ProductsModulesPricingBlogAbout PL Log in See demo
GDPR Compliance

GDPR Fines. How much, for what, and how to avoid them.

The Polish DPA (UODO) has shifted enforcement: fewer decisions, higher fines. By 2025 the total sum of sanctions exceeded 64 million PLN. The maximum is 20 million EUR or 4% of worldwide turnover. Below: the largest fines, the most common causes, and a concrete plan to stay off that list.

Scale

Largest fines issued by the Polish DPA (UODO)

  • 27 mln PLNPoczta Polska ; Failure to implement remedial measures after a confirmed breach
  • 18.4 mln PLNING Bank Slaski ; Security failures and improper handling of data subject rights
  • 16.9 mln PLNMcDonald's Polska ; Deficiencies in data management and processing grounds
  • up to 20 mln EURStatutory maximum ; or 4% of total annual worldwide turnover, whichever is higher

Amounts based on UODO decisions and public disclosures 2024-2026.

Causes

What the Polish DPA (UODO) most often penalises

Lack of technical safeguards

No encryption, lost laptop or storage device, ransomware attack without backups.

Processing without a legal basis

Data collected or used without a valid ground under Art. 6 GDPR.

Unhandled data subject rights

Failure to respond to access, rectification, or erasure requests within the deadline.

Late breach notification

72-hour deadline to notify the Polish DPA (UODO) missed or notification absent entirely.

Outdated documentation

Missing Record of Processing Activities (RoPA) or DPIA for high-risk processes.

Lack of cooperation with the Polish DPA (UODO)

Obstructing inspections, incomplete responses, no accountability evidence.

Plan

How to avoid a fine and pass an inspection

STEP 01

Complete and up-to-date RoPA

Record of Processing Activities (Art. 30) that reflects actual processes, systems, and data categories. This is the first thing the Polish DPA (UODO) checks.

STEP 02

DPIA for high-risk processes

Data Protection Impact Assessment (Art. 35) wherever required by WP248 and the UODO catalogue. Documented decision and residual risk.

STEP 03

72h breach response

Timer from the moment of discovery, impact assessment, export of the notification for the Polish DPA (UODO). The decision not to notify must also be documented.

STEP 04

Regular audits and accountability

Evidence that controls work in practice: versioning, roles, change log. Accountability is the foundation of any defence against a fine.

All of these elements ; RoPA, DPIA, 72h timer, accountability ; RealSec maintains in one module. See the Iodynka (GDPR) module.

FAQ

Frequently asked questions about GDPR fines

Up to 20 million EUR or up to 4% of total annual worldwide turnover, whichever is higher. The Polish DPA (UODO) sets the amount based on severity, duration, intent, and cooperation.
The highest fines issued by the Polish DPA (UODO) run into the tens of millions of Polish zloty, including penalties for Poczta Polska, ING Bank Slaski, and McDonald's Polska. By 2025 the total sum of UODO fines exceeded 64 million PLN.
Lack of technical safeguards (encryption, backups), processing without a legal basis, unhandled data subject rights, and breach notification after the 72-hour deadline.
Keep an up-to-date RoPA and DPIA, have a breach response procedure with a 72h timer, run regular internal audits, and collect accountability evidence. RealSec tracks deadlines and documentation completeness.
Yes, indirectly. A tool like RealSec keeps documentation current, monitors deadlines (72h, DSR), and surfaces gaps before an inspection does, directly addressing the most common causes of sanctions.

Find your gaps before the Polish DPA (UODO) does.

30-minute demo on real data: RoPA, DPIA, 72h breach timer, and audit-ready export.

Book a demo → See the GDPR module