GDPR compliance in the Polish branch of a foreign company

You register a branch in Poland, and the first thing you order is a privacy notice for employees. The problem is that the notice must identify the data controller — and you do not yet know who it is. This single sequencing error affects the entire set of documents. They must all be reissued, this time naming the correct entity.

Foreign corporate groups opening branches in Poland regularly make the same mistake: they start with visible documents (privacy notices, policies) instead of the determinations that dictate the content of those documents. GDPR compliance in the Polish branch of a foreign company requires a strictly defined sequence of actions. Reversing this order means duplicating work and creates a real risk of complaints to the President of UODO.

In this article, I describe eight steps for establishing GDPR compliance in a new branch — in an order that avoids rework. I explain why an audit is the wrong solution for a new entity, why a data processing agreement between a head office and its own branch has no legal subject matter, and how to plan the work when half of the information must come from abroad.

Key concepts you need to know before you begin

Before we discuss the sequence, it is worth clarifying a few concepts. Without them, it is easy to confuse roles and choose the wrong legal instrument.

Why an audit is the wrong solution for a new branch

An audit examines an existing state of affairs. In a newly registered branch, there is no existing state yet — processes are only being launched, and information still needs to be collected from the head office. Ordering a GDPR audit at this point means paying to inspect an empty room.

Instead of an audit, you need a map of the processes actually carried out in Poland: categories of individuals and data, local and group-wide systems, vendors, and process owners. This is the starting point for documentation, not an audit report.

The difference is fundamental:

An audit has its place — but in phase two, after the initial compliance package has been implemented and there is something to examine.

Eight steps in an order that actually works

The sequence below follows one principle: each successive document depends on the determinations made in the previous step. Changing the order breaks this dependency — and makes rework necessary.

Step 1: roles and responsibilities — who is the controller?

This is the foundation of the entire package. Before creating any privacy notice, record, or procedure, you must determine and document:

1. Who is the controller of the data processed by the branch (as a rule, the parent company, not the branch — because the branch is not a separate legal entity)
2. What the branch’s status is within the controller’s structure
3. Which supervisory authority has jurisdiction over complaints (the President of UODO is competent to receive a complaint where there is a Polish connecting factor — Article 77(1) GDPR)
4. Whether the data protection officer appointed by the head office also covers the branch and whether the DPO has been notified to the competent authority (Article 37(2) GDPR permits a single DPO to be appointed for an entire group)
5. Who the contact person is at the branch and at the head office

Outcome: a one-page memo. Without it, every subsequent document may identify the wrong entity.

Common mistake: the head office sends a draft privacy notice naming the branch as the controller. The notice is distributed to employees. A month later, it turns out that the parent company is the controller — and the entire set of documents must be replaced.

Step 2: process mapping — what actually happens in Poland?

Once the controller has been identified, you collect information about the processing activities carried out by the branch:

1. Categories of individuals whose data is processed by the branch (employees, candidates, B2B contractors, representatives of business partners, customers)
2. Categories of data for each group of individuals
3. Local and group-wide systems used by the branch (HRIS, CRM, email, messaging platforms)
4. Service providers involved in processing
5. Process owners at the branch

This is not an audit. It is the collection of input for the documentation — partly from people at the branch and partly from the head office.

Practical point: some answers must come from abroad. The schedule for the initial compliance package should therefore include additional time for correspondence with the head office. Eight items spread over four months despite requiring only a dozen or so hours of work is not a measure of workload — it is a buffer for waiting for responses.

Step 3: intra-group relationships — branch, sister company, head office

This is the step where mistakes are most common. You must distinguish and document two relationships:

The head office–branch relationship is an allocation of tasks within a single controller. It does not require a data processing agreement (Article 28 GDPR), because there are no two separate legal entities. A data processing agreement between a head office and its own branch is a legal instrument with no subject matter — the appearance of compliance that offers no protection during an inspection.

The relationship with a separate group company (e.g. a sister company with which the branch shares an office, staff, or systems) requires the parties’ roles to be classified and the appropriate legal instrument identified:

Real-life scenario: the branch shares an office, staff, and systems with a sister company in the same group. No one has determined whether this constitutes processing on behalf of the controller, joint controllership, or disclosure. When the first inspection or complaint occurs, there is no legal basis for the data flow between the entities.

Review all existing data processing agreements within the group and remove those concluded between the head office and its own branch. Then classify the relationship with each separate group company.

Contact us if you need support in classifying roles within a corporate group.

Step 4: transparency of processing — privacy notices

Only now — once the controller has been identified, the processes mapped, and the relationships classified — can you prepare privacy notices. These are required under Articles 13 and 14 GDPR.

The notices must identify the foreign legal entity as the controller, acting through its branch in Poland — not the branch as the controller. This distinction determines whether the document is correct or must be replaced.

The set of notices should include at least:

1. Employee privacy notice (Article 13 GDPR + Article 22¹ of the Polish Labour Code)
2. Candidate privacy notice — the obligation arises when the first CV is received
3. Privacy notice for contractors engaged under civil-law and B2B contracts
4. Privacy notice for business partners and their representatives — including an Article 14 GDPR notice for data obtained indirectly (from business cards, emails, or referrals)
5. Customer privacy notice — if the branch serves customers

Each notice must contain: the controller’s identity, the purposes and legal bases, recipients, information about transfers outside the EEA, retention periods, data subject rights, the right to lodge a complaint with the President of UODO, and information on whether the provision of data is mandatory.

Priority: if the branch is already recruiting, prepare the HR and recruitment notices in the first month, before the remaining documents. There is no point delaying an obligation that arises upon receipt of the first CV. An infringement of Article 13(1)(a) GDPR (incorrectly identifying the controller) is subject to the penalty under Article 83(5)(b) GDPR: up to EUR 20 million or 4% of total worldwide annual turnover (source: Article 83 GDPR).

Step 5: data flows and transfers — what goes to the head office and the group?

Describe every data flow to the head office and between group entities. Classify each one separately:

1. Does the data flow take place within a single controller (head office–branch)?
2. Is the recipient a separate legal entity (a sister company or vendor)?
3. Is the data transferred outside the EEA?
4. If so, which transfer mechanism applies?

Trap: the flow of HR data to the head office in the United Kingdom may appear secure under the adequacy decision. However, the classification changes if the actual recipient is a group company other than the controller. The adequacy decision covering the head office’s country is not enough — you must establish who the actual recipient is and in what capacity it acts.

When using group-wide systems (HRIS, CRM, SaaS), roles must be classified at every level. A typical model is: controller (parent company) → processor (company operating the system) → subprocessor (SaaS provider). Each level requires a separate legal instrument under Article 28(3) GDPR. A processor may not engage a subprocessor without the controller’s prior written authorisation (Article 28(2) GDPR).

Status of the adequacy decision for the United Kingdom: Decision 2021/1772 was extended by Decision 2025/1226. Its expiry date is subject to change and must be monitored on an ongoing basis. If no adequacy decision is in place, appropriate safeguards under Article 46 GDPR are required: standard contractual clauses (SCCs), binding corporate rules (BCRs), or other approved mechanisms.

Step 6: records and accountability — documenting what has been established

You supplement the record of processing activities (Article 30(1) GDPR) after preparing the notices and process map — not before. Why? Because the record must be consistent with the notices. Two documents describing the same processes differently will be a problem during an inspection.

The record must include, among other things:

1. The name and contact details of the controller (the parent company, not the branch)
2. Purposes of processing
3. Categories of individuals and data
4. Data recipients
5. Information about transfers outside the EEA
6. Envisaged retention periods
7. A description of technical and organisational measures (Article 32 GDPR)

Clearly mark any fields for which an answer from the head office is still outstanding as “to be confirmed”. This is better than leaving them blank or entering information based on guesswork.

Failure to maintain the record is subject to the penalty under Article 83(4)(a) GDPR: up to EUR 10 million or 2% of total worldwide annual turnover. Decision DKN.5112.27.2022 of the President of UODO addressed, among other things, a failure to maintain a record of processing activities.

Step 7: data subject rights and breaches — response procedures

Two sets of procedures that the branch must have before receiving its first request and before its first incident:

Procedure for handling data subject rights (Articles 12–22 GDPR):
The branch is the point of contact, but the head office (the controller) is responsible for responding. Establish a process for forwarding requests to the head office, with internal deadlines shorter than the statutory one-month period (Article 12(3) GDPR). If the head office fails to respond on time, you have a problem because the deadline continues to run regardless of internal arrangements.

Personal data breach response procedure (Articles 33–34 GDPR):
A breach notification must be made to the supervisory authority within 72 hours of becoming aware of it. The branch → head office reporting route must be faster — because the head office decides whether to make the notification. Establish an escalation point, an internal reporting form, and a breach register that also includes breaches not reported to the authority.

Scenario: the first breach occurs at the branch. The 72-hour period expires before the head office responds to the email because no escalation point was established. Failure to have a breach response procedure may result in a penalty of up to EUR 20 million or 4% of turnover.

Step 8: summary and risk list — what is closed and what remains open?

Conclude the initial compliance package with a document that clearly identifies:

1. What has been completed and to what extent
2. What remains open (with the risk level and a recommendation)
3. What falls within the scope of phase two

This document is evidence of accountability (Article 5(2), Article 24 GDPR). Submit it to the management board.

What the initial compliance package does not include — and why this must be documented

Half of a well-written scope of services consists of what it does not include. A list of exclusions is a tool for protecting your company: it shows what must not be regarded as resolved once the package has been completed.

Typical exclusions from an initial GDPR compliance package for a new branch:

If no one documents this list, once the initial compliance package is complete, the client assumes that everything has been taken care of. It has not.

How to plan the work when half of the information must come from abroad

The schedule for an initial compliance package for the branch of a foreign company has one distinctive feature: it depends on how quickly the head office responds. Three rules help avoid disputes about delays:

1. The SLA for each item starts when the complete input is received — not when the contract is signed. When the work depends on a foreign head office, this is the only arrangement that does not create disputes over deadlines.
2. One overall hour limit for the entire package — including correspondence with the head office and one round of comments on each deliverable. Hours may be reallocated between items. This protects the budget from renegotiation halfway through the work if one item proves more difficult and another simpler.
3. A dependencies column for each item — each step identifies the preceding steps on which it depends. Changing the order breaks the structure, not merely the appearance of the schedule.

Training process owners — one rule to remember

Train the process owners at the branch (HR, administration, sales) on one point: the branch is not the controller. Every letter, notice, and response to a request must identify the parent company acting through the branch.

This is simple in theory, but mistakes are easy to make in day-to-day work. HR sends out a notice with the branch in the header. Administration responds to an access request and signs it in the branch’s name. Sales collects the data of business partners without an Article 14 GDPR notice. Each of these situations constitutes an infringement that can be prevented with a single training session.

Jurisdiction of the supervisory authority — where will an employee’s complaint go?

An employee of the Polish branch may lodge a complaint with the President of UODO (Article 77(1) GDPR). UODO is competent to receive the complaint even if the controller is a foreign entity.

What happens next depends on the structure:

1. If the controller has its main establishment in another EU Member State, the matter may be referred to the lead authority in that state (Article 56(1) GDPR), while UODO cooperates with it under the mechanism set out in Article 60 GDPR
2. If the controller is established outside the EU but has a branch in Poland as an establishment — the GDPR applies under Article 3(1), and the President of UODO may have jurisdiction over the activities of that branch
3. The decision of the lead authority is binding on the controller with regard to all its establishments in the Union (Article 60(11) GDPR) — including its Polish branch

For the head office, this means that proceedings may be conducted in Polish, against the background of Polish labour law, and before an authority for which the head office is unprepared. Establishing a communication route with the supervisory authority is part of the initial compliance package, not an optional extra for later.

Important note: a controller with a branch in the EU (as an establishment carrying out actual activities related to processing) is subject to the GDPR under Article 3(1) — and, as a rule, is not required to appoint an additional representative under Article 27 GDPR. However, a branch in Poland is not automatically a “representative” within the meaning of Article 27 — these are separate legal functions.

Branch registration requirements and the GDPR — what follows from the entry in the National Court Register?

The registration of a branch of a foreign undertaking in Poland is governed by the Act of 6 March 2018 on the Rules Governing the Participation of Foreign Undertakings:

1. Article 16 — the obligation to appoint a person authorised to represent the foreign undertaking at the branch
2. Article 17 — entry in the National Court Register as a prerequisite for commencing business operations
3. Article 19 — the obligation to use the foreign undertaking’s business name with the designation “branch in Poland”

Entering a representative in the National Court Register does not create a separate data controller. Privacy notices and the record of processing activities must identify the entity that actually determines the purposes and means of processing — as a rule, the foreign legal entity, not the branch. The Regional Court in Warsaw (XXIII Gz 356/24 and 357/24, 15 July 2024) confirmed that a person disclosed in the National Court Register may receive correspondence addressed to the foreign undertaking — but this concerns representation, not controller status.

Employment law at the branch — transparency obligations from the first CV

A branch employing staff in Poland is subject to the Polish Labour Code regardless of where the controller is established. Three areas require attention from day one:

1. Candidate data — Article 22¹ of the Labour Code sets out an exhaustive list of data that may be requested from a candidate (first name, surname, date of birth, education, employment history). The privacy notice under Article 13 GDPR must identify the actual controller — the foreign legal entity.
2. Special categories of data — Article 22¹b of the Labour Code: special-category data relating to a candidate or employee may be processed on the basis of consent only if the data was provided at that person’s initiative.
3. Video surveillance — Article 22² § 1 of the Labour Code: permitted exclusively to ensure employee safety, protect property, supervise production, or protect confidential information. Employees must be informed no later than 2 weeks before surveillance is launched; a new employee must be informed in writing before being allowed to start work (source: UODO).

We can help you with this

Establishing GDPR compliance in a new branch is a project with a clear sequence, specific deliverables, and defined dependencies. We work with a scope structured like a specification — with acceptance criteria, input, a final deliverable, and an exclusion for each item.

Our initial compliance package includes:

1. Roles and responsibilities memo — a one-page document identifying the controller, the branch’s status, the competent authority, and the point of contact
2. Process map — identification of the categories of individuals, data, systems, and vendors at the branch
3. Classification of intra-group relationships — distinguishing the head office–branch relationship from relationships with separate companies and identifying the required instruments
4. Set of privacy notices — for employees, candidates, contractors, business partners, and customers
5. Data flow and transfer analysis — classification of every data flow to the head office and the group
6. Record of processing activities — entries for processes carried out in Poland
7. Response procedures — handling data subject requests and breaches, with internal deadlines and an escalation path
8. List of risks and gaps — including the risk level, recommendations, and an indication of what falls within phase two

One overall hour limit for the entire package. Hours may be reallocated between items. The SLA starts when the input is received. A documented list of exclusions so that it is clear what remains open.

Contact us

GDPR compliance at the branch of a foreign company — key takeaways

When establishing GDPR compliance at a new branch, the sequence determines everything. First the roles and controller, then the process map, followed by intra-group relationships, and only then the notices, data flows, record, procedures, and risk list. Reversing this order means discarding and reissuing documents.

Three things to remember:

1. The branch is not the controller — the parent company is, and the notices, record, and procedures must reflect this
2. A data processing agreement between the head office and its own branch has no legal subject matter — remove it and classify the relationships with separate group companies
3. An audit of a new entity means paying to examine a state of affairs that does not yet exist — order a process map, not an audit report

If you are registering a branch in Poland or establishing GDPR compliance at a new entity — contact us. We will define an initial compliance package tailored to your structure, with a clear sequence of actions and a documented list of exclusions.

Frequently asked questions

We are registering a branch in Poland — do we need our own GDPR framework, or is what the head office has enough?
The GDPR applies directly throughout the EU — it is not “implemented” separately for the branch. However, a branch operating in Poland (recruitment, employment, dealing with business partners) creates processing activities that require separate documentation: privacy notices in Polish, entries in the record of processing activities, and procedures for handling requests and breaches. The head office’s documents do not replace these obligations because they must reflect the processes actually carried out in Poland and identify the President of UODO as the authority competent to receive complaints.

Can a branch be a data controller?
As a rule, no. A branch is not a separate legal entity — it is an organisational unit of the parent company. The parent company, which determines the purposes and means of processing, remains the controller (Article 4(7) GDPR). Privacy notices must identify the parent company acting through the branch, not the branch itself. Naming the branch as the controller is a substantive error that requires the entire set of documents to be replaced.

The head office sent us a data processing agreement to be signed between itself and the branch. Should we sign it?
No. A data processing agreement under Article 28 GDPR requires two separate legal entities — a controller and a processor. A branch is not a separate legal entity, so the agreement has no legal subject matter. It merely creates the appearance of compliance. Instead, define the internal allocation of tasks between the head office and the branch in a group policy. A data processing agreement only makes sense in a relationship with a separate group company (e.g. a sister company) or an external vendor.

Does sending employee data to the head office in the United Kingdom require an additional legal basis?
It depends on how the data flow is classified. If the data goes to the head office as part of the same controller, it is a flow within a single entity and is covered by the adequacy decision for the United Kingdom (Decision 2021/1772, extended by Decision 2025/1226). However, if the actual recipient is another group company, you need to classify the parties’ roles separately and use the appropriate legal instrument. The adequacy decision alone is not enough when the recipient is not the controller. The decision’s expiry date is subject to change and must be monitored.

How long does it take to establish GDPR compliance at a new branch, and why does the adviser say four months if the work only requires a dozen or so hours?
Four months is not a measure of the workload — it is a buffer for responses from the head office. Each item in the package depends on input that must partly come from abroad. The SLA starts when this information is received, not when the contract is signed. With efficient communication with the head office, the package can be completed sooner. If the head office is slow to respond, the schedule is extended without either party being at fault.

What exactly will we not have after the initial compliance package?
The initial compliance package does not include, among other things: analysis of cookies and online tracking, audits of vendors and subprocessors, data protection impact assessments (DPIAs), group agreements and BCRs, or annual maintenance. These areas fall within phase two. A documented list of exclusions is part of the package — so that, once the package is completed, it is clear what remains open and what risks this entails.