If you operate a digital platform, DAC7 rules already apply to you. Below are specific details about who is covered, what data you need to collect, which procedures to implement and what may happen if you do not report. The next report, for 2025, is due by 31 January 2027.
What is DAC7 and what does it change in practice?
Council Directive (EU) 2021/514 of 22 March 2021 (DAC7) requires digital platform operators to collect and provide tax authorities with data about sellers who carry out transactions through those platforms.
Until now, many forms of income earned through platforms were outside the tax authorities’ reach. The new rules give tax authorities access to detailed transaction data, helping them detect tax avoidance more effectively.
Importantly:
- The rules do not introduce new taxes or fees for sellers.
- They do not change income tax rules.
- In Poland, they were implemented through an amendment to the Act on the Exchange of Tax Information with Other Countries (Section IIIA, automatic exchange of information about sellers).
Basic definitions
- Digital platform: software, such as a website or application, including a mobile application, that allows sellers to connect with other users to carry out activities for payment. This includes e-commerce services, service-booking applications and similar solutions.
- Platform operator: an entity that manages a digital platform and enables sellers to offer goods or services to users.
What the amendment to the tax information exchange act introduces
The Polish law implementing DAC7:
- Defines platform operators’ duties: they must collect, verify and provide detailed information about sellers using their platforms.
- Regulates reporting: data goes to the Head of the National Revenue Administration (KAS), who makes it available to tax authorities in other EU Member States.
- Introduces penalties: financial penalties may apply for failing to meet reporting duties.
Who is covered by the rules?
Types of activity subject to reporting
The rules cover operators of digital platforms that enable:
- Rental of real estate or parts of it, for example websites for booking hotels, apartments, flats or holiday cottages.
- Rental of means of transport, such as cars, bicycles or scooters.
- Sale of goods, on either a small or large scale and regardless of product type.
- Personal services, such as tutoring, renovation work or beauty services.
Territorial scope
- The rules cover every platform operator that is tax resident in Poland or another EU Member State.
- They apply to both cross-border transactions and transactions carried out solely in the domestic market.
- The rules have extraterritorial scope: operators outside the EU, for example in the United States or China, that serve users in the European Union must also meet the reporting requirements.
- Exception: operators that have demonstrated to the competent authority that their business model does not include sellers subject to reporting.
Which sellers are not subject to reporting?
Not every platform user is covered by the reporting duty. Sellers are excluded if they meet both of these conditions:
- they carried out fewer than 30 transactions in the tax year, and
- they earned less than EUR 2,000 from those transactions.
This means small-scale sellers do not bear additional administrative burdens. The rules focus on transactions carried out on a larger scale.
What data must you collect as an operator?
Digital platform operators must collect and provide tax authorities with:
- Seller identification details:
- Businesses: company name, registered office address, Polish tax identification number (NIP) and VAT number.
- Individuals: first and last name, address, NIP and VAT number.
- The number of completed transactions for which the seller received payment.
- The amount of remuneration paid in connection with completed transactions.
Additional operator duties
- Implement and apply due diligence procedures for collecting and verifying information.
- Process personal data in accordance with the GDPR.
Due diligence procedures
As a platform operator, you must:
- Request the necessary identification details from the seller no later than the day on which the seller meets the conditions for becoming subject to reporting.
- Verify that the information is accurate and reliable using TIN and VAT number verification systems made available by the EU or Member States, as well as your own records.
- Ensure the collected information is complete and accurate: using an external service provider does not release you from responsibility for properly carrying out the procedures.
The deadline for implementing due diligence procedures was 31 December 2024. If you have not done so yet, act immediately.
GDPR compliance
When collecting data for DAC7, you must comply with the GDPR. In practice, this means:
- Transparency of processing: inform users about the purposes, legal bases and ways their data will be used.
- Data minimization: collect only information necessary to meet reporting duties.
- Data protection: implement technical and organizational safeguards against unauthorized access.
- Respecting users’ rights: be prepared to handle requests relating to access to data, its correction and deletion.
Failure to meet GDPR duties creates a separate financial and legal risk, independent of penalties for failing to report under DAC7.
Penalties for failing to report
If you do not provide the required information, or provide it incompletely or incorrectly, the Head of KAS may impose an administrative financial penalty of up to PLN 1,000,000 by administrative decision.
In addition to the financial penalty, you face:
- Risk of losing users’ trust, which directly affects the number of sellers and transactions on the platform.
- Risk of a tax audit, which creates additional costs and operational burdens.
Does DAC7 change the rules of e-commerce?
No. DAC7 increases transparency in online trade; it does not restrict it. For sellers operating in compliance with the rules, the regulations mean more equal competitive conditions. For those who have avoided tax duties until now, they are a signal to change their practices.
Summary: what to do and in what order
The first two reports, for 2023 (due by 31 January 2025) and 2024 (due by 31 January 2026), have already been filed. Data for 2025 is currently being collected and must be reported by 31 January 2027.
Check now:
- Whether your platform is covered by DAC7: review your business model and transaction types.
- Whether your due diligence procedures work properly: the implementation deadline has passed.
- Whether you collect all required data: identification details, transaction counts and remuneration amounts.
- Whether data processing complies with the GDPR: transparency, minimization and safeguards.
- Whether reporting is timely and complete: every error or delay creates a risk of a penalty of up to PLN 1 million.
If you are unsure whether your platform meets DAC7 requirements or need support with ongoing reporting, contact us. We specialize in advising digital platforms and analyzing tax regulations.
Frequently asked questions
Is my digital platform covered by DAC7 at all? DAC7 applies if you manage software, such as a website or application including a mobile application, that enables sellers to connect with users to sell goods, rent real estate or means of transport, or provide personal services for payment. The rules cover operators that are tax resident in Poland or another EU country, as well as operators outside the EU serving users in the Union. The exception applies only to operators that have demonstrated to the competent authority that their business model does not include sellers subject to reporting.
What seller information must I collect and report under DAC7? Collect and provide tax authorities with seller identification details: for businesses, the company name, registered office address, NIP and VAT number; for individuals, first and last name, address, NIP and VAT number. You also report the number of completed transactions for which the seller received payment and the amount of that remuneration.
Which sellers on a platform are not subject to DAC7 reporting? You do not report sellers who meet both conditions in the relevant tax year: they carried out fewer than 30 transactions and earned less than EUR 2,000 from them. Both thresholds must be met at the same time. Exceeding either one means the seller is subject to reporting.
What due diligence procedures must a platform operator implement under DAC7? Request the seller’s identification details no later than the day on which the seller meets the conditions for becoming subject to reporting, then verify their accuracy and reliability using TIN and VAT verification systems made available by the EU or Member States. You remain responsible for the completeness and accuracy of the collected information; using an external provider does not release you from that responsibility. The implementation deadline was 31 December 2024, so act immediately if you have not done this yet.
What penalties may a platform operator face for missing or incorrect DAC7 reporting? The Head of the National Revenue Administration may impose an administrative financial penalty of up to PLN 1,000,000 by administrative decision for failing to provide required information or providing it incompletely or incorrectly. In addition, you risk losing platform users’ trust, which directly affects the number of sellers and transactions, and a tax audit that creates additional costs and operational burdens.
