Poland

Territorial scope comes from Article 3 of Regulation (EU) 2016/679 and the representative duty from Article 27. The Polish overlay is the Act of 10 May 2018 on the protection of personal data. Article 8 of that Act simply refers back to Article 37 of the Regulation for when an officer is required. Article 9 defines the Polish public bodies that must always appoint one: public finance sector units, research institutes, and the National Bank of Poland. Article 10(1) creates the filing duty and Article 10(2) allows it to be made by an attorney with an electronic power of attorney.

Sector by sector, as checked on 18 August 2026. FINANCE (banking, payments, insurance, securities): the financial supervisor's cloud notice of 23 January 2020 recommends processing in data centres located in European Economic Area states, and says operators of critical infrastructure and providers of key services should in the first instance use data centres located on the territory of Poland. Processing outside the Area is possible where the supervised firm assesses and accepts the risk. Rated data can leave with the right paperwork. GOVERNMENT AND CLASSIFIED: the state runs its own cloud service at chmura.gov.pl; classified information sits under a separate accreditation regime and is in practice closed. We could not open an operative text for either, so no rule is asserted. HEALTH, TELECOM, GEOSPATIAL, GAMBLING, EDUCATION, DEFENCE: no localisation rule found on an official Polish domain, checked 18 August 2026, confidence medium. We specifically could not verify the telecoms retention regime or any territorial condition attached to it, and that is flagged as unconfirmed rather than reported as absent.

Chapter V of Regulation (EU) 2016/679 governs. The 2021 Standard Contractual Clauses (Decision (EU) 2021/914) remain the operative set and are unamended; the promised additional clauses for importers already directly caught by the Regulation are still not adopted as at 18 August 2026. Binding corporate rules remain available. The narrow exceptions in Article 49 are not usable for routine or bulk flows. A transfer impact assessment is still expected after Schrems II. The European Data Protection Board's Guidelines 02/2024 confirm that an order from a non-European authority is not by itself a lawful basis to hand data over. The European Union–United States Data Privacy Framework is in force and legally valid today but under pressure: the Latombe case was dismissed by the General Court on 3 September 2025 and is on appeal to the Court of Justice, and on 31 July 2026 the European Data Protection Board formally asked the Commission to examine whether recent United States developments affect the decision's validity. It has not been suspended. Do not build a single-mechanism architecture on it.

Evidence of operation, not just existence: the decisions portal at orzeczenia.uodo.gov.pl carried decisions with 2026 publication dates including DKE.561.1.2026 and DKE.561.4.2026 (failure to cooperate with the supervisory authority, and unlawful video surveillance) and DKN.5131.5.2025 published 27 July 2026. The office is also opening own-initiative inspections: on 13 August 2026 it announced an inspection of the company MyDr. Rated active rather than aggressive because the published Polish fines remain modest by European standards and the office still leads with guidance.

The ceiling is the storage limitation principle in Article 5(1)(e) of Regulation (EU) 2016/679, backed by the erasure right in Article 17. The floors sit in the Accounting Act, the Tax Ordinance, the Labour Code and the Act on patients' rights; the Ministry of Finance publishes the accounting rules and the Ministry of Health the medical documentation rules, but neither operative provision could be opened from a government domain on 18 August 2026 (the official statute database at isap.sejm.gov.pl and the official gazette at dziennikustaw.gov.pl both refuse automated access). Two Polish-specific points worth confirming before you build to them: whether accounting books may be held outside Poland at all and what notification that requires, and the long retention attached to medical documentation. Both are listed as unconfirmed.

The 72-hour clock is Article 33 of Regulation (EU) 2016/679 and runs from becoming aware, not from confirming. The Polish cyber clock comes from the amended Act on the national cyber security system, which entered into force on 3 April 2026 and implements the European network and information security directive; the underlying European rules set a first alert within 24 hours and a fuller notification within 72 hours, but we could not open the Polish article text to confirm the Polish wording, so treat the Polish hours as unconfirmed. Financial entities also sit under the European digital operational resilience regulation, which has applied since 17 January 2025.

The officer filing duty is Article 10 of the Act of 10 May 2018 and can be made through an attorney holding an electronic power of attorney. The mandatory-appointment list is Article 9: public finance sector units, research institutes, and the National Bank of Poland. The data management fines are in Articles 29 to 31 of the Act of 27 March 2026, which also gives the privacy regulator a new job supervising data intermediation services and data altruism organisations. The financial supervisor's 14-day pre-notification applies to processing legally protected information in public or hybrid cloud and to critical cloud outsourcing. A sixth trap to watch, which we could not verify from a government source, is Poland's approach to criminal liability for unlawful processing — the 2018 Act is widely reported to create criminal offences as well as administrative fines, and that is flagged as unconfirmed.

Dormant switches, meaning powers already held that could change the picture without new legislation. First, the Commission can suspend or amend an adequacy decision; the European Data Protection Board formally asked it on 31 July 2026 to examine the United States decision, and the Latombe appeal is pending before the Court of Justice. Second, the Polish financial supervisor's cloud position is a communication, not a statute, so it can be tightened or replaced without any parliamentary process — the current text has stood since 23 January 2020. Third, the Minister of Digital Affairs sets the cyber registration timetable by communication, as it did on 8 April 2026, and can extend the register's reach the same way. Fourth, the free flow rules for non-personal data allow a member state to impose localisation on public-security grounds, which Poland has not used but retains. Proposed European measures — the Cloud and Artificial Intelligence Development Act of 3 June 2026 and the Digital Omnibus of 19 November 2025 — have no legal effect and should not be planned around as binding.