{"id":4425,"date":"2026-10-28T09:02:54","date_gmt":"2026-10-28T09:02:54","guid":{"rendered":"https:\/\/sawaryn.com\/?p=4425"},"modified":"2026-10-28T09:46:00","modified_gmt":"2026-10-28T09:46:00","slug":"gdpr-before-new-product-launch","status":"publish","type":"post","link":"https:\/\/sawaryn.com\/en\/publikacje\/gdpr-before-new-product-launch\/","title":{"rendered":"GDPR Before a Project Launch. 7 Things You Need to Put in Order Before Implementing a New Product."},"content":{"rendered":"

The new product is ready. The team is waiting for the green light. And then someone asks: what about GDPR? In most companies we work with, this question comes too late\u2014when changing anything means delaying the launch by weeks and rebuilding something that already works.<\/p>\n

Meanwhile, the data speaks for itself. In 2025, the President of the UODO imposed fines totaling PLN 64.3 million<\/strong>\u2014more than three times the amount imposed in 2024. The entities fined included Poczta Polska (PLN 27.1 million), ING Bank \u015al\u0105ski (PLN 18.4 million), and McDonald’s Polska (PLN 16.9 million). Violations of Articles 24, 25, and 32 of the GDPR\u2014in other words, failure to properly design data protection measures\u2014are consistently penalized.<\/p>\n

But a financial penalty is not the only risk. Project delays, chaos between departments, loss of user trust, and costly redesigns of forms, consent mechanisms, and terms and conditions after launch\u2014this is a scenario that can be anticipated and prevented.<\/p>\n

In this article, I cover 7 GDPR areas<\/strong> you should address before launching a new product, service, sales channel, or tool. Not to hold up implementation, but to accelerate it\u2014with a clear plan and no risk of having to make changes after launch.<\/p>\n

Before you begin\u2014the terms you need to know<\/h2>\n

Before we move on to the specifics, let us establish a common language. The following terms appear in every project involving the processing of personal data.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Term<\/th>\nWhat it means<\/th>\n<\/tr>\n<\/thead>\n
Data controller<\/strong><\/td>\nThe entity that determines the purposes and means of processing personal data. Usually your company.<\/td>\n<\/tr>\n
Processor<\/strong><\/td>\nAn external provider that processes data on your behalf\u2014for example, a CRM provider, hosting provider, or marketing automation tool.<\/td>\n<\/tr>\n
Joint controller<\/strong><\/td>\nA situation in which two entities jointly determine the purposes and means of processing. It requires a separate agreement governing the allocation of responsibilities (Article 26 of the GDPR).<\/td>\n<\/tr>\n
Data processing agreement<\/strong><\/td>\nA document governing the terms on which a processor processes data on your behalf (Article 28 of the GDPR).<\/td>\n<\/tr>\n
DPIA (data protection impact assessment)<\/strong><\/td>\nA formal risk assessment required before processing begins where that processing may result in a high risk to individuals’ rights (Article 35 of the GDPR).<\/td>\n<\/tr>\n
Privacy by design<\/strong><\/td>\nThe obligation to incorporate data protection at the design stage of a process, product, or service (Article 25(1) of the GDPR).<\/td>\n<\/tr>\n
Privacy by default<\/strong><\/td>\nThe obligation to ensure that, by default, only data necessary for a specific purpose is processed (Article 25(2) of the GDPR).<\/td>\n<\/tr>\n
Legal basis for processing<\/strong><\/td>\nOne of the conditions under Article 6 of the GDPR that permits data processing\u2014for example, consent, performance of a contract, or the controller’s legitimate interests.<\/td>\n<\/tr>\n
Privacy notice<\/strong><\/td>\nInformation provided to the person whose data you collect\u2014explaining who processes it, for what purpose, on what basis, and what rights that person has (Articles 13\u201314 of the GDPR).<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

With these terms covered, we can move on to the specific steps.<\/p>\n

1. Map data flows before development begins<\/h2>\n

This is the starting point. Before you write the first line of code or configure a new tool, answer four questions:<\/p>\n

    \n
  1. Where is the data collected from? (form, API, import, partner integration)<\/li>\n
  2. Where does it go? (database, CRM, analytics tool, provider’s cloud)<\/li>\n
  3. Who has access to it? (product team, marketing, sales, external provider)<\/li>\n
  4. What operations are performed on it? (storage, segmentation, scoring, personalization, profiling)<\/li>\n<\/ol>\n

    The record of processing activities required by Article 30 of the GDPR is a natural tool for this analysis. It contains the controller’s details, the purposes of processing, categories of individuals and data, recipients, information on transfers outside the EU<\/a>, retention periods, and a description of the safeguards used.<\/p>\n

    Why is this important now rather than after launch?<\/strong> Every change to the data flow after the product has been launched requires updates to the record, privacy notices, terms and conditions, and data processing agreements. If you do it once, before launch, you save time and money. If you discover gaps after launch, you will have to redesign forms, obtain consent again, and amend your documentation.<\/p>\n

    According to data from the Polish Chamber of Digital Economy (the \u201ce-Accurate 2024″ report), the e-commerce sector<\/a> spends an average of PLN 159.5 thousand per company per year<\/strong> on compliance with the GDPR, the Omnibus Directive, and the DSA, totaling approximately PLN 55.4 billion for the entire market. This represents approximately 6% of the sector’s annual sales and 18\u201320% of its margin. A significant share of these costs is generated by post-implementation remediation.<\/p>\n

    2. Establish roles: who is the controller, who is the processor, and who is the joint controller<\/h2>\n

    For every new project involving external providers, you must determine who is responsible for what in relation to personal data. This is not a formality\u2014it is the foundation on which all documentation and accountability rest.<\/p>\n

    The three most common scenarios:<\/strong><\/p>\n\n\n\n\n\n\n\n
    Scenario<\/th>\nYour role<\/th>\nPartner’s role<\/th>\nWhat you need to prepare<\/th>\n<\/tr>\n<\/thead>\n
    You implement a CRM or marketing automation tool<\/td>\nController<\/td>\nProcessor<\/td>\nData processing agreement (Article 28 of the GDPR)<\/td>\n<\/tr>\n
    You launch a marketplace with partners<\/td>\nJoint controller (or controller + processor\u2014depending on the model)<\/td>\nJoint controller or processor<\/td>\nJoint controllership agreement (Article 26 of the GDPR) or data processing agreement<\/td>\n<\/tr>\n
    You integrate an external provider’s AI tool<\/td>\nController<\/td>\nProcessor (or independent controller\u2014depending on the model)<\/td>\nRole analysis + appropriate agreement<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

    A lack of clarity in this area is one of the most common sources of problems. An example from a UODO decision: DPD Polska was fined a total of more than PLN 11 million<\/strong>, among other things, for failing to have data processing agreements<\/a> with external carriers (a violation of Article 28(3) of the GDPR) and for failing to implement adequate organizational measures.<\/p>\n

    What to do:<\/strong><\/p>\n

      \n
    1. Review the list of all providers, partners, and tools involved in the project.<\/li>\n
    2. For each entity, determine whether it acts as a processor, joint controller, or independent controller.<\/li>\n
    3. Prepare the appropriate agreements before the data flow begins.<\/li>\n
    4. Plan regular reviews of processors\u2014at least once a year and whenever a breach is suspected.<\/li>\n<\/ol>\n

      3. Determine the legal basis for processing\u2014separately for each purpose<\/h2>\n

      This is the mistake I see most often: a company assumes it has \u201ctaken care of GDPR” because its terms and conditions include a consent clause. In reality, a single project generates several separate processing purposes\u2014and each of them requires its own legal basis<\/a>.<\/p>\n

      A typical breakdown for a new SaaS or e-commerce product:<\/strong><\/p>\n\n\n\n\n\n\n\n\n\n\n
      Purpose of processing<\/th>\nTypical legal basis (Article 6 of the GDPR)<\/th>\n<\/tr>\n<\/thead>\n
      Customer service, order fulfillment<\/td>\nPerformance of a contract (Article 6(1)(b))<\/td>\n<\/tr>\n
      Issuing invoices, accounting<\/td>\nLegal obligation (Article 6(1)(c))<\/td>\n<\/tr>\n
      Newsletter, marketing communications<\/td>\nConsent (Article 6(1)(a)) + consent to electronic communications (Act on Providing Services by Electronic Means)<\/td>\n<\/tr>\n
      Analytics, usage statistics<\/td>\nLegitimate interests of the controller (Article 6(1)(f))<\/td>\n<\/tr>\n
      Lead scoring, offer personalization<\/td>\nLegitimate interests (Article 6(1)(f))\u2014but a balancing test is required; consent is required for profiling that produces legal effects<\/td>\n<\/tr>\n
      Remarketing, behavioral advertising<\/td>\nConsent (Article 6(1)(a))<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

      The boundary between lawful analytics and high-risk profiling<\/strong> lies where data analysis begins to produce legal effects or similarly significant effects for an individual (Article 22 of the GDPR). Lead scoring in a CRM is not the same as automatically rejecting a loan application. But if your scoring system automatically excludes customers from accessing a service, you enter the area of automated decision-making, which requires additional safeguards and may require a DPIA.<\/p>\n

      Contact us<\/a> if you need support in determining the legal bases for a specific project.<\/p>\n

      4. Assess whether your project requires a DPIA<\/h2>\n

      Not every new project requires a DPIA. But every project requires a conscious decision<\/strong> as to whether a DPIA is necessary\u2014and that decision must be documented.<\/p>\n

      When is a DPIA required?<\/strong><\/p>\n

      The announcement of the President of the UODO dated 17 June 2019 (Monitor Polski, item 666) identifies 12 categories of processing operations<\/strong> for which a DPIA is required. The rule is: if your project meets at least two<\/strong> of the following criteria, conduct a DPIA.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
      No.<\/th>\nCriterion<\/th>\nExample in a new project<\/th>\n<\/tr>\n<\/thead>\n
      1<\/td>\nEvaluation, assessment, profiling, prediction<\/td>\nLead scoring, behavioral analysis of users<\/td>\n<\/tr>\n
      2<\/td>\nAutomated decision-making with legal effects<\/td>\nAutomatic rejection of an application, recruitment decisions<\/td>\n<\/tr>\n
      3<\/td>\nSystematic monitoring of public areas involving the recognition of characteristics<\/td>\nVideo surveillance with facial analysis<\/td>\n<\/tr>\n
      4<\/td>\nProcessing of special categories of data<\/td>\nHealth, biometric, and genetic data<\/td>\n<\/tr>\n
      5<\/td>\nBiometric data for identification or access control<\/td>\nFingerprint scanners, facial recognition<\/td>\n<\/tr>\n
      6<\/td>\nGenetic data<\/td>\nGenetic testing, health profiling<\/td>\n<\/tr>\n
      7<\/td>\nLarge-scale processing<\/td>\nA large number of individuals, a broad scope of data, a long retention period<\/td>\n<\/tr>\n
      8<\/td>\nCombining data from different sources<\/td>\nCRM data + online activity + location data<\/td>\n<\/tr>\n
      9<\/td>\nData concerning individuals in a dependent relationship<\/td>\nEmployees, students, patients<\/td>\n<\/tr>\n
      10<\/td>\nInnovative technological solutions<\/td>\nIoT, advanced AI systems, new cloud solutions<\/td>\n<\/tr>\n
      11<\/td>\nProcessing that prevents access to a service<\/td>\nAutomatic exclusion from recruitment with no right of appeal<\/td>\n<\/tr>\n
      12<\/td>\nLocation data<\/td>\nReal-time tracking via GPS, IoT sensors<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

      Important:<\/strong> If your project meets two criteria but you nevertheless believe that a DPIA is not necessary, you must document and justify this in detail. The more criteria an operation meets, the more evident the need to conduct an assessment.<\/p>\n

      A DPIA must be conducted before processing begins<\/strong>\u2014not after the project has been launched.<\/p>\n

      5. Implement privacy by design and privacy by default in the product architecture<\/h2>\n

      Article 25 of the GDPR is not bureaucracy. It is an element of a good product. Implementing the principles of privacy by design<\/a><\/strong> and privacy by default<\/strong> at the design stage protects against costly changes after launch.<\/p>\n

      Privacy by design<\/strong> (Article 25(1)) means that data protection is incorporated at the design stage rather than \u201cbolted on” afterwards. It includes both technical measures (encryption, pseudonymization, access control) and organizational measures (policies, procedures, training).<\/p>\n

      Privacy by default<\/strong> (Article 25(2)) means that the product’s default settings process the minimum amount of data. There are four dimensions you need to check:<\/p>\n

        \n
      1. Scope of data collected<\/strong>\u2014by default, do not collect more than necessary. Review every form and remove fields that are not essential.<\/li>\n
      2. Scope of processing<\/strong>\u2014data collected for one purpose should not be used for other purposes by default.<\/li>\n
      3. Retention period<\/strong>\u2014set up automatic deletion or anonymization of data once the necessary period has expired.<\/li>\n
      4. Accessibility<\/strong>\u2014by default, data should be accessible only to those who need it. Predefined roles, masking of unnecessary information, and restricted permissions.<\/li>\n<\/ol>\n

        A UODO decision confirms the consequences of failing to implement privacy by design:<\/strong> In case DKN.5131.4.2024, the President of the UODO imposed fines totaling more than PLN 1,145,891<\/strong> for violations including Article 25(1) of the GDPR\u2014the failure to implement adequate technical measures when processing data using external storage media. In another decision (DKN.5131.17.2022), a fine of PLN 32,832<\/strong> was imposed for failing to conduct a risk analysis and implement measures to protect medical records.<\/p>\n

        The guidelines of the European Data Protection Board (EDPB, Guidelines 4\/2019) emphasize that Article 25 applies throughout the entire system life cycle<\/strong>: planning \u2192 design \u2192 implementation \u2192 operation \u2192 monitoring \u2192 updating \u2192 decommissioning. Every significant system modification, change of provider, or migration to the cloud requires these requirements to be reconsidered.<\/p>\n

        Practical tip for SaaS:<\/strong> In SaaS projects, implementation often comes down to configuring software, creating user accounts, and granting permissions. Despite the simplified implementation process, the obligations of privacy by design and by default still apply\u2014configure roles, permissions, and default privacy settings before making the product available to users.<\/p>\n

        6. Prepare documentation before launch\u2014not afterwards<\/h2>\n

        Complete GDPR documentation must be ready before the project is launched<\/strong>. The list of documents depends on the nature of the project, but the following set covers most scenarios:<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n
        Document<\/th>\nWhen it is needed<\/th>\nLegal basis<\/th>\n<\/tr>\n<\/thead>\n
        Privacy notice (privacy policy<\/a>)<\/td>\nWhenever data is collected from users<\/td>\nArticles 13\u201314 of the GDPR<\/td>\n<\/tr>\n
        Service terms and conditions containing data provisions<\/td>\nFor every digital service, e-commerce platform, and SaaS product<\/td>\nArticle 13 of the GDPR + Act on Providing Services by Electronic Means<\/td>\n<\/tr>\n
        Consent form (marketing, newsletter, profiling)<\/td>\nWhen consent is the legal basis for processing<\/td>\nArticle 6(1)(a), Article 7 of the GDPR<\/td>\n<\/tr>\n
        Data processing agreement<\/td>\nFor every provider processing data on your behalf<\/td>\nArticle 28 of the GDPR<\/td>\n<\/tr>\n
        Joint controllership agreement<\/td>\nWhen you and a partner jointly determine the purposes of processing<\/td>\nArticle 26 of the GDPR<\/td>\n<\/tr>\n
        Update to the record of processing activities<\/td>\nFor every new processing activity<\/td>\nArticle 30 of the GDPR<\/td>\n<\/tr>\n
        DPIA documentation<\/td>\nWhen the project meets the criteria on the UODO list<\/td>\nArticle 35 of the GDPR<\/td>\n<\/tr>\n
        Data breach response procedure<\/td>\nBefore launch\u2014not after the first incident<\/td>\nArticles 33\u201334 of the GDPR<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

        The cost of inaction:<\/strong> A data breach must be reported to the UODO<\/a> within 72 hours<\/strong> of becoming aware of the incident (Article 33 of the GDPR). If you do not have a data breach response procedure<\/a>, you will not make the deadline. A court enforcement officer was fined a total of approximately PLN 21 thousand<\/strong> for failing to report a breach and notify the affected individual.<\/p>\n

        Consent management in marketing automation tools:<\/strong> If you are implementing a CRM or marketing automation tool, configure the consent management module before launching a campaign. This includes managing multiple consents for different purposes, recording the history of consent changes (who changed the wording, when, and how), subscription and unsubscribe statistics, and displaying consent information on the contact timeline.<\/p>\n

        7. Take the AI Act into account if you are implementing artificial intelligence tools<\/h2>\n

        Since 2 February 2025<\/strong>, the first provisions of the AI Act<\/a> (EU Regulation 2024\/1689) have applied, including:<\/p>\n

          \n
        1. A ban on the use of emotion recognition systems<\/strong> in workplaces and educational institutions.<\/li>\n
        2. An AI literacy requirement<\/strong>\u2014organizations deploying AI systems must ensure that the people operating those systems have an appropriate level of competence.<\/li>\n
        3. Full application<\/strong> of the AI Act provisions for high-risk systems will begin on 2 August 2026<\/strong>.<\/li>\n<\/ol>\n

          Relationship between the AI Act and the GDPR:<\/strong> Article 2(7) of the AI Act explicitly states that the regulation does not affect obligations arising from the GDPR. This means that implementing an AI tool requires compliance with both regulations in parallel.<\/p>\n

          If your new project includes a chatbot, an automated customer service tool, a recommendation system, or AI-based scoring, check:<\/p>\n

            \n
          1. What personal data is fed into the AI system and on what legal basis.<\/li>\n
          2. Whether the AI provider acts as a processor or an independent controller.<\/li>\n
          3. Whether the processing requires a DPIA (scoring, profiling, automated decisions\u2014see section 4).<\/li>\n
          4. Whether the system falls into a prohibited or high-risk category under the AI Act.<\/li>\n
          5. Whether the team operating the tool has the required competence (AI literacy).<\/li>\n<\/ol>\n

            The AI Act also introduces an obligation to conduct an FRIA<\/strong> (fundamental rights impact assessment, Article 27 of the AI Act) for high-risk AI systems\u2014this is a separate assessment from a DPIA, although the two may complement each other.<\/p>\n

            GDPR checklist for a new project\u20149 self-assessment questions<\/h2>\n

            Before involving a lawyer, go through the following questions with the project owner. The answers will show you where the gaps are and what needs to be addressed.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n
            No.<\/th>\nQuestion<\/th>\nWhat to consider<\/th>\n<\/tr>\n<\/thead>\n
            1<\/td>\nWhat personal data do you collect and from whom?<\/td>\nCategories of individuals (customers, leads, employees) and categories of data (email, phone number, location, behavior)<\/td>\n<\/tr>\n
            2<\/td>\nFor what purpose do you process each category of data?<\/td>\nA separate legal basis for each purpose<\/td>\n<\/tr>\n
            3<\/td>\nWho is the controller and who is the processor?<\/td>\nA separate analysis for each provider and partner<\/td>\n<\/tr>\n
            4<\/td>\nDoes the project involve profiling, scoring, or automated decisions?<\/td>\nIf so, check whether you need a DPIA<\/td>\n<\/tr>\n
            5<\/td>\nAre you implementing an AI tool?<\/td>\nCheck your obligations under the AI Act and the GDPR in parallel<\/td>\n<\/tr>\n
            6<\/td>\nAre the privacy notices and terms and conditions ready?<\/td>\nThey must be available before any data is collected<\/td>\n<\/tr>\n
            7<\/td>\nHave data processing agreements with providers been signed?<\/td>\nBefore the data flow begins<\/td>\n<\/tr>\n
            8<\/td>\nDo the product’s default settings collect the minimum amount of data?<\/td>\nPrivacy by default\u2014review forms, permissions, and retention<\/td>\n<\/tr>\n
            9<\/td>\nDo you have a data breach response procedure?<\/td>\nNotification to the UODO within 72 hours, notification of individuals, breach register<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

            If you do not have an answer to any of these questions, it is a sign that the issue should be addressed before launch.<\/p>\n

            Who is responsible for GDPR in a new company project<\/h2>\n

            This question comes up with every implementation: is GDPR the responsibility of the CEO, the product owner, marketing, or IT?<\/p>\n

            The answer: responsibility for GDPR compliance rests with the data controller\u2014in other words, your company, represented by its management board.<\/strong> Operationally, however, coordination should be handled by the project owner, with the involvement of representatives from product, marketing, sales, and IT.<\/p>\n

            What we recommend:<\/strong><\/p>\n

              \n
            1. Organize a GDPR kick-off involving the project owner and representatives of every team that will come into contact with personal data.<\/li>\n
            2. Agree on a shared list of compliance activities and assign responsibility\u2014who prepares the notices, who configures the tools, and who signs the data processing agreements.<\/li>\n
            3. Appoint one person to coordinate the process\u2014this does not have to be the DPO (data protection officer), but it should be someone who monitors deadlines and ensures that the documentation is complete.<\/li>\n
            4. Prepare a brief decision-making document for the management board: a summary of risks, a list of conditions for a safe launch, and a go\/no-go recommendation from a data protection perspective.<\/li>\n<\/ol>\n

              Without a single list of activities and one coordinator, chaos ensues\u2014marketing collects data without a legal basis, sales launches a campaign without privacy notices, and IT integrates a tool without a data processing agreement.<\/p>\n

              How much does getting it right cost, and how much do post-launch fixes cost?<\/h2>\n

              The lack of precise empirical research on GDPR remediation costs in the SaaS and e-commerce sectors is a confirmed gap. However, the available indirect data makes it possible to build an estimate.<\/p>\n\n\n\n\n\n\n\n\n
              Category<\/th>\nEstimated cost<\/th>\n<\/tr>\n<\/thead>\n
              Preventive GDPR implementation<\/a> before launch (medium-sized SaaS\/e-commerce company)<\/td>\nPLN 100\u2013150 thousand<\/td>\n<\/tr>\n
              Remediation after non-compliance is discovered (redesign + re-consent + potential fine + lost revenue)<\/td>\nPLN 220\u2013250 thousand or more<\/td>\n<\/tr>\n
              Average annual cost of GDPR\/Omnibus\/DSA compliance for an e-commerce company<\/td>\nPLN 159.5 thousand<\/td>\n<\/tr>\n
              Redesigning a website for GDPR compliance<\/td>\nFrom tens of thousands to several hundred thousand PLN<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

              Intrum Justitia data indicates that the average cost of the initial GDPR implementation in SMEs is approximately PLN 32 thousand<\/strong>, and in large corporations\u2014approximately PLN 270 thousand<\/strong>. More than half of Polish companies were unable to estimate these costs.<\/p>\n

              SaaS specifics (multi-tenant architecture):<\/strong> A design flaw in a system where one instance serves multiple customers requires a correction that affects all customers at once. A campaign to obtain consent again (re-consent) results in a real decline in the number of marketing contacts\u2014the success rate for renewed consent is lower than for initial consent.<\/p>\n

              Estimated ROI from a preventive approach: approximately 100%<\/strong> over a multi-year horizon\u2014assuming that the difference between prevention and remediation costs is approximately PLN 120 thousand.<\/p>\n

              Get GDPR in order before launch\u2014not after the first inspection<\/h2>\n

              Getting GDPR in order before launching a new product is not an additional obligation that slows down implementation. It is something that accelerates the launch\u2014because it eliminates the risk of rework, gives the team clear rules, and protects the company from remediation costs.<\/p>\n

              The seven areas described in this article are the minimum you should cover before every new project:<\/p>\n

                \n
              1. Mapping data flows.<\/li>\n
              2. Establishing roles (controller, processor, joint controller).<\/li>\n
              3. Determining the legal bases for processing.<\/li>\n
              4. Assessing the need for a DPIA.<\/li>\n
              5. Implementing privacy by design and by default.<\/li>\n
              6. Preparing documentation.<\/li>\n
              7. Taking the AI Act into account when using AI tools.<\/li>\n<\/ol>\n

                If you are planning a new product, service, or sales channel and want to check whether your implementation is ready from a GDPR perspective\u2014contact us<\/a>. We will help you get your obligations in order before problems arise, not afterwards.<\/p>\n

                Frequently asked questions<\/h2>\n

                I am launching a new product in 6 weeks\u2014do I have enough time to get GDPR in order?<\/strong><\/p>\n

                Yes, provided that you start by mapping data flows and establishing roles with providers. Most documentation (notices, terms and conditions, data processing agreements) can be prepared within 3\u20134 weeks if you have a clear picture of the project. A DPIA\u2014if required\u2014takes additional time, so decide whether to conduct one as soon as possible.<\/p>\n

                How do I know whether my project requires a DPIA?<\/strong><\/p>\n

                Check the 2019 list published by the President of the UODO (Monitor Polski, item 666)\u2014it contains 12 categories of operations. If your project meets at least two criteria (e.g., profiling + large-scale processing), a DPIA is generally required. The assessment should be conducted by the data controller\u2014usually in cooperation with the DPO or an external adviser.<\/p>\n

                I am implementing a CRM and marketing automation\u2014will signing an agreement with the provider be enough?<\/strong><\/p>\n

                No. The agreement with the provider is a commercial agreement. In addition, you need a data processing agreement (Article 28 of the GDPR) governing the processing of data on your behalf. You must also configure the tool for privacy by default: limit the data collected by default, set access roles, and configure the consent management module.<\/p>\n

                If I only collect an email address and first name on a landing page, do I need to worry about GDPR?<\/strong><\/p>\n

                Yes. An email address and first name are personal data. You must have a legal basis for processing (usually consent to marketing communications), a privacy notice available alongside the form, and an entry in the record of processing activities. If the data is sent to an external tool (e.g., Mailchimp, HubSpot), you also need a data processing agreement.<\/p>\n

                Who in the company should be responsible for GDPR in a new project?<\/strong><\/p>\n

                Legal responsibility rests with the management board (the data controller). Operationally, coordination should be handled by the project owner, with the involvement of representatives from product, marketing, sales, and IT. Appoint one person to monitor deadlines and ensure that the documentation is complete\u2014this does not have to be the DPO.<\/p>\n

                Where is the boundary between lawful analytics and high-risk profiling?<\/strong><\/p>\n

                The boundary lies where data analysis begins to produce legal effects or similarly significant effects for an individual (Article 22 of the GDPR). Segmenting customers in a CRM for campaign purposes is not the same as automatically rejecting an application for a service based on an algorithm. If your scoring system automatically excludes people from accessing a service, you enter the area of automated decision-making, which requires a DPIA and additional safeguards.<\/p>\n","protected":false},"excerpt":{"rendered":"

                Review seven GDPR areas before launching a new product in Poland, from data flows and provider roles to DPIAs, privacy settings and AI tools.<\/p>\n","protected":false},"author":13,"featured_media":2567,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":"","sip_alt_url":"","sip_en_pl_url":"","sip_pair_uuid":"d6da5951-9205-4261-8e06-4354279d812a","sip_pair_state":"verified"},"categories":[1578],"tags":[1545,1533,1446,1644,1531,1534],"specialization":[1215],"practice_area":[],"class_list":["post-4425","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-gdpr","tag-ai-act-en","tag-data-breach","tag-gdpr","tag-high-risk-ai-systems-en","tag-personal-data-protection","tag-uodo-en","specialization-gdpr"],"acf":[],"_links":{"self":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts\/4425","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/users\/13"}],"replies":[{"embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/comments?post=4425"}],"version-history":[{"count":3,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts\/4425\/revisions"}],"predecessor-version":[{"id":4440,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts\/4425\/revisions\/4440"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/media\/2567"}],"wp:attachment":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/media?parent=4425"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/categories?post=4425"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/tags?post=4425"},{"taxonomy":"specialization","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/specialization?post=4425"},{"taxonomy":"practice_area","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/practice_area?post=4425"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}