Last review date: 10 January 2025

Yes.

The potential legal bases for data processing in the employment context are:

Under Article 22(1) of the Polish Labor Code, an employer shall request the following categories of data from a job candidate:

• first name(s) and last name;
• date of birth;
• contact information provided by the candidate;
• education;
• personal qualifications; and
• details of previous employment

The last three categories should be requested only if necessary to perform work of a specific kind or for certain job positions. Once the employee is hired, the employer should ask for the following additional data:

• address of residence;
• national ID number ("PESEL") or, if the candidate does not have a PESEL, type and number of an identity document;
• other personal data of the employee, as well as personal data of the employee's dependents, if necessary to exercise special legal rights;
• education and employment history, if there were no grounds to request this data from the candidate; and
• bank account number, if the employee did not file a request for remuneration to be paid in cash 

The above means that employers should use a "legal obligation" justification laid down in Art. 6(1)(c) of the GDPR as a legal ground for processing the above categories of personal data in the employment context.

Notwithstanding the above-mentioned provisions of the Polish Labor Code, employers in Poland may rely on all legal bases available under the GDPR, including data subject's consent. It must be however noted that employer's ability to rely on employee's consent is limited, as explained further in the next section.

Last review date: 10 January 2025

☒        Yes, but this consent is typically more difficult to establish in an employment context (specify details below)

Pursuant to recital 43, "consent should not provide a valid legal ground for the processing of personal data in a specific case where there is a clear imbalance between the data subject and the controller", which could be the case in the employment relationship.

Pursuant to an amendment to the Polish Labor Code, which entered into force on 4 May 2019, refusal to grant a consent or its withdrawal by a candidate or an employee may not result in their unfavorable treatment or adverse consequences of any kind. In particular, the denial of consent may not constitute a ground for refusal of employment or termination of the employment contract by the employer.

Moreover, consent may be used as a legal basis for processing of employees' or candidates' sensitive personal data only where such data have been provided to the employer on their own initiative. Otherwise, consent may be declared invalid. Moreover, consent may not constitute a legal basis for the processing of an employee's criminal background data, per Article 10 of GDPR.

Please refer to the EU Chapter for detailed information regarding EU-wide guidance. 

☒         No

No guidance on this specific issue has been produced at a national level.