Cybersecurity Policy Report, Polish DPA Outlines GDPR Obligations in FAQ Summary, (Sep 8, 2025)

By Tony Foley

The Polish data protection authority, Urzad Ochrony Danych Osobowych (UODO), has provided guidance on a number of topics on which it received questions from multiple stakeholders through the agency’s public hotline.

The guidance, published in a news release Friday, is presented in a frequently asked questions format. Among the topics covered are the following:

• The legal grounds for processing students’ personal data through video surveillance in a public school, including a discussion of required markings of monitored areas;

• The authority of police to check a person’s identity card while performing official duties;

• The responsibility of an individual acting as a data controller to notify a personal data breach to a local supervisory authority under Article 33 of the EU General Data Protection Regulation (GDPR), in particular in an instance where the individual loses a phone containing such data while abroad;

• The right of data subjects to receive a copy of personal data processed by a controller; and

• The applicability of GDPR requirements to “video door spyholes,” i.e., video door monitors that have a video recording and archiving function.

News: InternationalLegislation DataPrivacy DataSecurity DataBreach GDPR