Report on the activities of the President of the Personal Data Protection Office in 2025
We encourage you to read the report on the activities of the President of the Personal Data Protection Office, Mirosław Wróblewski, in 2025. Every year, by 31 August, the President of the Personal Data Protection Office must present this document to the Parliament, the Council of Ministers, the Ombudsman, the Ombudsman for Children and the Prosecutor General. This is an implementation of Article 59 of Regulation (EU) 2016/679 of the European Parliament and of the Council and Article 50 of the Act of 10 May 2018 on the Protection of Personal Data. The report is also presented to the public, the Commission and the European Data Protection Board.
The report on the activities of the President of the Personal Data Protection Office, i.e. the Polish supervisory authority competent for the protection of personal data, contains the most important findings concerning the statutory tasks performed, which include: examining complaints, conducting inspections, giving opinions on draft legal acts, receiving data breach notifications and taking actions against data controllers and processors in order to notify persons whose data have been breached.
Important tasks of the President of the Personal Data Protection Office also include educational and informational activities and participation in the work of international organisations and institutions dealing with the issue of personal data protection. Information on this subject is also included in the report for 2025.
Administrative decisions
In 2025, the President of the Personal Data Protection Office issued a total of 2092 administrative decisions, which consisted of:
o 2020 decisions in individual complaint cases,
o 20 decisions on the imposition of administrative fines (32 fines were imposed),
o 31 decisions concerning inspections and data breaches
o 20 decisions in cooperation with the supervisory authorities of the EU countries,
o 1 decision concerning code of conduct.
Complaints to the President of the Data Protection Office
In 2025, 12,827 complaints were filed with the President of the Personal Data Protection Office (not including complaints conducted as part of international cooperation with other supervisory authorities in the EU). A year earlier, there were 8056 complaints. This means that in the last year the President of the Personal Data Protection Office received as many as 61% more individual complaints than in 2024.
The complaints most often concerned, among others, sharing data on the Public Information Bulletin website, sharing data in e-mail correspondence, sending correspondence to an unauthorised addressee, processing data using video surveillance, processing data in connection with debt collection, processing data for marketing purposes, minimising data with regard to children, processing of information constituting bank secrecy by banks for the purpose of assessing creditworthiness, sharing data by banks with other entities, processing data for the purpose of issuing prescriptions, sharing data on a person's health condition by the employer with co-workers.
In education, there were repeated allegations of disclosing information about children, passing on data through electronic diaries and publishing the images of students.
Data breach notifications
In 2025, controllers notified 22,435 personal data breaches to the President of the Personal Data Protection Office. For comparison, in 2024 there were 14,842 breach notifications Thus, the President of the Personal Data Protection Office received 51% more personal data breach notifications.
Among the most frequently notified breaches to the President of the Personal Data Protection Office by data controllers were, inter alia: incorrectly addressed correspondence, sharing data with the wrong person, incorrect anonymisation of data or unintentional publication, loss of correspondence, unauthorised access to databases, theft of a data carrier, use of malware interfering with the confidentiality, integrity or availability of personal data.
Inspections
In 2025, the inspectors of the President of the Personal Data Protection Office carried out 76 inspections. This is 52% more than in 2024, when 50 inspections were carried out.
On the basis of the Sectoral Inspection Plan adopted for 2025, 41 inspections were carried out. Five inspections were carried out in connection with personal data breaches notified to the President of the Personal Data Protection Office by data controllers. Five inspections of personal data processing in the Large-Scale Systems of the European Union were also carried out, including on the basis of Article 34 of the Act of 24 August 2007 on the participation of the Republic of Poland in the Schengen Information System and the Visa Information System. The remaining 25 inspections were carried out as a result of obtaining information by the President of the Personal Data Protection Office about irregularities in connection with the processing of personal data.
In addition, the President of the Personal Data Protection Office carried out 20 checks on the application of Article 11(1) of the Act on the Protection of Personal Data Processed in Connection with the Prevention and Combating of Crime.
Administrative fines
In 2025, the President of the Personal Data Protection Office exercised the power to impose an administrative fine in 20 cases, imposing a total of 32 administrative fines in the total amount of PLN 64,436,940.25 on 23 entities.
Compared to 2024, this means an increase in the number of fines imposed by 18.5%, while their total amount increased by 363% (in 2024, 27 administrative fines were imposed for a total amount of PLN 13,907,740.96).
Notifications of suspected crime
In 2025, the President of the Personal Data Protection Office filed 8 notifications of suspected crime.
The notification that most interested the public concerned the generation of photos of a naked classmate by primary school students. Her image was created using an application using artificial intelligence. This student was a minor under the age of 15 and there was a high probability of her identification. The conduct of her classmates not only drastically violated the girl's privacy, but also threatened to violate her elementary life interests in the future. In connection with becoming aware of this event, the President of the Personal Data Protection Office filed a notification of suspected crime, in particular on the basis of Article 107(1) of the Act on Protection of Personal Data.
Giving opinions on draft legal acts
The President of the Personal Data Protection Office does not have a legislative initiative, but his tasks include giving opinions on legal acts. In 2025, the supervisory authority gave its opinion on 981 legal acts (in 2024 – 779). An extremely important aspect of giving opinions for the President of the Personal Data Protection Office was to take into account the context of personal data protection already at the stage of legislative work, especially when it comes to data protection impact assessment.
Questions on legal interpretation
In 2025, data controllers and individuals sent 1815 letters with legal questions to the Personal Data Protection Office, and 218 letters were received from data protection officers. In addition, the President of the Personal Data Protection Office received 57 inquiries from supervisory authorities from other countries. In total, the Personal Data Protection Office received 2090 legal questions (2024 – 2214).
The report of the President of the Personal Data Protection Office indicates that a slight decrease in the number of incoming questions may be due to the fact that many issues have already been clarified by the supervisory authority, e.g., in the announcements published on the Office's website or in the "Personal Data Protection Office’s Bulletin". Some interested parties also make use of the Personal Data Protection Office’s Infoline or consultation points launched by the authority, inter alia, during participation in various types of projects organised throughout Poland, including a permanent consultation point established in Rzeszów.
Letters of the President of the Personal Data Protection Office
In 2025, the President of the Personal Data Protection Office sent a total of 43 letters with specific requests to various entities: 35 in complaint cases, 8 in cases of inspections and violations. For comparison, in 2024 there were 14 letters.
Letters in 2025 concerned, inter alia:
· video monitoring in educational institutions,
· placing and storing fingerprints in identity cards,
· preventing incidents during the delivery of mail,
· unauthorised use of the PESEL (personal identification number) database by Border Guard officers,
· loss of ticket pads and official notebooks containing personal data by police officers,
· retention of medical records containing sensitive data of patients,
· disclosure of data in connection with subsidies for sports associations.
Educational activities of the Personal Data Protection Office
The report of the President of the Personal Data Protection Office for 2025 extensively presents the educational activities of the supervisory authority. In addition to information about the "Your Data – Your Concern" programme addressed to students, schools and teachers, there are details on, inter alia, the celebration of the 19th Personal Data Protection Day, a series of seminars organised together with the Social Insurance Institution, open lectures, conferences on data protection in the context of new technologies and artificial intelligence, seminars and expert lectures, the "The Personal Data Protection Office on tour across Poland" campaign and participation in the Pol'and'Rock Festival.
Media activity
The report also contains information on the information activities of the President of the Personal Data Protection Office in 2025. During this time, 337 communiques and 38 videos were published on the www.uodo.gov.pl website. 271 questions from journalists were answered, in which a total amount of 643 detailed questions were asked. The President of the Personal Data Protection Office and the employees of the Personal Data Protection Office gave 47 interviews to the press, radio and television.
The President of the Personal Data Protection Office participates in the meetings of the European Data Protection Board, in the work of various groups and subgroups and in the EDPB task forces. Within these frameworks, he cooperates with other supervisory authorities on the development of documents in order to promote a common understanding of the GDPR. These were guidelines and recommendations (11), opinions and letters (23). The President of the Personal Data Protection Office also participates in meetings within the framework of supervisory cooperation in other formats.
The entire report, with all the data and their detailed presentation, as well as analysis, is available (in Polish) at: https://uodo.gov.pl/pl/file/7930