Go to Wolters Kluwer VitalLaw.comGo to Wolters Kluwer VitalLaw.com
VitalLaw®
  • Find answers to your questions
  • Log in to access your subscriptions
In depth. On point.
In depth. On point.
  • Home
  • Legal Directory
  • Home
  • Legal Directory
In depth. On point.
  • Articles
    • Articles
  • Organizations
    • Organizations
    • Bill to Update HIPAA Cyber Rules Clears Senate Committee
    • Congressional report examines challenges of regulating bank-fintech partnerships
    • Cyber Command Nominee Lacks Necessary Experience, Wyden Says
    • DHS’s Use of Subpoenas to Investigate Online Critics Threatens Privacy, House Democrats Say
    • District Judge: IRS Unlawfully Shared 42,695 Taxpayer Addresses With ICE
    • Info Collected for Age-Verification Not Covered Under COPPA, FTC Says
    • Legislation to Prohibit Sale of Internet Browsing History Advances in Hawaii
    • Poland Fines Courier Company Over GDPR Failures
    • Recognition of Chinese Test Lab’s FCC Accreditation Withdrawn
    • South Dakota House Advances Data-Portability Bill
  • Articles
    • Articles
  • Organizations
    • Organizations

    Cybersecurity Policy Report, Poland Fines Courier Company Over GDPR Failures, (Feb 26, 2026)

    By R. Jason Howard, J.D.

    The Polish data protection authority, Urzad Ochrony Danych Osobowych (UODO), has announced that it imposed an administrative fine of 11 million złoty ($3.1 million) against DPD Polska over violations of the European Union’s General Data Protec ...

    By R. Jason Howard, J.D.

    The Polish data protection authority, Urzad Ochrony Danych Osobowych (UODO), has announced that it imposed an administrative fine of 11 million złoty ($3.1 million) against DPD Polska over violations of the European Union’s General Data Protection Regulation (GDPR).

    The fine comes after an inspection at DPD Polska’s headquarters that focused on the personal data processed in connection with courier delivery services, UODO said in a news release.

    The investigation revealed that in the process of delivering parcels, the DPD processed “first names, last names, e-mail address, telephone number, addresses (shipping, delivery, redirection of the parcel), bank account number (in the case of cash on delivery), company name, parcel number and the handwritten signature of the sender and the addressee,” UODO noted.

    DP failed to get data processing agreements from its carriers, but the company argued this was unnecessary because the “subject of the agreement was the transport operation, which, in the company's opinion, did not involve the processing of personal data.” UODO disagreed and found that by not having data processing agreements, the company violated article 28(3) of the GDPR.

    News: InternationalLegislation DataPrivacy GDPR LitigationEnforcement

    © 2026 CCH Incorporated and its affiliates and licensors. All rights reserved.

    • Manage Cookie Preferences
    • Privacy Statement
    • Terms of Use