UODO (Poland) - DKE.561.3.2026

Summary

Poland's Personal Data Protection Office (UODO) has fined a limited liability company PLN 29,112 (approximately €6,700) for failing to comply with a previous decision. The company was ordered to fulfill its information obligations under GDPR Articles 14(1) and 14(2) but repeatedly failed to respond to UODO's communications, including letters and requests for financial statements. The violation persisted for nearly a year, impacting one data subject.

Full text

Help UODO (Poland) - DKE.561.3.2026: Difference between revisions From GDPRhub Jump to:navigation, search Newer edit →VisualWikitext Revision as of 13:00, 6 October 2026 view source Av (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators209 edits Tag: Decisions [1.0]Newer edit → (No difference) Revision as of 13:00, 6 October 2026 UODO - DKE.561.3.2026 Authority: UODO (Poland) Jurisdiction: Poland Relevant Law: Article 14(1) GDPR Article 14(2) GDPR Article 58(2)(c) GDPR Type: Investigation Outcome: Violation Found Started: Decided: 18.08.2026 Published: 30.09.2026 Fine: 29112.0 PLN Parties: n/a National Case Number/Name: DKE.561.3.2026 European Case Law Identifier: n/a Appeal: n/a Original Language(s): Polish Original Source: UODO (in PL) Initial Contributor: av The DPA fined a limited liability company PLN 29,112 (€6,700) for a failure to comply with a decision ordering the controller to fulfil its information obligations under Articles 14(1) and 14(2) GDPR. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts The DPA issued a decision in the case DKE.560.206.2025 ordering a limited liability company (the controller) to fulfil its information obligations under Articles 14(1) and 14(2) GDPR in June 2025. The DPA sent the controller this decision by letter in June and July 2025. Both times, the letters were returned to the sender. The DPA sent the controller a letter requesting it to provide evidence of compliance with the order set fort in the decision in September 2025. Following a phone call in October, a copy of the decision and a reminder to reply to the previous request were sent to the email address of the controller's CEO. In November 2025, the DPA sent the company a warning stating it would initiate proceedings with the possibility of imposing an administrative fine on the controller. The DPA initiated enforcement proceedings against the controller in March 2026. It requested the company to submit financial statements in May 2026. These letters also remained unanswered. Holding The DPA issued the controller a fine of PLN 29,112 (€6,700) for a failure to comply with an order issued by the DPA pursuant to Article 58(2)(c) GDPR. The company had not responded to any of the letters addressed to it in the initial complaint proceedings or the subsequent proceedings. In particular, it had failed to provide evidence of compliance with the order to fulfil its information obligations under Articles 14(1) and 14(2) GDPR. When determining the amount of the fine, the DPA took into account that the violation had been of significant gravity – failure to comply with the DPA order indicated that the data subject remained in a state of uncertainty regarding the ground and scope of the processing of their personal data. The violation had also persisted for nearly a year. On the other hand, the DPA considered it to be a mitigating factor that the violation only concerned one data subject. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the Polish original. Please refer to the Polish original for more details. Warsaw, August 18, 2026 not final Decision DKE.561.3.2026 Pursuant to Article 104 § 1 of the Act of June 14, 1960—Code of Administrative Procedure¤[1] (hereinafter referred to as: “k.p.a.”) in conjunction with Article 7(1) and (2), Article 60, and Article 101 of the Act of May 10, 2018, on data protection[2] (hereinafter referred to as the “PDPA”), as well as pursuant to Article 57(1)(a) and (h), Article 58(2)(i), Article 83(1)-(2), Article 83(6) in conjunction with Article 58(2)(c) of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter referred to as: “Regulation 2016/679”[3], following an ex officio administrative proceeding concerning the imposition of an administrative fine on X. sp. z o.o., with its registered office in B. at (…), the President of the Personal Data Protection Office, having found that X. sp. z o.o., with its registered office in B. at ul. (…), failed to comply with the order contained in the administrative decision of the President of the Personal Data Protection Office dated June 25, 2025, ref. no. DS.523.2420.2024.(…), imposes on X. sp. z o.o., with its registered office in B. at (…) Street, an administrative fine in the amount of 29,112 PLN (in words: twenty-nine thousand one hundred twelve zlotys). Statement of Reasons I. Facts of the Case. 1. On June 25, 2025, the President of the Personal Data Protection Office (hereinafter referred to as the “President of the Personal Data Protection Office” or the “supervisory authority”) issued an administrative decision, ref. no. DS.523.2420.2024.(…) (hereinafter also referred to as the “Decision”), in which—acting pursuant to Article 58(2)(c) of Regulation 2016/679—he ordered X, Ltd., with its registered office in B. at (…) (hereinafter referred to as the “Company”) to fulfill, with respect to Ms. T. S., residing in B. at (…) (hereinafter also referred to as the “Complainant”), the information obligation arising from Article 14(1) and (2) of Regulation 2016/679. This decision, addressed to the Company’s registered office address as disclosed in the National Court Register (hereinafter also referred to as “KRS”), i.e., ul. (…), (…)-(…) B.—after two notices of delivery on June 30, 2025, and July 8, 2025—was returned to the Office for Personal Data Protection (hereinafter also referred to as “UODO”) with the annotation: “RETURN: Not accepted within the deadline.” Pursuant to the provisions of Article 44, § 1 and 4 of the Code of Administrative Procedure, in conjunction with Article 45 of the Code of Administrative Procedure, it was deemed to have been served on the Company as of July 14, 2025. 2. The purpose of the verification is to determine whether the Company had fulfilled the obligation imposed by the decision, by letter dated September 16, 2025, Ref. No.: DKE.560.206.2025.(…), the Company was requested to provide explanations and evidence of compliance with the order set forth in the decision. This request was served on the Company at its current registered office address as disclosed in the National Court Register (KRS), i.e., ul. (…), (…)-(…) B., on September 18, 2025. 3. Following a telephone call initiated on October 29, 2025, by an employee of the Company, a copy of the decision was sent on the same day to the email address of the Company’s CEO, as provided by that employee. The email again called on the Company to submit a response to the request dated September 16, 2025. 4. By letter dated November 24, 2025, ref. no.: DKE.560.206.2025.(…), the President of the Personal Data Protection Office (UODO) issued a warning to the Company pursuant to Art. 15 § 1 of the Act of June 17, 1966, on Administrative Enforcement Proceedings[4], calling for compliance with the order set forth in the decision under threat of referring the matter to enforcement proceedings. The warning was also sent to the Company’s current registered office address as disclosed in the National Court Register (KRS) and was served on the Company on November 26, 2025. The 7-day-day deadline for complying with the order set forth in the decision expired without result on December 3, 2025. The Company, despite proper service of the letter, did not respond to the reminder from the President of the UODO and did not provide evidence of compliance with the decision. 5. The complainant contacted an employee of the UODO’s Department of Penalties and Enforcement by phone on several occasions, informing them that the Company had fa

Entities