Your company implemented GDPR in 2018. Since then, you have changed CRM systems, hired dozens of new people, launched marketing automation, and rebuilt the sales department. The question is: does your GDPR documentation know about any of these changes?
If the answer is “I’m not sure,” this article is for you.
GDPR (Regulation (EU) 2016/679 of the European Parliament and of the Council) is not a project you close and put on a shelf. It is an ongoing obligation. Article 5(2) GDPR expressly says that a controller must be able to demonstrate compliance at all times, not only on the implementation date. Yet in many companies, GDPR documentation exists only on paper. It was created two or three years ago, no one has updated it, and the company’s processes have changed several times since.
In 2024, the President of UODO issued 22 decisions imposing administrative fines, and the total value of fines increased by more than 1,000% year over year, from about PLN 1.23 million to about PLN 13.9 million (Source: UODO’s 2024 activity report). This signals that the supervisory authority is raising the stakes.
This article explains why a one-time GDPR implementation is not enough, how to recognize signs of “dead compliance,” and what specifically to do to move from a reactive mode to an ongoing data protection management system.
Key terms to know
Before getting to the main points, let’s clarify the terminology. These terms appear throughout the article; knowing them will make the rest easier to follow.
| Term | Meaning |
|---|---|
| Data controller | An entity (company or organization) that determines the purposes and means of processing personal data. In your company, this is usually the company itself, with responsibility resting with the management board. |
| Accountability (GDPR Article 5(2)) | The obligation to demonstrate that your company complies with data protection principles. It is not enough to say that you follow them; you must prove it with documents, procedures, and evidence that they are used. |
| DPO (Data Protection Officer) | A person responsible for monitoring GDPR compliance within an organization. The DPO may be an employee or work under a contract (outsourcing). Appointing a DPO is mandatory for certain categories of entities (GDPR Article 37). |
| DPIA (data protection impact assessment) | A risk analysis required before starting processing that may create a high risk to people’s rights, for example, profiling, large-scale monitoring, or processing sensitive data (GDPR Article 35). |
| Record of processing activities | A document (GDPR Article 30) describing all data processing operations in a company: purposes, data categories, recipients, and retention periods. It must be updated as processes change. |
| Data processing agreement | An agreement between a controller and a processor that processes data on the controller’s behalf, such as a CRM provider, cloud service, or marketing automation provider. It sets out the scope, purpose, and rules for processing. |
| UODO | Poland’s Personal Data Protection Office, the supervisory authority responsible for enforcing GDPR. |
Why a one-time GDPR implementation becomes outdated
Most companies treated GDPR as a project with a completion date. They created policies, notices, and a record of processing activities. Someone signed the documents, and someone completed training. Then the company carried on with its work, and GDPR fell behind.
What the rules say about ongoing compliance
GDPR leaves no doubt: compliance is an ongoing obligation, not a one-time task.
| Provision | What it means for your company |
|---|---|
| Article 5(2) (accountability) | You must be able to demonstrate compliance with processing principles at all times, not only on the day of an audit. An infringement is subject to a fine of up to EUR 20 million or 4% of turnover. |
| Article 24 (controller’s responsibilities) | Technical and organizational measures “shall be reviewed and updated where necessary.” Recital 74 adds that the controller must be able to demonstrate that processing is carried out in accordance with the Regulation. |
| Article 25 (privacy by design / by default) | Data protection must be considered both when designing new processes and during processing itself. Every new system, campaign, or tool requires a review. |
| Article 30 (record of processing activities) | The record must reflect the current state of processing. A new CRM, vendor, or data category means an update is needed. |
| Article 32 (security of processing) | The requirement for “regular testing, measuring and evaluating the effectiveness of measures,” without specifying a particular frequency but with a clear expectation of periodic checks. |
| Article 35 (DPIA) | An impact assessment should be reviewed when processing conditions change. Introducing AI, profiling, or monitoring? Check whether the DPIA is current. |
How a company outgrows its GDPR implementation
These are typical situations where GDPR documentation stops reflecting reality:
- IT system changes. The company introduced a new CRM or marketing automation tool, but no one checked whether a data processing agreement was signed, whether data is stored in the EU, or whether there is a legal basis for profiling.
- Team growth. The organization hired 30 to 50 people, but privacy notices, CV retention, and employee documentation no longer match current recruitment practices.
- New marketing campaigns. Marketing launched lead generation and email campaigns, but no one checked that consent, notices, and tools were configured correctly.
- Outsourcing processes. The company started working with new subcontractors for accounting, HR, or hosting. Processing agreements either do not exist or do not match the actual processing.
- Organizational changes. Department reorganizations, mergers, or spin-offs changed processing activities, but the record of processing activities does not reflect those changes.
Indirect data confirms the scale of the problem. A TGM Research study commissioned by ChronPESEL.pl and KRD, under the patronage of UODO, found that 59% of small and medium-sized businesses train employees on data protection only once, when they are hired, and 20% do not provide any training. Half of SMEs experienced a security incident in the previous 24 months.
GDPR does not set a fixed deadline for reviewing documentation, such as an annual deadline. The obligation is functional: documentation must reflect the current state of processing. If your company has changed since the last review, the documentation is very likely out of date.
How to recognize “dead compliance” in a company
“Dead compliance” is a situation where documents formally exist but do not reflect what is happening in the organization. The company looks compliant until someone takes a closer look.
Six warning signs
- No one knows who is responsible for GDPR. Responsibility is spread across HR, IT, administration, marketing, and management. Everyone assumes someone else is handling it. When an incident occurs, it turns out no one has the full picture.
- The record of processing activities has not been updated for over a year. New processes, systems, and data categories have not been added. The record describes the company as it was two years ago, not as it operates today.
- Data processing agreements do not cover all IT vendors. You introduced new tools such as a CRM, cloud services, marketing automation, or HRM, but did not sign or update agreements with their providers.
- The breach response procedure has never been tested. The document exists, but no one knows who detects a breach, who reports it to UODO within 72 hours, or who contacts affected people.
- New business initiatives start without a GDPR review. Campaigns, system implementations, and HR process changes are not checked for data protection before launch.
- GDPR comes up only reactively. The issue returns when there is an incident, inspection, customer question, or employee dispute. Between those events, there is silence.
Why this is more than a formal problem
Accountability (GDPR Article 5(2)) means that you must demonstrate compliance. The supervisory authority does not have to prove an infringement first. If a UODO inspection finds that your record of processing activities does not match reality, your breach procedure has not been tested, and your data processing agreements do not cover half of your vendors, the failure to demonstrate accountability may itself constitute an infringement.
An example from UODO case law: a company that lost a USB drive containing unencrypted data was fined nearly PLN 240,000, not for losing the device itself but for failing to implement adequate technical and organizational measures (GDPR Article 32). If the company had regularly tested its security and documented those reviews, its position in the proceedings would have been significantly stronger.
Contact us and we will check whether your GDPR documentation is keeping pace with your business.
What UODO looks for during inspections: supervisory priorities for 2024 to 2026
Knowing UODO’s supervisory priorities helps you decide which areas to review first. Sectoral inspection plans are published openly on UODO’s website.
How UODO’s inspection priorities have evolved
| Year | Sectoral inspection areas |
|---|---|
| 2022 | Banks (profiling and creditworthiness assessments), mobile apps, SIS/VIS systems |
| 2023 | SIS/VIS systems, mobile apps, web applications |
| 2024 | Web applications, SIS/VIS systems, information obligations (GDPR Articles 13 to 14) |
| 2025 | Large-scale EU systems, health data, children’s data (image), breach documentation (Article 33(5)) |
| 2026 (announced) | Video surveillance in healthcare providers, BIP, marketing (legal bases), delivery platforms |
(Source: UODO sectoral inspection plans)
What this means for your company
Three takeaways from the priorities:
- Web applications and information obligations: if you run an e-commerce business, SaaS company, or online platform, your privacy notices and the way you secure data in applications may be reviewed. Check whether your privacy policies are current and meet GDPR Articles 13 and 14.
- Breach documentation (Article 33(5)): since 2025, UODO has been checking whether companies keep a breach register documenting every incident, including its circumstances, effects, and remedial actions, even if the breach was not reported to the authority. Not keeping such a register is an infringement in itself.
- Marketing and legal bases: in 2026, UODO has announced inspections of marketing entities. If you run lead generation, email marketing, or profiling campaigns, verify the legal basis for processing and whether you have the required consents.
UODO’s supervisory approach: monetary fines account for about 1.5% to 2% of all decisions (22 fine decisions out of 1,719 decisions overall in 2024). The authority says fines are a last resort; warnings and compliance orders are more common. This does not change the fact that the total value of fines is increasing year over year and inspections are becoming more precise.
Real consequences of failing to maintain ongoing compliance
Financial penalties: scale and examples
The maximum fine thresholds under GDPR Article 83:
| Category of infringement | Maximum fine |
|---|---|
| Infringements of controller obligations (Articles 25 to 39): no privacy by design, no record of processing activities, no DPIA, or an improperly appointed DPO | Up to EUR 10 million or 2% of annual worldwide turnover |
| Infringements of processing principles (Article 5), lawfulness conditions (Articles 6 and 9), people’s rights (Articles 12 to 22), or transfer rules (Articles 44 to 49) | Up to EUR 20 million or 4% of annual worldwide turnover |
| Public finance sector entities, research institutes, and the National Bank of Poland | Maximum PLN 100,000 |
| State and local cultural institutions | Maximum PLN 10,000 |
Examples of UODO decisions in recent years:
| Entity | Fine | Reason |
|---|---|---|
| McDonald’s Polska | PLN 16.9 million | A processor misconfigured a server; the controller failed to supervise the processor and conduct a risk analysis. |
| Polish Post | PLN 27 million | Processing data of 30 million citizens without a legal basis. |
| Toyota Bank Polska | PLN 576,220 | Improper placement of the DPO (PLN 262,000) and omitting profiling from the record and DPIA (PLN 314,000). |
| Santander Bank Polska | PLN 545,748 | Failure to notify employees of a breach after a former employee retained access to PUE ZUS. |
| Company (lost USB drive) | About PLN 240,000 | Data on the device was not encrypted, so security measures were inadequate. |
| Town mayor | PLN 20,900 | Failure to report a breach within 72 hours (PLN 7,700) and failure to notify affected people (PLN 13,200). |
| Medical company | PLN 11,365 | The management board president also served as DPO, creating a conflict of interest. |
(Source: decisions of the President of UODO)
Consequences beyond financial penalties
Fines are only the tip of the iceberg. Failing to maintain an ongoing compliance system also creates:
- Liability for damages (GDPR Article 82): people whose data was infringed may claim compensation directly from the controller.
- Personal liability for the management board: board members may be liable for failing to supervise data processing.
- Operational paralysis: when an incident occurs without ready procedures, the company loses time figuring out who is responsible, which documents are needed, and what to do. Every hour of delay brings you closer to missing the 72-hour deadline for reporting a breach to UODO.
- Costs of bringing in lawyers at short notice: reactively commissioning GDPR work “from scratch” for each new issue costs more than an ongoing arrangement.
- Reputational risk: loss of trust among customers, business partners, and job candidates.
New rules raising the bar: AI Act, DSA, DMA
GDPR does not operate in a vacuum. Between 2023 and 2026, new EU regulations entered into force or are coming into force, creating additional obligations related to data protection.
| Regulation | Status | Effect on GDPR obligations |
|---|---|---|
| AI Act (Artificial Intelligence Regulation) | Entered into force on 1 August 2024. Prohibitions on practices applied from 2 February 2025. Full application from 2 August 2026. | High-risk AI systems require a DPIA. Profiling using AI is subject to GDPR and AI Act requirements in parallel. UODO says processing personal data for high-risk AI systems will, as a rule, require a DPIA. |
| DSA (Digital Services Act) | Fully applicable from 17 February 2024. | New transparency obligations for digital platforms, including targeted advertising and profiling, directly linked to GDPR. |
| DMA (Digital Markets Act) | Applicable from 2 May 2023. | Restrictions on combining data between services affect business models based on aggregating user data. |
| ePrivacy (proposed Regulation) | Proposal in progress. A 24-month adjustment period would apply after adoption. | It will replace the ePrivacy Directive and set new rules for cookies, electronic marketing, and confidentiality of communications. |
If your company uses AI tools such as chatbots, recommendation systems, or process automation, runs online marketing, or operates as a digital platform, these regulations create a layered compliance ecosystem that requires ongoing management.
How to move from a reactive mode to an ongoing compliance system
Below are concrete actions, ordered from the most urgent to those worth planning over the next several months.
Priority actions: do these as soon as possible
- Conduct a compliance audit. Check whether your documentation (policies, records, notices, and data processing agreements) matches the company’s current processes. If the implementation was more than a year ago and no one has updated it, it is very likely out of date.
- Appoint one owner for data protection. This may be a DPO, internal or external, but the key is that one person or entity has the full picture and responsibility for managing the issue. Without this, accountability is scattered: the management board carries the risk, but no one manages the process.
- Update your record of processing activities (GDPR Article 30). Add all new processes, systems, and data categories introduced since the last update. The record must be updated whenever processing activities change, not once a year.
- Review data processing agreements with IT vendors. Review agreements with CRM, cloud, marketing automation, and HRM providers. If you introduced new tools without a formal GDPR review, fill the gaps. Processor oversight should be carried out regularly, for example, once a year, and when a breach is suspected.
Actions to implement within a quarter
- Introduce a GDPR review process for new initiatives. Every new project, campaign, or system implementation should pass a short assessment before launch. This implements privacy by design (GDPR Article 25): data protection must be considered during design, not after the fact.
- Train operational teams. Not a lecture on regulations, but workshops: what to do when a customer requests data deletion, how to recognize a breach, and whom to notify about an incident. Data show that 59% of companies train employees on GDPR only once, when hired. That is not enough.
- Test the breach response procedure. Who detects a breach? Who reports it to UODO within 72 hours? Who contacts affected people? Test it with a scenario; do not wait for a real incident. After every incident or test, analyze the causes and implement preventive measures.
Actions to plan over the next six months
- Schedule recurring compliance reviews. At least once a quarter, review a selected area, department, or process. The goal is to find gaps before they become problems. Data retention procedures, the record of processing activities, and data processing agreements all require periodic review.
- Consider moving to an ongoing GDPR support model. An external DPO on a subscription basis instead of reactively engaging lawyers, particularly if the company is growing and data protection issues come up every month. An ongoing model provides continuity, familiarity with the organization, and faster response times.
Privacy by design checklist for new projects
Before launching any new tool, campaign, or process, check:
| Question | What to check |
|---|---|
| What is the purpose of processing? | Is the purpose clearly defined and documented? |
| What is the legal basis? | Consent, contract, legitimate interest, or legal obligation? |
| What data is collected? | Are you collecting only data that is necessary (data minimization)? |
| Who has access to the data? | Is access limited to people who need it? |
| Where is the data stored? | In or outside the EU? Is there a data processing agreement with the provider? |
| How long will the data be stored? | Has a retention period been set? |
| Is a DPIA required? | Profiling, sensitive data, monitoring, or new technologies: check the criteria in GDPR Article 35. |
| How do you facilitate people’s rights? | Access, erasure, rectification, and portability: do you have a procedure for these requests? |
External DPO: when it makes sense and what to consider
When appointing a DPO is mandatory
GDPR Article 37(1) requires a DPO to be appointed in three cases:
- Processing is carried out by a public authority or body, except courts.
- The controller’s core activities consist of regular and systematic monitoring of people on a large scale.
- The core activities consist of large-scale processing of special-category data (GDPR Article 9) or data relating to criminal convictions (Article 10).
Even if your company does not meet these criteria, appointing a DPO or an entity performing this function helps clarify responsibility and gives the management board operational support when making data-related decisions.
Internal versus external model
| Criterion | Internal DPO | External DPO (outsourcing) |
|---|---|---|
| Knowledge of the organization | High from the outset | Requires an onboarding period |
| Independence | Risk of a conflict of interest, such as combining the role with IT, HR, or management | Structural independence, with no employment reporting line |
| Cost | Median salary: about PLN 8,810 gross per month, plus training and certification costs | Subscription model, depending on scope, without employment costs |
| Availability | Full-time availability, but limited specialization | A team of specialists, but availability is governed by contract |
| Legal risk | UODO fined a bank PLN 262,000 for improperly positioning its DPO and a medical company PLN 11,365 for a conflict of interest (the president was also the DPO) | Lower risk of conflicts of interest, but clear communication rules are needed |
GDPR Article 38(6) allows the DPO to perform other tasks, provided there is no conflict of interest. UODO has repeatedly stated that a DPO cannot hold roles that determine the purposes and means of processing, such as head of IT, marketing, HR, or a management board member responsible for processing.
How we can help
If you recognize the signs described in this article in your company, such as scattered GDPR responsibility, outdated documentation, or no incident procedures, that is a signal to organize the matter systematically.
We combine data protection law with business context. We work with IT, SaaS, e-commerce, and scale-up companies that are growing their teams, implementing new systems, and running marketing campaigns. We understand that GDPR cannot block product development or sales, but it must operate in the background.
Our support includes:
- GDPR compliance audit: comparing documentation with current processes, identifying gaps, and recommending next steps.
- Documentation updates: records of processing activities, policies, notices, and data processing agreements matched to how the company operates today, not three years ago.
- External DPO function: subscription-based support covering compliance monitoring, advice, training, incident support, and inspections.
- Advice on new projects: GDPR review before launching a new tool, campaign, or process (privacy by design).
- Team training: workshops tailored to different roles (HR, marketing, IT, management), focused on everyday scenarios rather than theory.
- Incident and UODO inspection support: response procedures, preparing notifications, and communicating with the authority.
GDPR should operate in the background of an organization. Implemented well, it improves data security and reduces the risk of fines without blocking growth.
Organize GDPR before an inspection or incident does it for you
A one-time GDPR implementation becomes outdated faster than you think. The company grows, processes change, and new systems and campaigns create new risks, while the documentation stands still. The result is “apparent compliance” that will not withstand a UODO inspection or a real incident.
Moving from a reactive mode to an ongoing data protection management system requires three things: an audit of the current state, an owner for the issue, and a recurring review process. The sooner you do this, the lower the financial, operational, and reputational risks you face.
Schedule a 30-minute GDPR status assessment for your company. We will show you what needs correction and how to move to an ongoing compliance model without stopping operations.
Frequently asked questions
We implemented GDPR three years ago. How can I tell whether our documentation is still current?
Ask yourself three questions: (1) Have you changed IT systems, vendors, or tools such as a CRM, cloud service, or marketing automation since implementation? (2) Have you hired new employees or changed recruitment processes? (3) Have you launched new marketing campaigns or changed how you generate leads? If the answer to any of these is yes, your record of processing activities, data processing agreements, and privacy notices probably need updating. GDPR Article 30 requires the record to reflect the current state of processing, not the state from three years ago.
Who in the company should own GDPR, and do I have to appoint a DPO?
Appointing a DPO is mandatory in the three cases set out in GDPR Article 37: public bodies, companies that monitor people on a large scale, and companies that process special-category data on a large scale. Even if your company does not meet these criteria, appointing one person or entity to be responsible for GDPR clarifies accountability. Without this, the issue is left hanging between departments, and the management board carries risk without operational support. The DPO may be an employee or work under a contract through outsourcing; both models are permitted.
What does disorganized GDPR really cost, and what is at stake besides a fine?
UODO fines are only one part of the picture. In 2024, the total value of fines increased by more than 1,000% year over year, to about PLN 13.9 million. Other risks include compensation claims by people whose data was infringed (GDPR Article 82), personal liability for management board members, operational paralysis during an incident without ready procedures, the cost of engaging lawyers at short notice “from scratch,” and loss of trust among customers and business partners. An ongoing compliance system costs much less than the combined impact of these risks.
How often should I review my company’s GDPR documentation?
GDPR does not set a fixed frequency. Article 24 refers to reviews “where necessary,” and Article 32 to “regular testing of the effectiveness of measures.” We recommend reviewing at least one selected area, department, or process each quarter. Documentation should also be updated after every significant change: a new IT system or vendor, organizational restructuring, a new marketing campaign, or a change in the rules. Data retention procedures, records of processing activities, and data processing agreements each have a different life cycle and need separate monitoring.
We are implementing a new CRM or marketing automation tool. What should we check for GDPR before launch?
Before launch, check: (1) whether a data processing agreement is signed with the provider; (2) where data is stored, in or outside the EU, and if outside the EU, the legal basis for the transfer; (3) whether you have a legal basis for processing data in the new tool, such as consent, contract, or legitimate interest; (4) whether the data collected is limited to what is necessary; and (5) whether the new tool requires a DPIA, for example, because of profiling or large-scale processing. This implements privacy by design under GDPR Article 25: data protection must be considered at the design stage, not after implementation.
What does a UODO inspection look like, and what do inspectors check first?
UODO conducts sectoral inspections, which are planned and published in advance, as well as inspections resulting from complaints and breach reports. In 2024, priorities included web applications and information obligations (Articles 13 to 14); in 2025, they included breach documentation (Article 33(5)), health data, and children’s data. Inspectors review, among other things, the record of processing activities, data processing agreements, breach response procedures, breach registers, privacy notices, and security measures. Outdated documentation makes it harder to demonstrate accountability, which may itself constitute an infringement of GDPR Article 5(2).
