Last review date: 12 January 2026
Please note that this chapter focuses solely on specific local laws and regulations. Please refer to the EU chapter of the Global Data & Cyber Handbook for detailed information on EU-wide data privacy and other data-related legislation applicable across all EU Member States, such as the EU GDPR and the EU AI Act.
- Act of 10 May 2018 on Personal Data Protection
- Act of 14 December 2018 on the Protection of Personal Data Processed in Connection with the Prevention and Combating of Crime
- Act of 21 February 2019 amending certain laws to ensure the application of the EU General Data Protection Regulation (Aligning Act)
Last review date: 12 January 2026
Please note that this chapter focuses solely on specific local laws and regulations. Please refer to the EU chapter of the Global Data & Cyber Handbook for detailed information on EU-wide cybersecurity and other data-related legislation applicable across all EU Member States, including the Cybersecurity Act, DORA, and the NIS 2 Directive.
- Act of 5 July 2018 on the National Cybersecurity System (implementing NIS Directive)
- This Act is under legislative procedure to update it in accordance with the NIS 2 Directive and is likely to be finalized in 2026.
- Act of 16 July 2014 on Telecommunication Law replaced by Act of 12 July 2024 on Electronic Communications Law (implementing European Electronic Communications Code)
- Regulation of the Council of Ministers of 11 September 2018, on the list of key services and the thresholds for the materiality of the disruptive effect of an incident on the provision of key services
- Regulation of the Council of Ministers of 31 October 2018 on the thresholds for considering an incident as serious
- Regulation of the Council of Ministers of 16 October 2018 on types of cybersecurity documentation for the information system used to provide a key service
- Regulation of the Minister of Digital Affairs of 12 October 2018 on the list of certificates authorizing audits
- Regulation of the Council of Ministers of 2 October 2018 on the scope of activities and procedures of the College for Cyber Security Affairs
- Regulation of the Minister of Digital Affairs of 4 December 2019 on organizational and technical conditions for entities providing cyber security services and internal organizational structures of key service operators responsible for cyber security
- Regulation of the Minister of Digital Affairs of 20 September, 2018 on a model form for transmitting information on a breach of security or integrity of telecommunications networks or services that has had a significant impact on the operation of networks or services
- Regulation of the Minister of Digital Affairs of 20 September 2018 on the criteria for recognizing a breach of security or integrity of telecommunications networks or services as a breach with a significant impact on the operation of networks or services
The legislative process to implement Directive (EU) 2022/2555 ("NIS 2") into the Polish legal system has been initiated; however, as of December 2025, the draft legislation remains under parliamentary deliberation. Its adoption is anticipated in the first quarter of 2026.
Last review date: 12 January 2026
Please note that this chapter focuses solely on specific local laws and regulations. Please refer to the EU chapter of the Global Data & Cyber Handbook for detailed information on EU-wide legislation related to non-personal data, also applicable in all EU Member States, such as the Regulation on the free flow of personal data, the Data Governance Act, the Data Act, etc.
- Poland has not yet adopted a local law designating the competent authority or setting out penalty mechanisms required under the Data Act. Although preliminary legislative proceedings have commenced, they remain at an early stage as of the day of submitting this Handbook update.
- Act of 11 August 2021 on open data and reuse of public sector information
- Act of 6 September 2001 on access to public information