GDPR Navigator online

To make it easier for you to work with data protection regulations, we link relevant recitals from the preamble (P), provisions of the Personal Data Protection Act (U), and guidelines from the European Data Protection Board (W) alongside individual GDPR articles.

GDPR Navigator online — related texts:

Regulation (EU) 2016/679 (GDPR).
Personal Data Protection Act (PDPA).
EDPB guidelines.

List of contents

Introduction
Map of the practical aspects of the GDPR
List of guidelines of the Article 29 Working Party and the European Data Protection Board
Regulation (EU) 2016/679 of the European Parliament and of the Council

Chapter I. General rules (Art. 1–4)

Article 1 Subject and purpose Article 2 Material scope of use Article 3 Territorial scope of use Article 4 Definitions

Chapter II of the Rules (Art. 5–11)

Article 5 Rules on the processing of personal data Article 6 Conformity of the processing with the law Article 7 Conditions for giving consent Article 8 Conditions for giving consent by a child to information society services Article 9 Processing of specific categories of personal data Article 10 Processing of personal data relating to convictions and prohibited acts Article 11 Processing which does not require identification

Chapter III. Rights of the data subject (Art. 12–23)

Article 12 Transparent information and transparent communication and exercise of rights by data subjects Article 13 Information provided in the event of data collection from the data subject Article 14 Information provided in the event of personal data being obtained in a manner other than from the data subject Article 15 Right of access of data subjects Article 16 Right to rectification of data Article 17. Right to erasure (‘right to be forgotten’)Article 18 Right to restrict processing Article 19 Obligation to notify rectification or deletion of personal data or restriction of processing Article 20 Right to transfer data Article 21 Right to object Article 22 Automated decision-making in individual cases, including profiling Article 23 Restrictions

Chapter IV. Administrator and processor (Art. 24–43)

Article 24 Duties of the administrator Article 25 Inclusion of data protection in the design phase and default data protection Article 26 Co-directors Article 27 Representatives of administrators or processors who do not have an organisational unit in the Union Article 28 Processing entity Article 29 Processing under the authority of the controller or processor Article 30 Registration of the processing activities Article 31 Cooperation with a supervisory authority Article 32 Security of processing Article 33 Reporting of a personal data breach to a supervisory authority Article 34 Notification of a data subject of an infringement of the protection of personal data Article 35 Assessment of data protection effects Article 36 Previous consultations Article 37 Designation of the data protection officer Article 38 Status of data protection officer Article 39 Tasks of the data protection officer Article 40 of the code of conduct Article 41 Monitoring of approved codes of conduct Article 42 Certification Article 43 The certifying entity

Chapter V. Transfer of personal data to third countries or international organisations (Art. 44–50)

Article 44 General principle of transmission Article 45 Transfer on the basis of a decision establishing an appropriate level of protection Article 46 Transfers subject to appropriate safeguards Article 47 Binding corporate rules Article 48 Transfers or disclosures not permitted under Union law Article 49 Exceptions in specific situations Article 50 International cooperation for the protection of personal data

Chapter VI. Independent supervisory authorities (Art. 51–59)

Article 51 Supervisory authority Article 52 Independence of the Union Article 53 General conditions for the members of the supervisory authority Article 54 Rules for the establishment of a supervisory authority Article 55 Competence Article 56 Powers of the lead supervisory authority Article 57 Tasks Article 58 Powers Article 59 Reporting of activities

Chapter VII Cooperation and consistency (Art. 60–76)

Article 60 Cooperation between the lead supervisory authority and the other supervisory authorities concerned Article 61 Mutual assistance Article 62 Joint operations of supervisory authorities Article 63 The consistency mechanism Article 64 Opinion of the European Data Protection Board Article 65 Dispute settlement by the European Data Protection Board Article 66 Emergency mode Article 67 Exchange of information Article 68 European Council for the Protection of Data Article 69 Independence of the Union Article 70 Tasks of the European Data Protection Board Article 71 Reports Article 72 Procedure Article 73 Chairman of the Committee Article 74 Tasks of the Chairman Article 75 Secretariat Article 76 Confidentiality

Chapter VIII Measures of legal protection, liability and sanctions (Art. 77–84)

Article 77 Right to lodge a complaint with a supervisory authority Article 78 Right to an effective remedy before a court against a supervisory authority Article 79 Right to an effective remedy in court against an administrator or processor Article 80 Representation of data subjects Article 81 Suspension of the proceedings Article 82 Right to compensation and liability Article 83 General conditions for imposing administrative fines Article 84 Penalties

Chapter IX. Provisions on special situations related to processing (Art. 85–91)

Article 85 Processing and freedom of expression and information Article 86 Processing and public access to official documents Article 87 Processing of the national identification number Article 88 Processing in the context of employment Article 89 Safeguards and exceptions applicable to processing for archival purposes in the public interest, for scientific or historical research purposes or for statistical purposes Article 90 Obligation to maintain confidentiality Article 91 Existing data protection rules applicable to churches and religious associations

Chapter X. Delegated acts and implementing acts (Art. 92–93)

Article 92. Exercise of the powers conferred Article 93. The committee procedure

Chapter XI Final rules (Art. 94–99)

Article 94 Repeal of Directive 95/46/EC Article 95 Relationship with Directive 2002/58/EC Article 96 Relation to previously concluded agreements Article 97 Report from the Commission Article 98 Review of other Union legal acts relating to data protection Article 99 Entry into force and application

Preamble (recitals 1-173)

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173

Personal Data Protection Act (PDPA)

Chapter I. General rules (Art. 1–7)

Article 1 Scope of the Act Article 2 Restriction of application to press material activities, literary activities, artistic activities and academic expressions Article 3 Changes in the purpose of the processing of personal data in the performance of a public task Exemption from the obligation to provide information Article 4 Direct acquisition of personal data exemption from the information obligation Article 5 Restriction of the right of access to information on the processing of data by the controller Article 5a Exemption from the exercise of the right of access of the data subject Article 6 Exclusion of application of the Act to processing by national security or special services Article 6a Appropriate application of the provisions Article 7 Procedures by the Director of the Office for Personal Data Protection

Chapter II. Appointment of the data protection officer (Art. 8–11)

Article 8 Obligation to appoint a data protection officer Article 9 Public bodies and entities required to appoint an inspector Article 10. Notice to the President of the Office of the appointment of an inspector Article 11 Disclosure of the inspector's data Article 11a Person acting as an inspector

Chapter III: Conditions and procedures for granting accreditation to a certifying entity (Art. 12–14)

Article 12 Accrediting body; rules for accreditation Article 13 Provision of accreditation criteria Article 14 Information on the accreditation granted

Chapter IV. Conditions and procedures for certification (Art. 15–26)

Article 15 Certifying entity; rules for certifying Article 16 Provision of certification criteria Article 17 Application for certification Article 18 Deadline for the examination of an application for certification; failure to recognise the application Article 19 Informing the President of the Authority of the planned completion or planned refusal of certification Article 20 Refusal to certify Article 21 Content of the certificate Article 22 Obligation to fulfil the certification criteria Article 23 Data of the certified entity transmitted to the President of the Authority Article 24 Verification activities for the purpose of assessing compliance with the certification criteria Article 25 Rights of the person carrying out the verification activities Article 26 Fees for certification activities

Chapter V. Developing and approving the Code of Conduct and the terms and conditions of accreditation of the entity monitoring its compliance (Art. 27–33)

Article 27 Rules for drawing up, commenting on and approving the Code of Conduct Referral; consultation Article 28 An entity monitoring compliance with the approved code of conduct Article 29 Application for accreditation to monitor compliance with the approved code of conduct Article 30 Consideration of an application for accreditation Article 31 Certificate of accreditation Article 32 Obligation to meet the accreditation criteria Article 33 List of accredited entities

Chapter VI: President of the Authority (Art. 34–59)

Chapter VII: Procedure for infringement of the rules on the protection of personal data (Art. 60–74)

Article 60 The entity conducting the proceedings Article 61 Participation of the social organisation in the conduct Article 62 Obligations of the President of the Authority in the event of failure to resolve a case within the deadline Article 63. Request for a translation of the documentation into Polish Article 64 Access by the President of the Office to confidential information Article 65 Keeping information as a trade secret Article 66 Restriction of access to case files Article 67. Notification of the parties by public announcement Article 68 Control procedure for the purpose of supplementing evidence Article 69 Penalties for breach of the duty of personal representation Article 70 Temporary restriction on the processing of personal data Article 71 Application for a preliminary ruling on the lawfulness of the European Commission decision on the general application of the code of conduct in the EU Article 72 Indication in the decision of the grounds for imposing an administrative penalty Article 73. Provision in the BIP of information on the decision taken by the President of the Authority Article 74 Suspension of the execution of a decision on an administrative penalty in the event of a complaint to an administrative court

Chapter VIII: European administrative cooperation (Art. 75–77)

Article 75 Temporary restriction on the processing of personal data Article 76 Translation of the President's information into the official language of another Member State Article 77 Arrangements relating to the joint operation

Chapter IX. Control of compliance with the rules on the protection of personal data (Art. 78–91)

Article 78. Control entity; control plan Article 79 Inspecting officer Article 80 Exclusion of the controller from participation in the control Article 81. Authorisation to carry out checks Article 82 Authorization of a person with expertise to participate in control Article 83 The presence of the controlled person or person authorised by him during the control Article 84 Powers of the controller Article 85. Participation of the police in control Article 86 Interrogation of a controlled employee Article 87 Grounds for establishing the factual status Article 88 Inspection protocol Article 89 The duration of the checks Article 90 Obligation to initiate proceedings in respect of infringements of the rules on the protection of personal data Article 91 Rules applicable to controls

Chapter X. Civil Liability and Court Proceedings (Art. 92–100)

Article 92. Scope of the provisions of k.c.Article 93 Jurisdiction of the court Article 94 Exchange of information between the court and the President of the Office Article 95 Suspension of proceedings before the President of the Office Article 96 Improvement of legal proceedings in the event of a decision by the President of the Office Article 97. Connection of the Court by decision of the President of the Office Article 98. Initiation of legal proceedings by the President of the Authority; participation of the President of the Authority in legal proceedings Article 99 Submission by the President of the Office of substantive views in court proceedings Article 100 Application of the provisions of the CCP

Chapter XI. Provisions on administrative fines and penalties (Art. 101–108)

Article 101 Bases and conditions for imposing an administrative penalty Article 101a Obligation to provide data Article 102. Impose an administrative penalty on public finance sector entities, research institutes or NBPs Article 103. Conversion of euro amounts into gold Article 104 Means of administrative penalty as revenue of the State budget Article 105 Deadline for payment of the administrative penalty; postponement of the deadline; breakdown into instalments; relief in the administration of the administrative penalty Article 106 Exemption from the application of the rules on administrative fines Article 107 Illegal processing of personal data Article 108 Obstructing inspections of compliance with data protection rules

Chapter XII Amendments to the Regulations (Articles 109 to 157)

109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157

Chapter XIII. Transitional and adapting rules (Art. 158–174)

Article 158. Information security administrator as data protection officer Article 159 Unfinished checks before the date of entry into force of the Act Article 160. Procedures conducted by GIODO not completed before the date of entry into force of the Act Article 161. Obligation to communicate to the President of the Office a response to a request or request made by GIODO Article 162. Enforcement procedures carried out on the basis of an implementing title issued by GIODO Article 163. Effectiveness of actions carried out in enforcement proceedings before the date of entry into force of the Act Article 164 Unfinished proceedings in respect of the position of GIODO as creditor Article 165 Maintenance of implementing rules Article 166. GIODO as President of the Office Article 167. Conversion of the Office of GIODO into the Office for the Protection of Personal Data Article 168 Assets of the Treasury held by the GIODO Office on the date of entry into force of the Act Article 169 Transfer of the liabilities and obligations of the Office to the Office for the Protection of Personal Data Article 170. Annual GIODO activity report by the President of the Authority Article 171 Cases not completed before the date of entry into force of the Act Article 172 First communication on the types of processing operations requiring an assessment of the effects of the processing for the protection of personal data Article 173 Establishment of a Council for the Protection of Personal Data Article 174 Maximum limit of expenditure from the State budget

Chapter XIV Final rules (Art. 175–176)

Article 175. The derogating rule Article 176. Entry into force

We hope that this publication will help you understand the GDPR more effectively and support lawful, secure processing of personal data in your organisations.

Important!

In addition to the aforementioned provisions and guidelines, we recommend that you read the Act of 21 February 2019^*, which adapts the Polish legal order (162 acts) to the GDPR, inter alia by repealing provisions that conflict with the GDPR, duplicate GDPR solutions, or required consideration of the specifics of Polish legislation.

^*Act of 21 February 2019 amending certain acts in connection with ensuring the application of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

Text available at: https://isap.sejm.gov.pl

„We do not need IT documentation, we know how to operate.”

Are you sure about that?

Order an IT audit.