GDPR for crowdfunding service providers in Poland – data protection under the ECSPR

Last updated: 15.09.2026

Regulation (EU) 2020/1503 of the European Parliament and of the Council (ECSPR) sets the EU framework for crowdfunding services. It applies to crowdfunding offers of up to EUR 5 million, calculated over a 12-month period for a given project owner. The ECSPR contains only limited provisions on personal data. Recital 73 makes clear that personal data processed under the ECSPR remains subject to the GDPR. This means that the ECSPR does not replace the GDPR or create a separate privacy regime: crowdfunding service providers must comply with both sets of rules at the same time.

These requirements are particularly relevant for crowdfunding service providers, applicants seeking ECSP authorisation, members of their management bodies, and legal, compliance and data protection teams responsible for operating crowdfunding platforms. Data protection obligations arise at several core stages of the business: assessing prospective investors and their financial situation, evaluating the credit risk of project owners who may be natural persons, publishing certain financial information about identifiable individuals, and collecting personal data during the authorisation process.

The main compliance questions therefore concern what personal data may be collected, the legal basis for processing, how long the data may be retained, when profiling and automated decision-making rules apply, and what information may be disclosed publicly. These issues affect both the authorisation process and the day-to-day operation of a crowdfunding platform.

Crowdfunding service providers in Poland and GDPR – key obligations

Crowdfunding business models – data protection for investors and project owners

A crowdfunding platform is a two-sided market, so the GDPR compliance analysis has to be carried out twice. On the investor side, the platform collects identification data at account opening and then, by operation of law, information on experience, investment objectives, financial situation and basic understanding of risk.

Project owners and personal financial data

On the project owner side, it collects business and financial data. Although a project owner may be a natural or legal person, those data become personal data whenever the owner is a sole trader or the assessment reaches identified individuals, such as guarantors or beneficial owners.

The boundary with consumer credit matters here. The ECSPR covers crowdfunding for business. Where a platform matches lenders with consumers seeking finance, it steps outside the ECSPR and into the consumer credit regime: CCD2 expressly covers providers of crowdfunding credit services, and where such a provider grants credit to consumers directly, the provisions applicable to creditors apply to it. Platforms running a mixed model need two separate compliance systems, and the data protection analysis differs in each. We discussed the consumer side in detail in our guide on the GDPR and CCD2.

Investor protection: knowledge tests, loss simulation and investment risks

As an investor protection measure, Article 21 ECSPR requires an assessment of whether, and which, crowdfunding services offered are appropriate for prospective non-sophisticated investors, on the basis of information about their experience, investment objectives, financial situation and basic understanding of the investment risks involved. The assessment is subject to periodic review, and non-sophisticated investors must be able to simulate their ability to bear loss. From a GDPR standpoint, one thing matters: the platform gathers and analyses data on a specific person’s financial situation by operation of law.

From the GDPR perspective this is profiling of a natural person’s economic situation, mandated by directly applicable Union law. That has a useful consequence: the ECSPR, as a regulation, creates a legal obligation in its own right, so the basis for processing within the appropriateness assessment is Article 6(1)(c) GDPR. The reverse consequence is that this basis reaches no further than the obligation itself.

Using knowledge test answers or net worth data for marketing segmentation, that is, dividing clients into groups in order to target tailored offers at them, is a separate purpose which the legal obligation basis does not cover and which is also hard to defend on legitimate interests. The person provided that information in order to receive appropriate risk warnings, not in order to receive offers. A practical example: the platform cannot use information about an investor’s high net worth to target them with advertising for offers carrying the highest entry thresholds.

Two practical conclusions follow. The scope of data collected should match, and not exceed, the categories set out in the regulatory technical standards, and the retention period should be tied to the review cycle and to the evidential need to demonstrate compliance, rather than maintained indefinitely as a client profile.

Crowdfunding project scoring and automated decisions under the GDPR

Commission Delegated Regulation (EU) 2024/358 supplements the ECSPR with technical standards on the credit scoring of projects, the pricing of offers and risk management. It specifies the information and factors to be taken into account in the credit risk assessment, requires assessment decisions to be documented and that documentation to be kept for at least five years from repayment of the final instalment, and then adds a provision rarely seen in financial market law: personal data within the meaning of Article 4(1) GDPR are to be stored for no longer than five years from repayment of the final instalment of the loan.

This is a maximum retention period, not a minimum. It is hard to reconcile with anti-money laundering (AML) legislation, which imposes a minimum period, so it forces the credit documentation set to be separated from the customer due diligence documentation instead of running a single archive. It also transforms retention from a matter of internal policy into a supervised regulatory requirement: a platform holding scoring data beyond that period exposes itself to challenge from both UODO and the KNF.

Automated decisions and Article 22 GDPR

Scoring itself raises the question of automated decisions. In Case C-634/21 SCHUFA Holding (Scoring), the Court of Justice held that the automated establishment of a probability value concerning a person’s ability to meet payment commitments constitutes an automated decision within the meaning of Article 22(1) GDPR where a third party relies on it to a significant degree. Where a platform assesses a project owner who is a natural person, and the result determines admission of the project to an offer or the price of funding, that reasoning transfers directly.

For example: where the system automatically rejects a sole trader’s project because the scoring result is too low, that is an automated decision concerning that person. The safeguards of Article 22(3) GDPR – human intervention, the ability to express one’s point of view and to contest the decision – must then exist for project owners as well, not only for consumers.

The right to an explanation of a scoring decision

In Case C-203/22 Dun & Bradstreet Austria, the Court added that meaningful information about the logic involved means the procedure and principles actually applied, and that invoking trade secrets does not permit an outright refusal: the material must be provided to the supervisory authority or the court so that the competing interests can be balanced. This means, in turn, that an assessed project owner can effectively demand an explanation of how their result was arrived at, and the platform cannot close that conversation simply by invoking the confidentiality of the model.

Alongside the GDPR explanation duty there is a second disclosure obligation, addressed to a different audience. Where the provider applies credit scoring to projects or suggests the pricing of crowdfunding offers, the ECSPR requires publication of a description of the method used. That obligation runs towards investors, in the interest of market transparency, whereas the GDPR explanation duty runs towards the person whose creditworthiness is being assessed. They differ in addressee and in content, and a methodology page written for investors will rarely, by itself, satisfy Article 15(1)(h) GDPR.

In brief:

• description of the scoring method (ECSPR) – published to investors at large, in the interest of market transparency;
• explanation of the decision (Article 15(1)(h) GDPR) – addressed individually to the person whose creditworthiness is assessed.

Where, by contrast, the provider carries out individual portfolio management of loans under Article 6 ECSPR, Delegated Regulation (EU) 2022/2118 requires a documented method for assessing credit risk and allocating investors’ funds, which means that automated decisions are also taken in respect of investors.

Good repute and personal data in the ECSP authorisation process

The authorisation application is, in data protection terms, the most sensitive processing a platform will undertake. Under Article 12 ECSPR and the technical standards on authorisation, the applicant must provide evidence of the good repute and of the knowledge, skills and experience of the members of the management body, including information on the absence of a criminal record, on the absence of an insolvency history, and declarations concerning holdings and connected persons.

The European Data Protection Supervisor analysed precisely this material in his formal comments of 30 May 2022 on the draft technical standards under the ECSPR. He recommended that the information collected as evidence of good repute be listed exhaustively, and expressly recommended deleting an open-ended, catch-all item. He also recommended narrowing the item on dismissal from employment so that it refers to positions and tasks involving the management of funds or similar fiduciary relationships, and, in the standards on cooperation between competent authorities, deleting the words “inter alia” from the description of reputational information. The message for applicants is unambiguous: the categories set out in the standards form a closed catalogue, and an application that gathers more is not more compliant, but less.

In practical terms, data on criminal convictions fall under Article 10 GDPR and national law governing who may process them and how they may be obtained. Board members’ CVs, declarations concerning family members and shareholding structures should be collected on a defined template, kept on a schedule that distinguishes an effective appointment from an unsuccessful candidacy, and covered by access controls that do not simply replicate the platform’s general document workflow.

For an investor planning to obtain authorisation, this means that:

• questionnaires for members of governing bodies should be drawn up strictly in line with the catalogue in the technical standards, with no open-ended items;
• criminal record information requires a separate, restricted procedure;
• documentation on unsuccessful candidates is deleted sooner than the files of appointed members of governing bodies;
• access to the application documentation should be limited to a narrow circle of people.

Key investment information sheet (KIIS), personal data and marketing

The ECSPR requires the key investment information sheet (KIIS) to describe the project and the project owner, and Article 27 requires marketing communications relating to crowdfunding offers to be fair, clear and not misleading, and consistent with the sheet.

Where the project owner is an identifiable natural person, the platform publishes that person’s financial situation on a public website. The content of the sheet required by law has a clear basis in a legal obligation, whereas everything beyond it does not. Photographs, personal narratives, family circumstances and biographical detail are added for marketing reasons and require their own legal basis and their own minimisation analysis.

Bulletin boards and investor data

The bulletin board operated under Article 25 ECSPR extends the same question to secondary trading, where information about holdings may identify individual investors. The marketing layer is additionally subject to parallel financial supervision: under Article 24 of the Polish Crowdfunding Act, the KNF may, by decision, order the suspension of, or prohibit, marketing communications that infringe Article 27 ECSPR.

Information notices for investors and project owners

The information obligations of Articles 13 and 14 GDPR deserve particular attention here. Project owners often learn only at the moment of publication how widely their information will travel, and investors are rarely told that their appropriateness assessment answers are retained for the whole review cycle. Both notices should be written for the platform’s actual architecture, not adapted from a generic e-commerce template.

For an investor operating a platform, this means that:

• information notices must be written separately for investors and for project owners;
• a project owner should know before publication which of their data will be disclosed, and where;
• marketing content going beyond the sheet requires a separate basis, most often consent, which can be withdrawn.

European crowdfunding service providers – records, secrecy and cross-border obligations

Article 26 ECSPR requires all records relating to services and transactions to be kept for at least five years, a retention floor operating alongside the ceiling laid down in the standards on scoring. For a provider active in several Member States of the European Union, it matters that supervisory authorities and the European Securities and Markets Authority (ESMA) exchange information about providers and their management – board members’ data therefore circulate more widely than the application filed in Poland alone would suggest.

The Polish Crowdfunding Act adds a third, separate retention period. Under its Article 13, a provider that has ceased business archives the related documentation on a durable medium for five years, counted from the first day of the year following the year in which business ceased; the storage may be provided by a third party, which under the GDPR will be a processor requiring an Article 28 agreement, and the KNF retains the right to enter and inspect the documentation. Failure to archive is penalised under Article 42 of the Act.

An archive kept after business has ended may include data for which the ceiling under Delegated Regulation (EU) 2024/358 has already passed, so the archiving schedule must be designed together with the schedule for deleting scoring data.

A separate scenario is provided for in Article 22(4)–(6) of the Act: after an authorisation lapses or is withdrawn, the KNF may order the transfer of rights and obligations under the agreements to another provider, with the consent of the transferee and the clients, together with the handover of documents, and where no transfer takes place the outgoing provider designates a custodian of the documents. This is a change of controller, which triggers the information obligations of Articles 13 and 14 GDPR towards investors and project owners.

In brief – three parallel retention periods:

• credit risk assessment data – no more than five years from repayment of the final instalment;
• records of services and transactions – at least five years;
• archiving of documentation after cessation of business – five years from the start of the year following cessation.

Professional secrecy and GDPR in Poland

In parallel with the GDPR, the Polish legislature has imposed a professional secrecy regime on providers (Articles 4–12 of the Act); it is a confidentiality requirement, not a separate basis for processing data. Article 5 requires technical and organisational arrangements protecting the secrecy and the drawing up and implementation of internal rules on the protection of information flows, that is, a separate document alongside the Article 32 GDPR measures.

Article 7 contains a closed catalogue of authorities entitled to demand disclosure, including the President of UODO to the extent necessary for the performance of his statutory tasks, and Article 11 allows providers to exchange among themselves information about receivables owed by unreliable clients; this is a statutory basis for disclosure which does not dispense with the provider’s own GDPR analysis of the legal basis, minimisation and the information obligation towards the debtor.

Breach of the secrecy carries a fine of up to PLN 1,000,000 or imprisonment for up to 3 years, or both (Article 41), which, alongside the powers of UODO and the KNF, creates a third layer of enforcement. In summary: a provider may disclose information covered by the secrecy only to the authorities in the closed catalogue and to other providers in respect of receivables owed by unreliable clients, and every such disclosure requires a parallel check of the legal basis and the information obligation under the GDPR.

Data breaches, ICT incidents and DORA

Crowdfunding service providers are financial entities within the meaning of DORA, so a single incident can trigger the ICT incident reporting regime alongside the personal data breach notification obligation of Article 33 GDPR, on different timelines and to different addressees. Our guide to personal data breach obligations shows how to reconcile those regimes in a single internal process.

GDPR checklist for crowdfunding platforms in Poland

• Describe the two groups of data subjects separately, with separate entries in the record of processing activities for investors and for project owners.
• Base the appropriateness assessment and loss simulation on Article 6(1)(c) GDPR and limit the categories collected to those set out in the technical standards.
• Block secondary use of knowledge test data and net worth data for marketing segmentation.
• Carry out a DPIA wherever project owners who are natural persons are assessed, and provide them with the Article 22(3) GDPR safeguards.
• Separate the credit assessment archive from AML documentation and observe the five-year maximum period counted from repayment of the final instalment under Delegated Regulation (EU) 2024/358.
• Distinguish the scoring methodology disclosure addressed to investors from the explanation owed to the data subject under Article 15(1)(h) GDPR.
• Build the authorisation file on the closed catalogue of good-repute categories, with a separate retention and access regime.
• Review the key investment information sheet and marketing materials for personal data going beyond the content required by law.
• Integrate DORA incident reporting with GDPR breach notification in a single procedure.
• Implement internal rules on the protection of information flows covered by professional secrecy and synchronise them with the data protection policy and with the schedule for archiving documentation after cessation of business.

Practical example: GDPR compliance in ECSP authorisation in Poland

A platform preparing an authorisation application in Poland had assembled its board members’ documentation on the basis of open-ended questionnaires covering employment history unrelated to the management of funds, and documentation concerning relatives that no technical standard required. Separately, the draft offer pages featured photographs and personal narratives of project owners who were sole traders, alongside their financial data, and the scoring model generated the decision on admitting an offer with no route for the project owner to contest it.

As part of our support, the questionnaires were rebuilt to match the closed catalogue in the technical standards, the published content was limited to the elements required in the sheet, and a documented route for the project owner to contest the assessment was added. As a result, the risks were removed without delaying the authorisation proceedings.

How we support crowdfunding service providers in Poland?

If you are applying for authorisation as a crowdfunding service provider in Poland or operating a platform in several Member States, our team will build the data protection layer into the application, reconcile the retention regimes arising from the ECSPR, the delegated acts and AML legislation, and defend your scoring and disclosure architecture before the KNF and UODO.

We support platform operators in the following areas:

• ECSP authorisation proceedings before the KNF – we prepare the data protection part of the application and the documentation for members of governing bodies;
• data protection architecture for platforms – we draw up the record of processing activities, map the legal bases for investors and project owners, prepare retention schedules and draft the internal rules on the protection of information flows;
• DPIAs and Article 22 GDPR safeguards for the scoring of project owners who are natural persons and for individual portfolio management of loans;
• review of key investment information sheets, offer pages, the bulletin board and marketing communications for excessive disclosure of personal data;
• vendor and outsourcing agreements, including DORA-compliant ICT contracts, and international transfer mechanisms;
• incident and breach response – reporting under DORA, notifications to UODO and communications with investors;
• delineation of the ECSPR and CCD2 regimes where a platform serves both businesses and consumers.

FAQ – GDPR and crowdfunding service providers in Poland