UODO fines in 2026 – key decisions and GDPR violations

In 2026 the President of the Polish Personal Data Protection Office (UODO, the Polish GDPR supervisory authority) has issued a series of decisions; the fines in the cases summarised below total close to PLN 7 million. The largest, almost PLN 5.9 million, was imposed on a delivery platform that required users to upload scans of their ID cards. The remaining decisions concern a State-owned company, local government bodies, an accounting firm, a direct-sales network and a private individual. Most of these decisions are not yet final and may be challenged before the administrative court (Poczta Polska has announced an appeal).

Below we summarise the rulings you should know about if you process customer, employee or contractor data in Poland.

UODO in 2026: key fines and decisions

• Glovo, almost PLN 5.9 million (DKN.5112.33.2022): Restaurant Partner Polska, the company operating the delivery platform in Poland, required users to upload scans of their ID cards for anti-fraud purposes. UODO found no legal basis for this and a breach of the data minimisation principle, and ordered the scans to be erased.
• Poczta Polska (Polish Post), approx. PLN 978,000 (DKN.5131.4.2025): the Data Protection Officer also held a managerial security role and the company could not document any conflict-of-interest analysis.
• Municipal social welfare centre, PLN 33,700 in total (DKN.5131.27.2023): a list of residents in COVID-19 quarantine ended up on an employee’s private server and was indexed by a search engine; the centre neither notified UODO nor informed the individuals.
• District governor of Lubartów and the regional land-surveying office (DKN.5131.5.2025): theft of an unencrypted laptop holding data of around 700 people, including national ID numbers; both the controller (PLN 21,000) and the processor (PLN 12,500) were fined.
• Private CCTV, PLN 26,711 (DKE.561.4.2026): the first UODO fine relating to private CCTV, imposed on a private individual for ignoring a final order to stop recording neighbours and a public road.
• Smaller fines for typical mistakes: an accounting firm after an employee’s mailbox was taken over (PLN 11,594, DKN.5131.34.2023), a sub-agent in the Energa-Obrót sales network whose representatives sent contract scans via WhatsApp on private phones (PLN 10,145, DKN.5131.7.2022; Energa-Obrót itself, as controller, and the other processors received reprimands), and the mayor of Myślenice for failing to notify a breach after an unredacted petition containing the data of 749 people was published in the public information bulletin (BIP) (PLN 7,700, DKN.5131.17.2025).
• Reprimands without a fine went, among others, to a specialist hospital and its e-mail hosting provider after a mailbox with patient data was compromised (DKN.5131.12.2022), a physician who ignored UODO requests (DKE.561.1.2026) and a local authority that disclosed a citizen’s data to a business (DS.523.2582.2024).

What UODO’s 2026 decisions mean for businesses

This year’s rulings fall into several clear enforcement lines:

• Data minimisation in KYC and anti-fraud processes. UODO confirmed that copying identity documents is permitted only for entities expressly authorised by law, such as obliged institutions under the Polish AML Act. Fraud prevention does not justify collecting ID scans by other businesses.
• Genuine DPO independence. Appointing a manager as DPO without a documented conflict-of-interest analysis can cost close to PLN 1 million.
• Risk analysis as a process, not a document. Mailboxes, laptops and messaging apps on private phones are recurring sources of incidents. The authority expects a documented risk analysis, encryption of portable devices and regular testing of safeguards.
• Liability across the processing chain. Fines are imposed not only on controllers but also on processors, and controllers are held responsible for failing to verify their vendors.
• 72-hour notification and cooperation with the authority. Failure to notify breaches, failure to inform individuals and ignoring UODO requests or orders are consistently sanctioned, including against private individuals.

Who is affected by the UODO’s decisions and penalties for GDPR violations?

Practically every organisation processing personal data in Poland, in particular: financial institutions and FinTechs running KYC and anti-fraud procedures, online platforms and e-commerce businesses, companies working through agent networks or subcontractors, accounting and law firms, healthcare providers, and companies that have appointed a DPO from within their existing management structure.

Personal data protection – what should you check to avoid a fine from the UODO?

• whether your onboarding and identity verification processes collect copies of documents without an explicit legal basis,
• whether your DPO combines the role with tasks he or she is supposed to monitor, and whether the conflict-of-interest analysis is documented,
• whether your risk analysis covers e-mail, portable devices and remote work, and whether its results are reviewed periodically,
• whether your data processing agreements are backed by actual verification of processors, including agents and sub-agents,
• whether your breach response procedure allows you to meet the 72-hour deadline and provides for informing the individuals concerned.

GDPR violations – what penalties and consequences could a company face?

Fines of up to EUR 20 million or 4 per cent of annual worldwide turnover, orders to stop processing and erase data, and, where an order is not complied with, a further set of proceedings and a separate fine. Fines on public sector bodies are capped by Polish law at PLN 100,000, which explains the lower amounts in the local government cases. Add to this the risk of compensation claims from data subjects and reputational costs: UODO publishes its decisions together with a description of the facts.

Personal data protection – check whether your company is ready for an audit

Most of the cases above started with something that looked minor: an ID scan requested in a sign-up form, a laptop without encryption, a group chat on a messaging app, or a DPO who also happens to run another department. This is exactly the kind of thing we help companies tidy up. We look at what data your KYC and anti-fraud processes actually need, check whether your DPO set-up would pass the independence test, review your processors and subcontractors, and, if an incident does happen, handle the notification to UODO and the proceedings that may follow. We do this regularly for UK, US and other foreign businesses operating in Poland. If any of the scenarios above sounds familiar, it is worth talking to us before the regulator does.

Would you like to check whether your organization’sorganisation’s data protection procedures meet current requirements? Check out our guide on the GDPR and personal data breaches, or contact us to discuss a specific area of risk. To stay up to date on legal and regulatory changes in Poland, sign up for our newsletter.