Polish Company Fined for Ignoring GDPR Information Obligations and Regulator Communications
A Polish company was fined nearly €6,700 after failing to fulfill its GDPR Article 14 obligations to inform data subjects about how their personal data is processed, and then compounding the violation by repeatedly ignoring communications from the supervisory authority (UODO) for nearly a year. GDPR Article 14 requires organizations to proactively provide transparency information to individuals whose data was obtained from third parties — a duty that cannot simply be overlooked. The refusal or inability to engage with regulatory correspondence suggests a fundamental lack of internal accountability and GDPR governance. This case illustrates that non-compliance penalties can compound when organizations fail to respond to enforcement actions, turning a manageable compliance gap into a sustained regulatory violation.
Tactical Insight
Immediate actions
- Designate a named responsible person (e.g., DPO or compliance officer) to monitor and respond to all regulatory correspondence within defined SLAs.
- Audit all data processing activities to identify where personal data is obtained from third parties and ensure Article 13/14 notices are in place.
Long-term improvements
- Establish a formal GDPR compliance programme that includes regular reviews of data subject information obligations and templated Article 14 notices.
- Implement a regulatory communications log to track, escalate, and respond to all supervisory authority inquiries without delay.
- Train staff and management on the legal consequences of ignoring regulatory decisions, including escalating fines and enforcement actions.
Detection & Governance measures
- Schedule periodic internal audits to verify that data subject rights obligations (Articles 13–15) are being actively fulfilled across all processing activities.
- Create an escalation procedure that triggers executive-level attention whenever a communication from a data protection authority is received.