exists. The decisions portal at orzeczenia.uodo.gov.pl carried decisions with 2026 publication dates. They include DKE.561.1.2026 and DKE.561.4.2026, on failure to cooperate with the supervisory authority and on unlawful video surveillance. They also include DKN.5131.5.2025, published 27 July 2026. The office is also opening inspections on its own initiative. On 13 August 2026 it announced an inspection of the company MyDr. We rate it active rather than aggressive. The published Polish fines are still modest by European standards, and the office still leads with guidance.

The maximum is the storage limit in Article 5(1)(e) of Regulation (EU) 2016/679, backed by the erasure right in Article 17. The minimums sit in the Accounting Act, the Tax Ordinance, the Labour Code and the Act on patients' rights. The Ministry of Finance publishes the accounting rules and the Ministry of Health publishes the medical documentation rules. We could not open either binding text from a government website on 18 August 2026. The official statute database at isap.sejm.gov.pl and the official gazette at dziennikustaw.gov.pl both refuse automated access. Two Polish points are worth confirming before you build to them. One is whether accounting books may be held outside Poland at all, and what notification that requires. The other is the long keeping period attached to medical documentation. Both are listed as unconfirmed.

The 72-hour clock is Article 33 of Regulation (EU) 2016/679. It runs from when you become aware, not from when you confirm. The Polish cyber clock comes from the amended Act on the national cyber security system. That entered into force on 3 April 2026 and implements the European network and information security directive. The underlying European rules set a first alert within 24 hours and a fuller notification within 72 hours. We could not open the Polish article text to confirm the Polish wording, so treat the Polish hours as unconfirmed. Financial firms also sit under the European digital operational resilience regulation, which has applied since 17 January 2025.

The officer filing duty is Article 10 of the Act of 10 May 2018. It can be made through an attorney holding an electronic power of attorney. The list of bodies that must appoint one is Article 9: public finance sector units, research institutes, and the National Bank of Poland. The data management fines are in Articles 29 to 31 of the Act of 27 March 2026. That Act also gives the privacy regulator a new job supervising data intermediation services and data altruism organisations. The financial supervisor's 14-day warning applies where you put legally protected information in public or hybrid cloud, and to critical cloud outsourcing. A sixth trap is worth watching, and we could not confirm it from a government source. Poland's 2018 Act is widely reported to create criminal offences as well as fines. That is flagged as unconfirmed.

These are powers already held that could change things without new legislation. First, the Commission can suspend or change an official decision that a country is safe enough. The European Data Protection Board formally asked it on 31 July 2026 to examine the United States decision, and the Latombe appeal is pending before the Court of Justice. Second, the Polish financial supervisor's cloud position is a communication, not a statute. It can be tightened or replaced with no parliamentary process. The current text has stood since 23 January 2020. Third, the Minister of Digital Affairs sets the cyber registration timetable by communication, as it did on 8 April 2026. It can widen the register's reach the same way. Fourth, the free flow rules for data that is not about people let a member state require data to stay in the country on public-security grounds. Poland has not used that power, but it keeps it. Two proposed European measures have no legal effect. Do not plan around them as binding. They are the Cloud and Artificial Intelligence Development Act of 3 June 2026 and the Digital Omnibus of 19 November 2025.