{"id":4460,"date":"2026-10-28T11:31:13","date_gmt":"2026-10-28T11:31:13","guid":{"rendered":"https:\/\/sawaryn.com\/?p=4460"},"modified":"2026-10-28T11:31:33","modified_gmt":"2026-10-28T11:31:33","slug":"poland-job-posting-candidate-questions","status":"publish","type":"post","link":"https:\/\/sawaryn.com\/en\/publikacje\/poland-job-posting-candidate-questions\/","title":{"rendered":"A Job Posting Is a Legal Document. What You May and May Not Ask a Candidate"},"content":{"rendered":"

Open the most recent job posting published by your company. Check one thing: does it include the base salary or salary range? If not, your template has not been updated since 24 December 2025. And that is usually not the only problem with the document.<\/p>\n

A job posting<\/strong> may look like an HR document. A form to be completed. A template copied from a previous recruitment process or from the internet. In reality, it is a legal document governed by two legal regimes at once: the Labour Code<\/strong> and the GDPR<\/a><\/strong>. A single \u201crequired documents" paragraph can lead to the excessive processing of data belonging to hundreds of candidates. A single question about previous earnings \u2014 prohibited since December 2025 \u2014 can open the door to a compensation claim.<\/p>\n

In this article, I will guide you through four questions that determine the entire content of a recruitment advertisement. I will explain what data may be collected, what you cannot request, and provide a ready-to-use \u201callowed \/ not allowed" checklist following the amendment to the Labour Code<\/a>. At the end, you will find specific recommendations \u2014 what to change, in what order, and why it is worth doing before an inspection takes place.<\/p>\n

Key terms you need to know<\/h2>\n

Before we move on to the details, here are a few terms used throughout the article.<\/p>\n\n\n\n\n\n\n\n\n\n
Term<\/th>\nMeaning<\/th>\n<\/tr>\n<\/thead>\n
Article 22\u00b9 of the Labour Code<\/strong><\/td>\nAn exhaustive list of data that an employer may request from a candidate during recruitment \u2014 first name, surname, date of birth and contact details, while education and employment history may be requested only when necessary for the position concerned<\/td>\n<\/tr>\n
Article 18\u00b3ca of the Labour Code<\/strong><\/td>\nA provision in force since 24 December 2025 \u2014 it requires candidates to be informed of the base salary or salary range and prohibits questions about previous earnings<\/td>\n<\/tr>\n
Data minimisation principle (Article 5(1)(c) GDPR)<\/strong><\/td>\nPersonal data must be adequate, relevant and limited to what is necessary for the purpose of processing \u2014 in recruitment, this means collecting only what you genuinely need<\/td>\n<\/tr>\n
Privacy notice (Article 13 GDPR)<\/strong><\/td>\nThe obligation to inform candidates who processes their data, for what purpose, on what legal basis, for how long and what rights they have \u2014 this obligation must be fulfilled when the data is collected, i.e. in the job posting<\/td>\n<\/tr>\n
Special categories of data (Article 9 GDPR)<\/strong><\/td>\nData concerning health, disability, religion, sexual orientation or trade union membership \u2014 during recruitment, such data may be processed only when provided on the candidate\u2019s initiative and with their consent<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Four questions that determine the content of a job posting<\/h2>\n

Every recruitment advertisement can be reviewed using four questions. If you cannot answer any one of them, the template needs to be revised.<\/p>\n

1. Which legal regime applies to your employer?<\/h3>\n

A private employer is subject to the Labour Code and the GDPR. A local government entity is additionally subject to the Act on Local Government Employees and the regulation on remuneration. Copying a job posting template from a different legal regime (e.g. using a civil service recruitment template for an IT company) means that you are presenting candidates with a procedure you are not required to follow \u2014 and that you will subsequently fail to comply with.<\/p>\n

2. Which requirements are based on legislation and which are merely preferences?<\/h3>\n

In the private sector (IT, SaaS, e-commerce), there is no statutory list of qualifications for particular positions. As the employer, you must demonstrate a functional link between each requirement and the work performed in the position concerned. If you require a university degree for a position where it is not necessary, the requirement fails the test under Article 22\u00b9 \u00a7 2 of the Labour Code.<\/p>\n

Rule:<\/strong> an \u201cessential" requirement is one for which you can identify a specific task performed in the position, show that no less intrusive verification method is available, and demonstrate that it is applied consistently to all candidates. Everything else \u2014 experience, soft skills and \u201cnice-to-have" criteria \u2014 belongs in the \u201cadditional" column.<\/p>\n

3. What is the legal basis for processing each application field?<\/h3>\n

This is where the most common mistake arises: treating the candidate\u2019s consent as the legal basis for processing all data<\/strong>. In fact, consent is the appropriate legal basis only for data voluntarily provided beyond the scope permitted by the Labour Code \u2014 typically a photograph included in a CV.<\/p>\n\n\n\n\n\n\n\n\n
Data category<\/th>\nLegal basis<\/th>\nExample<\/th>\n<\/tr>\n<\/thead>\n
Data required by law (first name, surname, date of birth, contact details)<\/td>\nArticle 6(1)(c) GDPR in conjunction with Article 22\u00b9 of the Labour Code<\/td>\nFirst name and surname in the application form<\/td>\n<\/tr>\n
Data necessary for entering into a contract<\/td>\nArticle 6(1)(b) GDPR<\/td>\nConfirmation of qualifications required for the position<\/td>\n<\/tr>\n
Data voluntarily provided beyond the statutory list<\/td>\nArticle 6(1)(a) GDPR (consent)<\/td>\nPhotograph in a CV, additional certificates<\/td>\n<\/tr>\n
Special categories of data<\/td>\nArticle 9 GDPR + Article 22\u00b9b of the Labour Code<\/td>\nDisability certificate<\/a> \u2014 only when provided on the candidate\u2019s initiative<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Invalid consent \u2014 where the candidate cannot realistically refuse it \u2014 does not meet the requirement of being freely given. A refusal to give consent or its withdrawal cannot result in unfavourable treatment or constitute a reason for refusing employment (Article 22\u00b9a \u00a7 2 of the Labour Code).<\/p>\n

4. Where and when do you provide salary information?<\/h3>\n

Since 24 December 2025, Article 18\u00b3ca of the Labour Code has given you three alternative points at which to provide this information:<\/p>\n

    \n
  1. In the job posting.<\/li>\n
  2. Before the job interview \u2014 if it was not included in the job posting.<\/li>\n
  3. Before the employment relationship begins \u2014 if it was not provided earlier.<\/li>\n<\/ol>\n

    You may choose when to comply, not whether to comply. The salary or salary range must be based on objective, gender-neutral criteria<\/strong> \u2014 which means you need a pay scale or remuneration policy. Discretion alone is not enough.<\/p>\n

    The same provision prohibits asking candidates about their salary in their current or previous employment. Remove this question from the application form, the ATS configuration and the interview script.<\/p>\n

    Contact us<\/a> \u2014 we will help you prepare job posting templates that comply with the amended legislation.<\/p>\n

    Checklist: what is allowed, what is not allowed and what requires your decision<\/h2>\n

    The table below brings together the most common elements of recruitment advertisements and assigns a legal status to each one.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
    Job posting \/ recruitment element<\/th>\nAllowed<\/th>\nNot allowed<\/th>\nRequires the employer\u2019s decision<\/th>\n<\/tr>\n<\/thead>\n
    First name, surname, date of birth<\/td>\n\u2705<\/td>\n<\/td>\n<\/td>\n<\/tr>\n
    Contact details provided by the candidate<\/td>\n\u2705<\/td>\n<\/td>\n<\/td>\n<\/tr>\n
    Education, qualifications, employment history<\/td>\n<\/td>\n<\/td>\n\u2705 \u2014 only when necessary for the position<\/td>\n<\/tr>\n
    PESEL number, home address, bank account number<\/td>\n<\/td>\n\u274c during recruitment<\/td>\n<\/td>\n<\/tr>\n
    Question about previous earnings<\/td>\n<\/td>\n\u274c since 24.12.2025<\/td>\n<\/td>\n<\/tr>\n
    Salary or salary range information<\/td>\n\u2705 \u2014 mandatory<\/td>\n<\/td>\n\u2705 \u2014 when: in the job posting, before the interview or before employment begins<\/td>\n<\/tr>\n
    Photograph in a CV as a formal requirement<\/td>\n<\/td>\n\u274c \u2014 coerced consent to the use of the candidate\u2019s image<\/td>\n<\/td>\n<\/tr>\n
    Photograph voluntarily included in a CV by the candidate<\/td>\n\u2705 \u2014 on the basis of consent<\/td>\n<\/td>\n<\/td>\n<\/tr>\n
    National Criminal Register certificate<\/td>\n<\/td>\n<\/td>\n\u2705 \u2014 only when required by law or justified by the needs of the position<\/td>\n<\/tr>\n
    Medical certificate<\/td>\n<\/td>\n\u274c during recruitment \u2014 this is the employer\u2019s responsibility after hiring<\/td>\n<\/td>\n<\/tr>\n
    Health and disability data<\/td>\n<\/td>\n<\/td>\n\u2705 \u2014 only when provided on the candidate\u2019s initiative, with consent given in the form of a declaration<\/td>\n<\/tr>\n
    Age range in a job posting<\/td>\n<\/td>\n\u274c \u2014 discrimination<\/td>\n<\/td>\n<\/tr>\n
    \u201cYoung, dynamic team" in the description<\/td>\n<\/td>\n\u274c \u2014 indirect age discrimination<\/td>\n<\/td>\n<\/tr>\n
    Indicating a gender in the job title<\/td>\n<\/td>\n\u274c \u2014 unless it is a genuine occupational requirement<\/td>\n<\/td>\n<\/tr>\n
    GDPR privacy notice (Article 13)<\/td>\n\u2705 \u2014 mandatory when data is collected<\/td>\n<\/td>\n<\/td>\n<\/tr>\n
    Consent to future recruitment processes<\/td>\n<\/td>\n<\/td>\n\u2705 \u2014 separate and voluntary; it cannot be a condition for participating in the current recruitment process<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

    The most common mistakes in job postings \u2014 and how to fix them<\/h2>\n

    Mistake 1: no salary section<\/h3>\n

    The absence of salary information from a job posting template is a ready-made template age test<\/strong>: it means that the template has not been updated since December 2025. Add a \u201cProposed salary" section to the template with a two-part structure:<\/p>\n

      \n
    1. The amount of the base salary or its range.<\/li>\n
    2. A sentence stating that the rate is based on objective, gender-neutral criteria (e.g. the remuneration policy).<\/li>\n<\/ol>\n

      If your company does not have a pay scale, the Labour Code requirement means that you must create one. A range based on discretion does not meet the requirement of \u201cobjective criteria".<\/p>\n

      Mistake 2: using consent as the legal basis for processing all data<\/h3>\n

      A general clause stating \u201cI consent to the processing of my personal data" is not the appropriate legal basis for data required by law. The Polish Data Protection Authority indicates<\/a> that such consent is invalid \u2014 the candidate cannot realistically refuse it, so it does not meet the requirement of being freely given under Article 7 GDPR.<\/p>\n

      Divide the legal bases for processing in the privacy notice into three categories (see the table in the section on the four questions). Use consent only for data voluntarily provided beyond the scope permitted by the Labour Code.<\/p>\n

      Mistake 3: a \u201crequired documents" paragraph that asks for too much<\/h3>\n

      A CV with a photograph, a copy of a diploma, a National Criminal Register certificate, a PESEL number in the questionnaire and a medical certificate \u2014 at the recruitment stage, most of this package is excessive. Remove everything that you are not permitted to request before the employment relationship begins. Where you need confirmation of a fact (e.g. no criminal record), replace the document with a declaration from the candidate.<\/p>\n

      A pre-employment medical examination is the employer\u2019s obligation towards a person being hired (Article 229 \u00a7 1 of the Labour Code), not part of the application package.<\/p>\n

      Mistake 4: no specific retention period<\/h3>\n

      \u201cWe retain documents until they are no longer needed" does not comply with Article 5(1)(e) GDPR \u2014 the period must be specified or determinable. The Polish Data Protection Authority indicates<\/a> that the data of an unsuccessful candidate should be deleted immediately after the recruitment process ends, and longer retention requires a separate legal basis.<\/p>\n

      Enter a specific period in the job posting and the retention policy \u2014 e.g. destruction or return of documents no later than 3 months after the recruitment process ends \u2014 and set a reminder to ensure that the deadline is actually observed.<\/p>\n

      Mistake 5: discriminatory language hidden in the description<\/h3>\n

      Article 18\u00b3a \u00a7 1 of the Labour Code prohibits discrimination in access to employment. The National Labour Inspectorate indicates<\/a> that a job posting should not suggest preferences concerning gender, age or characteristics unrelated to the work. Article 18\u00b3ca \u00a7 3 of the Labour Code additionally requires job postings and job titles to be gender-neutral.<\/p>\n

      Phrases such as \u201cyoung person", \u201cman for manual work" or age ranges may constitute evidence that a discriminatory criterion has been applied. The candidate may claim compensation under Article 18\u00b3d of the Labour Code \u2014 at least one minimum monthly wage (from 1 January 2026 \u2014 PLN 4,806 gross), with no upper limit. In its judgment II PSKP 17\/21, the Supreme Court<\/a> confirmed that compensation under Article 18\u00b3d has a punitive function and is not limited to the actual financial loss suffered.<\/p>\n

      GDPR privacy notice \u2014 eight elements, not two sentences<\/h2>\n

      A privacy notice compliant with Article 13 GDPR is not just two sentences at the end of a job posting. You must fulfil the information obligation when the data is collected \u2014 i.e. in the job posting or application form.<\/p>\n

      A complete privacy notice includes:<\/p>\n

        \n
      1. Details of the controller (name, address, contact details).<\/li>\n
      2. Contact details of the data protection officer (if appointed).<\/li>\n
      3. The purposes and legal bases of processing \u2014 divided into three categories (legal requirement, contract, consent).<\/li>\n
      4. Recipients of the data and information about processing on behalf of the controller (e.g. the ATS provider).<\/li>\n
      5. Information confirming that no transfer outside the EEA<\/a> takes place \u2014 or details of the safeguard mechanism if such a transfer occurs.<\/li>\n
      6. The retention period \u2014 a specific period, not \u201cuntil the data is no longer needed".<\/li>\n
      7. A list of the candidate\u2019s rights: access, rectification, erasure, restriction of processing, data portability, objection, withdrawal of consent and the right to lodge a complaint with the President of the Polish Data Protection Authority.<\/li>\n
      8. Information on whether the provision of data is voluntary, the consequences of failing to provide it, and the absence of automated decision-making and profiling.<\/li>\n<\/ol>\n

        If you use an ATS, check whether its configuration allows the full privacy notice to be displayed before an application is submitted. The ATS provider is a processor within the meaning of Article 28 GDPR, which requires a data processing agreement. Before selecting a provider, verify the location of the data, the subprocessors, the legal basis for transfers outside the EEA and the mechanisms for deleting data after the retention period expires.<\/p>\n

        Controlling access to candidate data \u2014 who can see applications<\/h2>\n

        Applications arriving in a shared email inbox that half the team can access are a problem. On their own initiative, a candidate may attach a disability certificate or include information about their health or trade union membership. Special categories of data then end up in a location with no access controls.<\/p>\n

        Article 22\u00b9b of the Labour Code requires access to special categories of data to be restricted to persons authorised in writing. Such authorisation is a formal document issued by the data controller \u2014 it must specify the scope and purpose and be acknowledged by the authorised person\u2019s signature.<\/p>\n

        What to do:<\/p>\n

          \n
        1. Restrict access to the recruitment inbox and CV folders to people directly involved in the recruitment process.<\/li>\n
        2. Introduce written authorisations for every person who may view candidate data.<\/li>\n
        3. If you use an ATS, configure roles and permissions so that special categories of data are visible only to designated individuals.<\/li>\n<\/ol>\n

          B2B recruitment \u2014 do the same rules apply to contracts?<\/h2>\n

          Article 22\u00b9 of the Labour Code applies only to employee recruitment (employer \u2014 person applying for employment). It does not automatically extend to the recruitment of B2B contractors.<\/p>\n\n\n\n\n\n\n\n\n\n\n
          Aspect<\/th>\nEmployee recruitment<\/th>\nB2B recruitment<\/th>\n<\/tr>\n<\/thead>\n
          List of data<\/td>\nExhaustive \u2014 Article 22\u00b9 of the Labour Code<\/td>\nNo separate list \u2014 apply GDPR principles<\/td>\n<\/tr>\n
          Legal basis for processing<\/td>\nArticle 6(1)(b) and (c) GDPR<\/td>\nArticle 6(1)(b) GDPR (steps taken prior to entering into a contract) or point (f) (legitimate interest)<\/td>\n<\/tr>\n
          Obligation to disclose remuneration<\/td>\nYes \u2014 Article 18\u00b3ca of the Labour Code<\/td>\nNo confirmed statutory obligation<\/td>\n<\/tr>\n
          Prohibition on asking about earnings<\/td>\nYes \u2014 since 24.12.2025<\/td>\nNo confirmed statutory prohibition<\/td>\n<\/tr>\n
          GDPR data minimisation principle<\/td>\nYes<\/td>\nYes<\/td>\n<\/tr>\n
          GDPR privacy notice<\/td>\nYes<\/td>\nYes<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

          In a B2B job posting, determine the scope of the data requested according to the purpose of the planned contract and GDPR principles, rather than the list in Article 22\u00b9. Providing the rate in a B2B job posting may be good recruitment practice, but as of today it is not a statutory obligation.<\/p>\n

          Note: Directive (EU) 2023\/970 on pay transparency, which must be implemented by 7 June 2026<\/a>, applies to employment relationships. However, it cannot be ruled out that the Polish implementing legislation will extend its personal scope to some contractors \u2014 particularly individuals who perform work personally without subcontractors. Check the current legislative position before publishing a B2B job posting.<\/p>\n

          Recruitment agency and job board \u2014 who is responsible for the content of the job posting?<\/h2>\n

          Passing discriminatory requirements to a recruitment agency does not release you from liability. Responsibility for the content of a job posting rests primarily with the entity that created, approved or knowingly published it.<\/p>\n

          An agency\u2019s status under the GDPR depends on the cooperation model:<\/p>\n

            \n
          1. If the agency processes data solely on your instructions, it is a processor (Article 28 GDPR) and requires a data processing agreement.<\/li>\n
          2. If the agency jointly determines the purposes and means of processing, the parties may be joint controllers (Article 26 GDPR), which requires a separate agreement defining their respective responsibilities.<\/li>\n
          3. The mere fact of acting as an intermediary in publishing a job posting does not in itself establish joint controllership \u2014 in its judgment in Case C-683\/21, the CJEU<\/a> indicated that the purposes and means of processing must be determined jointly.<\/li>\n<\/ol>\n

            The Act of 20 March 2025 on the Labour Market and Employment Services<\/a> prohibits the publication of vacancies that violate equal treatment principles in the ePraca system.<\/p>\n

            What are the consequences of a defective job posting? Three areas of risk<\/h2>\n\n\n\n\n\n\n\n
            Area<\/th>\nAuthority \/ entity<\/th>\nLegal basis<\/th>\nConsequences<\/th>\n<\/tr>\n<\/thead>\n
            GDPR<\/td>\nPresident of the Polish Data Protection Authority<\/td>\nArticle 83 GDPR<\/td>\nAdministrative fine of up to EUR 20 million or 4% of annual worldwide turnover (Polish Data Protection Authority<\/a>)<\/td>\n<\/tr>\n
            Employment law \u2014 discrimination<\/td>\nLabour court (on the candidate\u2019s initiative)<\/td>\nArticle 18\u00b3d of the Labour Code<\/td>\nCompensation of at least one minimum monthly wage (PLN 4,806 gross from 1.01.2026), with no upper limit<\/td>\n<\/tr>\n
            Employment law \u2014 inspection<\/td>\nNational Labour Inspectorate<\/td>\nArticle 18\u00b3ca, Article 22\u00b9 of the Labour Code<\/td>\nInspection and potentially an offence under Article 282 \u00a7 1 of the Labour Code (if the conduct meets the statutory elements of the offence)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

            The three areas can overlap. A single defective job posting creates GDPR risk (excessive data concerning hundreds of candidates), employment law risk (an inspection by the National Labour Inspectorate) and civil liability risk (a candidate\u2019s compensation claim). After the recruitment process ends, a candidate may also request access to their data (Article 15 GDPR) and its erasure (Article 17 GDPR).<\/p>\n

            Pay Transparency Directive \u2014 what else is coming?<\/h2>\n

            Article 18\u00b3ca of the Labour Code partially anticipates Directive (EU) 2023\/970<\/a>, which should be fully implemented by 7 June 2026. The Directive introduces a broader system of obligations than Article 18\u00b3ca alone:<\/p>\n

              \n
            1. An employee\u2019s right to information on average pay levels, broken down by sex (Article 7 of the Directive).<\/li>\n
            2. An obligation to report on the gender pay gap \u2014 annually for employers with \u2265250 employees (first report by 7 June 2027), every 3 years for employers with 150\u2013249 employees, and every 3 years for employers with 100\u2013149 employees (by 7 June 2031).<\/li>\n
            3. Where there is a pay gap of \u22655% in any category, which is not justified by objective criteria and has not been remedied within 6 months \u2014 a joint pay assessment with workers\u2019 representatives (Article 10 of the Directive).<\/li>\n<\/ol>\n

              As of today, there is no confirmation that Poland has adopted comprehensive legislation implementing all the Directive\u2019s requirements. However, if you employ \u2265100 people, start preparing pay record systems broken down by sex and job category. The reporting deadlines follow soon after the implementation date.<\/p>\n

              What to do now \u2014 order of actions<\/h2>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
              Priority<\/th>\nAction<\/th>\nCategory<\/th>\n<\/tr>\n<\/thead>\n
              1<\/td>\nOpen every job posting template in use and check whether it includes the base salary or salary range. If it does not, the template must be corrected immediately.<\/td>\nAudit<\/td>\n<\/tr>\n
              2<\/td>\nRemove the question about previous earnings from the application form, ATS and interview script. Give recruiters clear instructions.<\/td>\nProcess change<\/td>\n<\/tr>\n
              3<\/td>\nDivide the legal bases for processing in the privacy notice into three categories. Use consent only for data provided voluntarily.<\/td>\nDocumentation<\/td>\n<\/tr>\n
              4<\/td>\nRemove from the \u201crequired documents" paragraph everything that cannot be requested during recruitment (PESEL number, address, bank account number, photograph, medical certificate, National Criminal Register certificate).<\/td>\nDocumentation<\/td>\n<\/tr>\n
              5<\/td>\nSpecify a particular retention period for candidate documents in the job posting and retention policy (e.g. 3 months after the recruitment process ends). Set a reminder.<\/td>\nProcess change<\/td>\n<\/tr>\n
              6<\/td>\nExpand the privacy notice to include all 8 elements required by Article 13 GDPR.<\/td>\nDocumentation<\/td>\n<\/tr>\n
              7<\/td>\nDivide requirements into \u201cessential" (based on legislation or justified by the needs of the position) and \u201cadditional" (an advantage).<\/td>\nDocumentation<\/td>\n<\/tr>\n
              8<\/td>\nReview the job posting for discriminatory language. Remove age ranges, gender references and phrases such as \u201cyoung, dynamic team".<\/td>\nLegal review<\/td>\n<\/tr>\n
              9<\/td>\nRestrict access to the recruitment inbox. Introduce written authorisations.<\/td>\nProcess change<\/td>\n<\/tr>\n
              10<\/td>\nTrain managers conducting recruitment on the \u201callowed \/ not allowed" list. Do not publish a job posting without approval.<\/td>\nTraining<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

              We can help you with this<\/h2>\n

              Correcting a single job posting template is not enough if the problem affects the entire recruitment process \u2014 from the ATS configuration and application forms to interview scripts and document retention.<\/p>\n

              Our support is available in three options tailored to the scale of the problem:<\/p>\n

                \n
              1. Operational minimum<\/strong> \u2014 a corrected job posting template, a complete Article 13 GDPR privacy notice, a salary section compliant with Article 18\u00b3ca of the Labour Code and a ready-to-use \u201callowed \/ not allowed" list for recruiters.<\/li>\n
              2. Solid foundation<\/strong> \u2014 a review of the entire recruitment process: the ATS (mandatory fields, consent checkboxes, processing arrangements), application submission channels, retention, access rights and interview scripts.<\/li>\n
              3. Comprehensive protection<\/strong> \u2014 GDPR documentation for recruitment, a retention policy, training for recruiters and managers, and support during an inspection by the National Labour Inspectorate or the Polish Data Protection Authority.<\/li>\n<\/ol>\n

                We begin by auditing what you already have \u2014 and identify what needs to be changed, in what order and why. No theory, just specific wording ready to implement.<\/p>\n

                Contact us<\/a><\/p>\n

                A job posting is a legal document \u2014 put it in order before an inspection takes place<\/h2>\n

                A recruitment advertisement is governed by two legal regimes: the Labour Code and the GDPR. Since 24 December 2025, these have also included the obligation to provide salary information and the prohibition on asking about previous earnings. A single outdated template is replicated in every subsequent recruitment process and affects the data of every applicant.<\/p>\n

                Review your templates. Remove excessive fields. Complete the privacy notice. Add a salary range. Train your team. If you need support reviewing job postings, forms and recruitment processes \u2014 contact us<\/a>.<\/p>\n

                Frequently asked questions<\/h2>\n

                Do I have to include the salary range in the job posting, or is it enough to tell the candidate before the interview?<\/strong>
                \nArticle 18\u00b3ca of the Labour Code gives you three alternative points at which to provide the information: in the job posting, before the job interview or, at the latest, before the employment relationship begins. You choose the timing, but the obligation itself is unconditional. If you do not provide salary information in the job posting, you must do so before the candidate attends the interview. The salary or salary range must be based on objective, gender-neutral criteria.<\/p>\n

                Can I still ask candidates about their salary expectations?<\/strong>
                \nAsking about a candidate\u2019s salary expectations (how much they would like to earn) is not the same as asking about their previous earnings. Article 18\u00b3ca prohibits questions about remuneration in current and previous employment relationships. The question \u201cHow much would you like to earn?" is not expressly covered by this prohibition \u2014 but given the employer\u2019s obligation to provide a salary range, it is becoming less relevant in practice.<\/p>\n

                How long can I retain applications from unsuccessful candidates, and may I keep them for future recruitment processes?<\/strong>
                \nThe data of an unsuccessful candidate should be deleted immediately after the recruitment process ends. Longer retention requires a separate legal basis: defence against claims (based on Article 291 \u00a7 1 of the Labour Code \u2014 a 3-year limitation period) or the candidate\u2019s consent to future recruitment processes. Consent must be voluntary, specific and capable of being withdrawn \u2014 it cannot be a condition for participating in the current recruitment process. A talent pool requires a separate purpose, a separate legal basis and a defined retention period disclosed to the candidate.<\/p>\n

                What should I do with a CV in which the candidate has voluntarily included information about their health, children or trade union membership?<\/strong>
                \nSpecial categories of data provided on the candidate\u2019s initiative may be processed on the basis of their consent given in the form of a declaration (Article 22\u00b9b of the Labour Code, Article 9 GDPR). Only persons authorised in writing may access such data. If applications arrive in a shared inbox, restrict access to it and introduce written authorisations. Do not request this data \u2014 but if the candidate provides it, secure it in accordance with the law.<\/p>\n

                Do the same rules apply when recruiting for B2B contracts?<\/strong>
                \nArticle 22\u00b9 of the Labour Code and Article 18\u00b3ca apply only to employee recruitment. In B2B recruitment, you determine the scope of the data requested according to the purpose of the planned contract and GDPR principles (data minimisation, a privacy notice and a defined retention period). The obligation to disclose remuneration and the prohibition on asking about earnings currently have no confirmed statutory equivalent for B2B arrangements \u2014 but Directive (EU) 2023\/970 may change this once it has been fully implemented into Polish law.<\/p>\n

                What are the potential consequences of a defective job posting \u2014 an inspection by the National Labour Inspectorate, a complaint to the Polish Data Protection Authority or a lawsuit by a candidate?<\/strong>
                \nAll three. Excessive data creates a risk of a fine from the Polish Data Protection Authority (up to EUR 20 million or 4% of turnover). Discriminatory requirements open the door to a candidate\u2019s compensation claim (at least one minimum monthly wage, with no upper limit). Failure to provide salary information or asking about previous earnings may be investigated by the National Labour Inspectorate. These risks can overlap \u2014 a single defective job posting can create exposure on all three fronts.<\/p>\n","protected":false},"excerpt":{"rendered":"

                Review Polish job postings against the Labour Code and GDPR: learn which candidate data to request, when to share salary information and what questions to avoid.<\/p>\n","protected":false},"author":13,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":"","sip_alt_url":"","sip_en_pl_url":"","sip_pair_uuid":"fe14f77a-ae53-4219-a07c-7a9612f658d3","sip_pair_state":"verified"},"categories":[1578,1442],"tags":[1530,1446,1531,1558,1534],"specialization":[1212],"practice_area":[],"class_list":["post-4460","post","type-post","status-publish","format-standard","hentry","category-gdpr","category-labor-law","tag-b2b-agreement","tag-gdpr","tag-personal-data-protection","tag-pip-en","tag-uodo-en","specialization-labor-law"],"acf":[],"_links":{"self":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts\/4460","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/users\/13"}],"replies":[{"embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/comments?post=4460"}],"version-history":[{"count":2,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts\/4460\/revisions"}],"predecessor-version":[{"id":4463,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts\/4460\/revisions\/4463"}],"wp:attachment":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/media?parent=4460"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/categories?post=4460"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/tags?post=4460"},{"taxonomy":"specialization","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/specialization?post=4460"},{"taxonomy":"practice_area","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/practice_area?post=4460"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}