EdLaw
Poland — Ustawa o ochronie danych osobowych (UODO)
The Act of 10 May 2018 that operationalises the GDPR in Poland: it establishes the Prezes Urzędu Ochrony Danych Osobowych (PUODO) as the supervisory authority, sets national procedure, and caps administrative fines for public-sector bodies. Poland is the second-largest market by our subscriber base (1,883 active subscriptions — ranking basis under Open work in the repository README).
Fact text is Polish (authentic language); this README is curation.
Applicability to EdTech
- Digital-consent age stays at the GDPR default of 16: the act contains no provision lowering the Art. 8(1) GDPR age for information-society services (checked mechanically against the full consolidated text, 2026-09-06 — no derogation exists). Parental consent is therefore required for under-16s in Poland where consent is the basis.
- PUODO is the one-stop supervisor: competent authority for data protection and supervisory authority under the GDPR (art. 34); since 2026 also the competent authority for data-intermediation services and data altruism under the EU Data Governance Act (art. 34 ust. 2a, added by the Act of 27 March 2026 on data management).
- Fines are asymmetric between schools and vendors: public-finance-sector units listed in art. 9 pkt 1–12 and 14 of the public-finance act — which include local-government budget units, the usual legal form of Polish public schools — face administrative fines capped at 100 000 PLN (art. 102 ust. 1); cultural institutions at 10 000 PLN (art. 102 ust. 2). A private vendor gets the full Art. 83 GDPR scale — the cap protects the school, not the supplier.
- Scope: the act applies within the material scope of Arts. 2–3 GDPR (art. 1); press, literary, artistic and academic expression enjoy carve-outs from listed GDPR provisions (art. 2).
Contents
| Document | Covers |
|---|---|
| USTAWA.md | UODO art. 1, 2, 34 (incl. the 2026 ust. 2a), 102 |
Scope note: the act's remaining chapters (DPO notification, certification/accreditation, inspections, civil and criminal liability) are procedure for the authority and controllers generally — add specific articles when a Poland deployment question needs them. School-sector data rules live in the education acts (Prawo oświatowe, SIO act), curated separately.
Key obligations at a glance
- GDPR applies directly; UODO adds the authority, procedure and public-sector fine caps.
- Under-16 consent needs parental authority (GDPR Art. 8(1) default, not derogated).
- PUODO enforcement against public schools is capped at 100 000 PLN; vendors face full GDPR fines.
Enforcement
Prezes Urzędu Ochrony Danych Osobowych (PUODO), appointed by the Sejm with Senate consent for a four-year term (art. 34 ust. 3–7).
Licence
The corpus reproduces selected articles of the ustawa o ochronie danych osobowych from the tekst jednolity in Dziennik Ustaw, with one later amendment integrated from the amending act, served by the Sejm ELI API.
Polish copyright law places normative acts and official materials outside copyright. Art. 4 ustawy o prawie autorskim i prawach pokrewnych (ISAP — tekst jednolity Dz.U. 2025 poz. 24, read 2026-10-01 in the official PDF served by the Sejm ELI API) provides: "Nie stanowią przedmiotu prawa autorskiego: 1) akty normatywne lub ich urzędowe projekty; 2) urzędowe dokumenty, materiały, znaki i symbole;"
Conditions: none attach to the statute text, because no copyright subsists in it. The corpus still identifies its source: each fact document names its source in its opening citation line and in its Meta section, and Sources here links the official text (ISAP and the Sejm ELI API). The changes (the selection of provisions, the Markdown layout and the added anchors) are described in Meta. The corpus does not claim that the publisher endorses it, and only the officially promulgated text is authentic.