Open the most recent job posting published by your company. Check one thing: does it include the base salary or salary range? If not, your template has not been updated since 24 December 2025. And that is usually not the only problem with the document.
A job posting may look like an HR document. A form to be completed. A template copied from a previous recruitment process or from the internet. In reality, it is a legal document governed by two legal regimes at once: the Labour Code and the GDPR. A single “required documents" paragraph can lead to the excessive processing of data belonging to hundreds of candidates. A single question about previous earnings — prohibited since December 2025 — can open the door to a compensation claim.
In this article, I will guide you through four questions that determine the entire content of a recruitment advertisement. I will explain what data may be collected, what you cannot request, and provide a ready-to-use “allowed / not allowed" checklist following the amendment to the Labour Code. At the end, you will find specific recommendations — what to change, in what order, and why it is worth doing before an inspection takes place.
Key terms you need to know
Before we move on to the details, here are a few terms used throughout the article.
| Term | Meaning |
|---|---|
| Article 22¹ of the Labour Code | An exhaustive list of data that an employer may request from a candidate during recruitment — first name, surname, date of birth and contact details, while education and employment history may be requested only when necessary for the position concerned |
| Article 18³ca of the Labour Code | A provision in force since 24 December 2025 — it requires candidates to be informed of the base salary or salary range and prohibits questions about previous earnings |
| Data minimisation principle (Article 5(1)(c) GDPR) | Personal data must be adequate, relevant and limited to what is necessary for the purpose of processing — in recruitment, this means collecting only what you genuinely need |
| Privacy notice (Article 13 GDPR) | The obligation to inform candidates who processes their data, for what purpose, on what legal basis, for how long and what rights they have — this obligation must be fulfilled when the data is collected, i.e. in the job posting |
| Special categories of data (Article 9 GDPR) | Data concerning health, disability, religion, sexual orientation or trade union membership — during recruitment, such data may be processed only when provided on the candidate’s initiative and with their consent |
Four questions that determine the content of a job posting
Every recruitment advertisement can be reviewed using four questions. If you cannot answer any one of them, the template needs to be revised.
1. Which legal regime applies to your employer?
A private employer is subject to the Labour Code and the GDPR. A local government entity is additionally subject to the Act on Local Government Employees and the regulation on remuneration. Copying a job posting template from a different legal regime (e.g. using a civil service recruitment template for an IT company) means that you are presenting candidates with a procedure you are not required to follow — and that you will subsequently fail to comply with.
2. Which requirements are based on legislation and which are merely preferences?
In the private sector (IT, SaaS, e-commerce), there is no statutory list of qualifications for particular positions. As the employer, you must demonstrate a functional link between each requirement and the work performed in the position concerned. If you require a university degree for a position where it is not necessary, the requirement fails the test under Article 22¹ § 2 of the Labour Code.
Rule: an “essential" requirement is one for which you can identify a specific task performed in the position, show that no less intrusive verification method is available, and demonstrate that it is applied consistently to all candidates. Everything else — experience, soft skills and “nice-to-have" criteria — belongs in the “additional" column.
3. What is the legal basis for processing each application field?
This is where the most common mistake arises: treating the candidate’s consent as the legal basis for processing all data. In fact, consent is the appropriate legal basis only for data voluntarily provided beyond the scope permitted by the Labour Code — typically a photograph included in a CV.
| Data category | Legal basis | Example |
|---|---|---|
| Data required by law (first name, surname, date of birth, contact details) | Article 6(1)(c) GDPR in conjunction with Article 22¹ of the Labour Code | First name and surname in the application form |
| Data necessary for entering into a contract | Article 6(1)(b) GDPR | Confirmation of qualifications required for the position |
| Data voluntarily provided beyond the statutory list | Article 6(1)(a) GDPR (consent) | Photograph in a CV, additional certificates |
| Special categories of data | Article 9 GDPR + Article 22¹b of the Labour Code | Disability certificate — only when provided on the candidate’s initiative |
Invalid consent — where the candidate cannot realistically refuse it — does not meet the requirement of being freely given. A refusal to give consent or its withdrawal cannot result in unfavourable treatment or constitute a reason for refusing employment (Article 22¹a § 2 of the Labour Code).
4. Where and when do you provide salary information?
Since 24 December 2025, Article 18³ca of the Labour Code has given you three alternative points at which to provide this information:
- In the job posting.
- Before the job interview — if it was not included in the job posting.
- Before the employment relationship begins — if it was not provided earlier.
You may choose when to comply, not whether to comply. The salary or salary range must be based on objective, gender-neutral criteria — which means you need a pay scale or remuneration policy. Discretion alone is not enough.
The same provision prohibits asking candidates about their salary in their current or previous employment. Remove this question from the application form, the ATS configuration and the interview script.
Contact us — we will help you prepare job posting templates that comply with the amended legislation.
Checklist: what is allowed, what is not allowed and what requires your decision
The table below brings together the most common elements of recruitment advertisements and assigns a legal status to each one.
| Job posting / recruitment element | Allowed | Not allowed | Requires the employer’s decision |
|---|---|---|---|
| First name, surname, date of birth | ✅ | ||
| Contact details provided by the candidate | ✅ | ||
| Education, qualifications, employment history | ✅ — only when necessary for the position | ||
| PESEL number, home address, bank account number | ❌ during recruitment | ||
| Question about previous earnings | ❌ since 24.12.2025 | ||
| Salary or salary range information | ✅ — mandatory | ✅ — when: in the job posting, before the interview or before employment begins | |
| Photograph in a CV as a formal requirement | ❌ — coerced consent to the use of the candidate’s image | ||
| Photograph voluntarily included in a CV by the candidate | ✅ — on the basis of consent | ||
| National Criminal Register certificate | ✅ — only when required by law or justified by the needs of the position | ||
| Medical certificate | ❌ during recruitment — this is the employer’s responsibility after hiring | ||
| Health and disability data | ✅ — only when provided on the candidate’s initiative, with consent given in the form of a declaration | ||
| Age range in a job posting | ❌ — discrimination | ||
| “Young, dynamic team" in the description | ❌ — indirect age discrimination | ||
| Indicating a gender in the job title | ❌ — unless it is a genuine occupational requirement | ||
| GDPR privacy notice (Article 13) | ✅ — mandatory when data is collected | ||
| Consent to future recruitment processes | ✅ — separate and voluntary; it cannot be a condition for participating in the current recruitment process |
The most common mistakes in job postings — and how to fix them
Mistake 1: no salary section
The absence of salary information from a job posting template is a ready-made template age test: it means that the template has not been updated since December 2025. Add a “Proposed salary" section to the template with a two-part structure:
- The amount of the base salary or its range.
- A sentence stating that the rate is based on objective, gender-neutral criteria (e.g. the remuneration policy).
If your company does not have a pay scale, the Labour Code requirement means that you must create one. A range based on discretion does not meet the requirement of “objective criteria".
Mistake 2: using consent as the legal basis for processing all data
A general clause stating “I consent to the processing of my personal data" is not the appropriate legal basis for data required by law. The Polish Data Protection Authority indicates that such consent is invalid — the candidate cannot realistically refuse it, so it does not meet the requirement of being freely given under Article 7 GDPR.
Divide the legal bases for processing in the privacy notice into three categories (see the table in the section on the four questions). Use consent only for data voluntarily provided beyond the scope permitted by the Labour Code.
Mistake 3: a “required documents" paragraph that asks for too much
A CV with a photograph, a copy of a diploma, a National Criminal Register certificate, a PESEL number in the questionnaire and a medical certificate — at the recruitment stage, most of this package is excessive. Remove everything that you are not permitted to request before the employment relationship begins. Where you need confirmation of a fact (e.g. no criminal record), replace the document with a declaration from the candidate.
A pre-employment medical examination is the employer’s obligation towards a person being hired (Article 229 § 1 of the Labour Code), not part of the application package.
Mistake 4: no specific retention period
“We retain documents until they are no longer needed" does not comply with Article 5(1)(e) GDPR — the period must be specified or determinable. The Polish Data Protection Authority indicates that the data of an unsuccessful candidate should be deleted immediately after the recruitment process ends, and longer retention requires a separate legal basis.
Enter a specific period in the job posting and the retention policy — e.g. destruction or return of documents no later than 3 months after the recruitment process ends — and set a reminder to ensure that the deadline is actually observed.
Mistake 5: discriminatory language hidden in the description
Article 18³a § 1 of the Labour Code prohibits discrimination in access to employment. The National Labour Inspectorate indicates that a job posting should not suggest preferences concerning gender, age or characteristics unrelated to the work. Article 18³ca § 3 of the Labour Code additionally requires job postings and job titles to be gender-neutral.
Phrases such as “young person", “man for manual work" or age ranges may constitute evidence that a discriminatory criterion has been applied. The candidate may claim compensation under Article 18³d of the Labour Code — at least one minimum monthly wage (from 1 January 2026 — PLN 4,806 gross), with no upper limit. In its judgment II PSKP 17/21, the Supreme Court confirmed that compensation under Article 18³d has a punitive function and is not limited to the actual financial loss suffered.
GDPR privacy notice — eight elements, not two sentences
A privacy notice compliant with Article 13 GDPR is not just two sentences at the end of a job posting. You must fulfil the information obligation when the data is collected — i.e. in the job posting or application form.
A complete privacy notice includes:
- Details of the controller (name, address, contact details).
- Contact details of the data protection officer (if appointed).
- The purposes and legal bases of processing — divided into three categories (legal requirement, contract, consent).
- Recipients of the data and information about processing on behalf of the controller (e.g. the ATS provider).
- Information confirming that no transfer outside the EEA takes place — or details of the safeguard mechanism if such a transfer occurs.
- The retention period — a specific period, not “until the data is no longer needed".
- A list of the candidate’s rights: access, rectification, erasure, restriction of processing, data portability, objection, withdrawal of consent and the right to lodge a complaint with the President of the Polish Data Protection Authority.
- Information on whether the provision of data is voluntary, the consequences of failing to provide it, and the absence of automated decision-making and profiling.
If you use an ATS, check whether its configuration allows the full privacy notice to be displayed before an application is submitted. The ATS provider is a processor within the meaning of Article 28 GDPR, which requires a data processing agreement. Before selecting a provider, verify the location of the data, the subprocessors, the legal basis for transfers outside the EEA and the mechanisms for deleting data after the retention period expires.
Controlling access to candidate data — who can see applications
Applications arriving in a shared email inbox that half the team can access are a problem. On their own initiative, a candidate may attach a disability certificate or include information about their health or trade union membership. Special categories of data then end up in a location with no access controls.
Article 22¹b of the Labour Code requires access to special categories of data to be restricted to persons authorised in writing. Such authorisation is a formal document issued by the data controller — it must specify the scope and purpose and be acknowledged by the authorised person’s signature.
What to do:
- Restrict access to the recruitment inbox and CV folders to people directly involved in the recruitment process.
- Introduce written authorisations for every person who may view candidate data.
- If you use an ATS, configure roles and permissions so that special categories of data are visible only to designated individuals.
B2B recruitment — do the same rules apply to contracts?
Article 22¹ of the Labour Code applies only to employee recruitment (employer — person applying for employment). It does not automatically extend to the recruitment of B2B contractors.
| Aspect | Employee recruitment | B2B recruitment |
|---|---|---|
| List of data | Exhaustive — Article 22¹ of the Labour Code | No separate list — apply GDPR principles |
| Legal basis for processing | Article 6(1)(b) and (c) GDPR | Article 6(1)(b) GDPR (steps taken prior to entering into a contract) or point (f) (legitimate interest) |
| Obligation to disclose remuneration | Yes — Article 18³ca of the Labour Code | No confirmed statutory obligation |
| Prohibition on asking about earnings | Yes — since 24.12.2025 | No confirmed statutory prohibition |
| GDPR data minimisation principle | Yes | Yes |
| GDPR privacy notice | Yes | Yes |
In a B2B job posting, determine the scope of the data requested according to the purpose of the planned contract and GDPR principles, rather than the list in Article 22¹. Providing the rate in a B2B job posting may be good recruitment practice, but as of today it is not a statutory obligation.
Note: Directive (EU) 2023/970 on pay transparency, which must be implemented by 7 June 2026, applies to employment relationships. However, it cannot be ruled out that the Polish implementing legislation will extend its personal scope to some contractors — particularly individuals who perform work personally without subcontractors. Check the current legislative position before publishing a B2B job posting.
Recruitment agency and job board — who is responsible for the content of the job posting?
Passing discriminatory requirements to a recruitment agency does not release you from liability. Responsibility for the content of a job posting rests primarily with the entity that created, approved or knowingly published it.
An agency’s status under the GDPR depends on the cooperation model:
- If the agency processes data solely on your instructions, it is a processor (Article 28 GDPR) and requires a data processing agreement.
- If the agency jointly determines the purposes and means of processing, the parties may be joint controllers (Article 26 GDPR), which requires a separate agreement defining their respective responsibilities.
- The mere fact of acting as an intermediary in publishing a job posting does not in itself establish joint controllership — in its judgment in Case C-683/21, the CJEU indicated that the purposes and means of processing must be determined jointly.
The Act of 20 March 2025 on the Labour Market and Employment Services prohibits the publication of vacancies that violate equal treatment principles in the ePraca system.
What are the consequences of a defective job posting? Three areas of risk
| Area | Authority / entity | Legal basis | Consequences |
|---|---|---|---|
| GDPR | President of the Polish Data Protection Authority | Article 83 GDPR | Administrative fine of up to EUR 20 million or 4% of annual worldwide turnover (Polish Data Protection Authority) |
| Employment law — discrimination | Labour court (on the candidate’s initiative) | Article 18³d of the Labour Code | Compensation of at least one minimum monthly wage (PLN 4,806 gross from 1.01.2026), with no upper limit |
| Employment law — inspection | National Labour Inspectorate | Article 18³ca, Article 22¹ of the Labour Code | Inspection and potentially an offence under Article 282 § 1 of the Labour Code (if the conduct meets the statutory elements of the offence) |
The three areas can overlap. A single defective job posting creates GDPR risk (excessive data concerning hundreds of candidates), employment law risk (an inspection by the National Labour Inspectorate) and civil liability risk (a candidate’s compensation claim). After the recruitment process ends, a candidate may also request access to their data (Article 15 GDPR) and its erasure (Article 17 GDPR).
Pay Transparency Directive — what else is coming?
Article 18³ca of the Labour Code partially anticipates Directive (EU) 2023/970, which should be fully implemented by 7 June 2026. The Directive introduces a broader system of obligations than Article 18³ca alone:
- An employee’s right to information on average pay levels, broken down by sex (Article 7 of the Directive).
- An obligation to report on the gender pay gap — annually for employers with ≥250 employees (first report by 7 June 2027), every 3 years for employers with 150–249 employees, and every 3 years for employers with 100–149 employees (by 7 June 2031).
- Where there is a pay gap of ≥5% in any category, which is not justified by objective criteria and has not been remedied within 6 months — a joint pay assessment with workers’ representatives (Article 10 of the Directive).
As of today, there is no confirmation that Poland has adopted comprehensive legislation implementing all the Directive’s requirements. However, if you employ ≥100 people, start preparing pay record systems broken down by sex and job category. The reporting deadlines follow soon after the implementation date.
What to do now — order of actions
| Priority | Action | Category |
|---|---|---|
| 1 | Open every job posting template in use and check whether it includes the base salary or salary range. If it does not, the template must be corrected immediately. | Audit |
| 2 | Remove the question about previous earnings from the application form, ATS and interview script. Give recruiters clear instructions. | Process change |
| 3 | Divide the legal bases for processing in the privacy notice into three categories. Use consent only for data provided voluntarily. | Documentation |
| 4 | Remove from the “required documents" paragraph everything that cannot be requested during recruitment (PESEL number, address, bank account number, photograph, medical certificate, National Criminal Register certificate). | Documentation |
| 5 | Specify a particular retention period for candidate documents in the job posting and retention policy (e.g. 3 months after the recruitment process ends). Set a reminder. | Process change |
| 6 | Expand the privacy notice to include all 8 elements required by Article 13 GDPR. | Documentation |
| 7 | Divide requirements into “essential" (based on legislation or justified by the needs of the position) and “additional" (an advantage). | Documentation |
| 8 | Review the job posting for discriminatory language. Remove age ranges, gender references and phrases such as “young, dynamic team". | Legal review |
| 9 | Restrict access to the recruitment inbox. Introduce written authorisations. | Process change |
| 10 | Train managers conducting recruitment on the “allowed / not allowed" list. Do not publish a job posting without approval. | Training |
We can help you with this
Correcting a single job posting template is not enough if the problem affects the entire recruitment process — from the ATS configuration and application forms to interview scripts and document retention.
Our support is available in three options tailored to the scale of the problem:
- Operational minimum — a corrected job posting template, a complete Article 13 GDPR privacy notice, a salary section compliant with Article 18³ca of the Labour Code and a ready-to-use “allowed / not allowed" list for recruiters.
- Solid foundation — a review of the entire recruitment process: the ATS (mandatory fields, consent checkboxes, processing arrangements), application submission channels, retention, access rights and interview scripts.
- Comprehensive protection — GDPR documentation for recruitment, a retention policy, training for recruiters and managers, and support during an inspection by the National Labour Inspectorate or the Polish Data Protection Authority.
We begin by auditing what you already have — and identify what needs to be changed, in what order and why. No theory, just specific wording ready to implement.
A job posting is a legal document — put it in order before an inspection takes place
A recruitment advertisement is governed by two legal regimes: the Labour Code and the GDPR. Since 24 December 2025, these have also included the obligation to provide salary information and the prohibition on asking about previous earnings. A single outdated template is replicated in every subsequent recruitment process and affects the data of every applicant.
Review your templates. Remove excessive fields. Complete the privacy notice. Add a salary range. Train your team. If you need support reviewing job postings, forms and recruitment processes — contact us.
Frequently asked questions
Do I have to include the salary range in the job posting, or is it enough to tell the candidate before the interview?
Article 18³ca of the Labour Code gives you three alternative points at which to provide the information: in the job posting, before the job interview or, at the latest, before the employment relationship begins. You choose the timing, but the obligation itself is unconditional. If you do not provide salary information in the job posting, you must do so before the candidate attends the interview. The salary or salary range must be based on objective, gender-neutral criteria.
Can I still ask candidates about their salary expectations?
Asking about a candidate’s salary expectations (how much they would like to earn) is not the same as asking about their previous earnings. Article 18³ca prohibits questions about remuneration in current and previous employment relationships. The question “How much would you like to earn?" is not expressly covered by this prohibition — but given the employer’s obligation to provide a salary range, it is becoming less relevant in practice.
How long can I retain applications from unsuccessful candidates, and may I keep them for future recruitment processes?
The data of an unsuccessful candidate should be deleted immediately after the recruitment process ends. Longer retention requires a separate legal basis: defence against claims (based on Article 291 § 1 of the Labour Code — a 3-year limitation period) or the candidate’s consent to future recruitment processes. Consent must be voluntary, specific and capable of being withdrawn — it cannot be a condition for participating in the current recruitment process. A talent pool requires a separate purpose, a separate legal basis and a defined retention period disclosed to the candidate.
What should I do with a CV in which the candidate has voluntarily included information about their health, children or trade union membership?
Special categories of data provided on the candidate’s initiative may be processed on the basis of their consent given in the form of a declaration (Article 22¹b of the Labour Code, Article 9 GDPR). Only persons authorised in writing may access such data. If applications arrive in a shared inbox, restrict access to it and introduce written authorisations. Do not request this data — but if the candidate provides it, secure it in accordance with the law.
Do the same rules apply when recruiting for B2B contracts?
Article 22¹ of the Labour Code and Article 18³ca apply only to employee recruitment. In B2B recruitment, you determine the scope of the data requested according to the purpose of the planned contract and GDPR principles (data minimisation, a privacy notice and a defined retention period). The obligation to disclose remuneration and the prohibition on asking about earnings currently have no confirmed statutory equivalent for B2B arrangements — but Directive (EU) 2023/970 may change this once it has been fully implemented into Polish law.
What are the potential consequences of a defective job posting — an inspection by the National Labour Inspectorate, a complaint to the Polish Data Protection Authority or a lawsuit by a candidate?
All three. Excessive data creates a risk of a fine from the Polish Data Protection Authority (up to EUR 20 million or 4% of turnover). Discriminatory requirements open the door to a candidate’s compensation claim (at least one minimum monthly wage, with no upper limit). Failure to provide salary information or asking about previous earnings may be investigated by the National Labour Inspectorate. These risks can overlap — a single defective job posting can create exposure on all three fronts.
