GDPR Compliance for a Polish Branch of a Foreign Company: Eight Steps in the Right Order

GDPR Compliance for a Polish Branch of a Foreign Company: Eight Steps in the Right Order

You register a branch in Poland and commission an employee privacy notice. The notice must name the data controller—but you have not yet established who that is. If it names the branch when the controller is the foreign company, the notice and any other documents built on that assumption must be reissued.

This is a common sequencing problem for foreign groups opening Polish branches. They begin with visible documents—privacy notices and policies—before making the decisions that determine what those documents must say. The result is duplicated work and a risk of complaints to the President of Poland’s Personal Data Protection Office (UODO).

The better approach is to establish roles, map the activities taking place in Poland, and classify the group’s data flows before drafting the documents that depend on those findings. This article sets out an eight-step startup package, explains why a conventional audit is usually premature, and shows how to plan work that depends on answers from a head office abroad.

The concepts that determine the approach

A Polish branch is an organizational unit of the foreign company, not a separate legal entity. That distinction affects who is named in privacy notices, whose record of processing activities is updated, and whether an agreement between the branch and head office has any purpose.

The GDPR applies directly in Poland, as it does across the EU. The branch does not need a separate “Polish GDPR.” It does, however, need the controller’s compliance documents and procedures to reflect what actually happens in Poland.

Why a conventional audit is premature

An audit examines existing operations, documents, and procedures against applicable requirements. A newly registered branch may have little to examine: its processes are being established, and essential information may still sit with the head office.

At this stage, commission a map of the processing activities carried out in Poland instead. Identify the categories of people and data, local and group systems, vendors, and process owners. The output is a specification of what must be built, not a report on deficiencies in an established system.

An audit has its place in a second phase, once the startup documentation and procedures are operating.

The eight-step startup sequence

Each step supplies information needed for the next. There may be urgent work to do in parallel—for example, a recruitment notice before the first CV arrives—but drafting without establishing the underlying facts creates avoidable rework.

Step 1: Record the roles and responsibilities

Before preparing notices, records, or procedures, document:

1. Who the controller is. As a rule, this is the foreign parent company, not its Polish branch.
2. The branch’s position within the controller’s organization.
3. Which authority can receive complaints. The President of UODO can receive a complaint with a Polish connection under Article 77(1) GDPR. The authority that subsequently leads a cross-border matter may depend on the group’s structure.
4. Whether the head office’s data protection officer (DPO) covers the branch and has been notified to the competent authority. Article 37(2) GDPR permits a group to appoint one DPO.
5. Who the operational contacts are at the branch and head office.

A one-page roles memo is a useful deliverable. Without it, every later document risks naming the wrong entity.

A typical failure starts when the head office sends an employee notice naming the Polish branch as controller. Employees receive it; a month later, the group establishes that the foreign company is the controller. The notice—and other documents using the same identification—then needs replacing.

Step 2: Map processing in Poland

Collect the facts about the branch’s activities:

• Categories of people: employees, job candidates, business-to-business (B2B) contractors, representatives of business partners, and customers.
• Categories of personal data for each group.
• Local and group systems, including HR information systems, customer relationship management systems, email, and messaging tools.
• Service providers involved in processing.
• The owner of each process at the branch.

Some answers will come from Poland; others must come from the head office. Build time for that correspondence into the schedule. A package containing roughly a dozen hours of work may be spread across four months because the project is waiting for inputs—not because the drafting itself takes four months.

Step 3: Classify relationships within the group

Do not treat the head office, its branch, and separate group companies as interchangeable.

Head office and branch: This is an internal allocation of tasks within one controller. A data processing agreement under Article 28 GDPR between the head office and its own branch has no separate legal subject matter. It creates the appearance of compliance without resolving the underlying responsibilities. Document the allocation in internal arrangements or a group policy instead.

Separate group companies: Where the branch shares offices, staff, or systems with a sister company, classify the entities’ actual roles before choosing an instrument.

A shared office and common systems do not, by themselves, answer whether the relationship involves processing on behalf of another entity, joint controllership, or disclosure between independent controllers. If no one makes that determination, the group may be unable to explain the data flow when a complaint or inspection arises.

Review existing group data processing agreements. Remove those purportedly made between the head office and its own branch, then classify the relationship with each separate group company. If you need help with that classification, contact us.

Step 4: Prepare the privacy notices

Once you know the controller, processes, and relevant relationships, prepare the notices required by Articles 13 and 14 GDPR. They must identify the foreign legal entity as controller, acting through its Polish branch—not name the branch as controller.

The set should cover at least:

1. Employees: Article 13 GDPR and Article 22¹ of the Polish Labour Code.
2. Job candidates: The information obligation arises when the first CV is received.
3. Civil-law and B2B contractors.
4. Business partners and their representatives: Include Article 14 GDPR information where data is obtained indirectly, such as through business cards, emails, or referrals.
5. Customers: If the branch serves them.

The notices must address the controller’s identity, purposes and legal bases, recipients, transfers outside the EEA, retention periods, individual rights, the right to complain to the President of UODO, and whether providing the data is obligatory.

Recruitment changes the immediate priority. If the branch is already recruiting, prepare the relevant HR and candidate notices in the first month rather than waiting for every other startup document. The need for correct information does not wait for completion of the package. Incorrectly identifying the controller under Article 13(1)(a) GDPR falls within the penalty tier in Article 83(5)(b): up to EUR 20 million or 4% of total worldwide annual turnover (Article 83 GDPR).

Step 5: Trace data flows and transfers

Describe every flow to the head office and between group entities. For each, ask:

1. Is the flow internal to one controller, between the head office and its branch?
2. Is an actual recipient a separate company or vendor?
3. Does the data go outside the EEA?
4. If so, which transfer instrument applies?

Consider HR data sent to a UK head office. The UK adequacy decision may appear to settle the transfer question. But if the actual recipient is another group company rather than the controller, you must also identify that company’s role and the basis for the disclosure or processing arrangement. An adequacy decision does not establish who may receive the data or in what capacity.

Apply the same discipline to group systems. A common chain is controller (parent company) → processor (group company operating a system) → subprocessor (software-as-a-service provider). Identify the Article 28 arrangements at each relevant level, including the requirements in Article 28(3) GDPR. Under Article 28(2), a processor needs the controller’s prior written authorization before engaging a subprocessor.

For the UK, Decision 2021/1772 was extended by Decision 2025/1226. Monitor its period of application. If there is no applicable adequacy decision, appropriate safeguards under Article 46 GDPR are needed, such as standard contractual clauses (SCCs), binding corporate rules (BCRs), or another approved mechanism.

Step 6: Update the records and document accountability

After mapping the processes and drafting the notices, update the controller’s record of processing activities under Article 30(1) GDPR for the activities carried out in Poland. The record and notices must describe those activities consistently.

The record should include, among other matters:

• The foreign controller’s name and contact details, rather than the branch’s name as a separate controller.
• Purposes of processing.
• Categories of individuals and personal data.
• Recipients.
• Transfers outside the EEA.
• Planned retention periods.
• A description of technical and organizational measures under Article 32 GDPR.

Mark information still awaited from the head office “to be confirmed.” That is preferable to leaving fields blank without explanation or filling them with guesses.

Failure to maintain the record falls within the Article 83(4)(a) GDPR penalty tier: up to EUR 10 million or 2% of total worldwide annual turnover. The President of UODO’s decision DKN.5112.27.2022 addressed, among other matters, failure to maintain a record of processing activities.

Step 7: Establish request and breach procedures

The branch needs working routes for individual requests and incidents before the first one arrives.

Individual rights requests (Articles 12–22 GDPR). The branch may be the local contact point, but the head office, as controller, is responsible for handling the request. Set a forwarding route and internal deadlines shorter than the one-month period under Article 12(3). Internal discussions do not stop that period from running.

Personal data breaches (Articles 33–34 GDPR). Establish an escalation contact, an internal reporting form, and a record covering breaches even when they are not notified to an authority. The branch must pass information to the head office quickly enough for the controller to make the notification decision. Where notification to a supervisory authority is required, Article 33(1) sets a 72-hour period from awareness.

Without an escalation point, the first breach may sit in an unanswered email while the 72-hour period runs. Failure to have a breach response procedure may lead to sanctions of up to EUR 20 million or 4% of turnover.

Step 8: Close the package with a risk and open-items list

The final deliverable should state:

1. What has been completed, and its scope.
2. What remains open, with a risk level and recommendation.
3. What belongs in a second phase.

Give this document to the management board. It helps demonstrate the controller’s accountability under Articles 5(2) and 24 GDPR, while preventing a completed startup package from being mistaken for completion of every possible GDPR task.

Define what the startup package excludes

A clear scope says not only what will be delivered but also what remains unresolved. Typical exclusions are:

Record the exclusions together with their risks. Otherwise, decision-makers may reasonably but incorrectly assume that “the GDPR project is finished.”

Plan around the head office’s response time

A foreign branch project often depends more on the availability of information than on drafting hours. Three scheduling rules make that dependency visible:

1. Start the service deadline for each deliverable when its complete inputs arrive, not automatically when the engagement is signed.
2. Set one hours cap for the whole package, covering head office correspondence and one round of comments on each deliverable. Allow hours to move between items if one proves harder and another simpler.
3. Show dependencies beside each deliverable. The schedule should say which earlier findings are needed before the next item can be completed.

This explains how a project involving eight deliverables and a dozen or so working hours can have a four-month window: much of that window may be reserved for replies from abroad. Faster replies can shorten the project; slow replies extend the schedule.

Train branch process owners on the controller’s identity

Give HR, administration, and sales staff one rule they can apply every day: the branch is not the controller. Notices, letters, and responses to requests should identify the foreign company acting through its Polish branch.

Practical mistakes are easy to make. HR may issue a notice naming the branch; administration may sign an access-request response as if the branch were the controller; sales may collect a business partner representative’s details without addressing the Article 14 information obligation. A short, focused training session can prevent these recurring errors.

Understand where a Polish complaint may go

An employee of a Polish branch can lodge a complaint with the President of UODO under Article 77(1) GDPR, even when the controller is a foreign company. What happens after receipt depends on the controller’s structure:

1. Main establishment in another EU Member State: The matter may involve the lead supervisory authority there under Article 56(1) GDPR, with UODO cooperating through the Article 60 mechanism.
2. Controller based outside the EU with a Polish branch as an establishment: The GDPR applies under Article 3(1), and the President of UODO may have jurisdiction in relation to the branch’s activities.
3. A lead-authority decision: Under Article 60(11), it binds the controller in relation to all of its establishments in the Union, including the Polish branch.

For the head office, a complaint may therefore mean proceedings in Polish, involving Polish employment practices and an authority with which it has not previously dealt. Agree on the route for supervisory-authority correspondence at startup.

A controller with a branch in the EU that operates as an establishment carrying out actual processing-related activities is subject to the GDPR under Article 3(1) and, as a rule, need not appoint an additional representative under Article 27 GDPR. The Polish branch is not automatically an Article 27 representative: establishment and representation are different legal functions.

What Polish branch registration does—and does not—establish

A foreign undertaking’s Polish branch is registered in the National Court Register (Krajowy Rejestr Sądowy, or KRS). The Act of March 6, 2018 on the Rules Governing the Participation of Foreign Undertakings provides for:

• Article 16: Appointment of a person authorized to represent the foreign undertaking at the branch.
• Article 17: KRS entry as a condition for starting business operations.
• Article 19: Use of the foreign undertaking’s business name with the designation “branch in Poland.”

Entering a representative in the KRS does not create a separate data controller. The notices and record must identify the entity that determines the purposes and means of processing—as a rule, the foreign legal entity. The Regional Court in Warsaw (XXIII Gz 356/24 and 357/24, July 15, 2024) confirmed that a person disclosed in the KRS may receive correspondence addressed to the foreign undertaking. That concerns representation, not controller status.

Polish employment requirements begin with recruitment

A branch employing people in Poland must account for the Polish Labour Code regardless of where the controller is based. Three points require attention from the outset:

1. Candidate data: Article 22¹ of the Labour Code sets out an exhaustive list of data that may be requested from a candidate, including name, date of birth, education, and employment history. The Article 13 GDPR notice must name the actual controller—the foreign legal entity.
2. Special categories of data: Under Article 22¹b of the Labour Code, consent may be used to process special-category data about a candidate or employee only where that person provided the data on their own initiative.
3. Video surveillance: Article 22² § 1 of the Labour Code permits it only for employee safety, protection of property, production supervision, or protection of confidential information. Employees must be informed no later than two weeks before it begins; a new employee must be informed in writing before being allowed to start work (UODO guidance).

These requirements make the first recruitment activity an operational deadline, not a matter to leave until the end of a broader documentation project.

How we can help

We structure a branch startup package as a set of deliverables with defined inputs, acceptance criteria, dependencies, and exclusions. It covers:

1. A one-page roles memo identifying the controller, branch status, relevant authority, and contacts.
2. A process map covering people, data, systems, vendors, and owners.
3. Classification of group relationships and the instruments required for separate entities.
4. Privacy notices for employees, candidates, contractors, business partners, and, where applicable, customers.
5. Data-flow and transfer analysis for head office and group systems.
6. Entries in the controller’s record of processing activities for Polish operations.
7. Individual-request and breach procedures, with internal deadlines and escalation contacts.
8. A risk and open-items list identifying second-phase work.

The engagement can use one overall hours cap, flexible allocation between deliverables, deadlines starting when required inputs are received, and a written list of exclusions. Contact us to define a package for your group structure.

Key points for decision-makers

Sequence drives accuracy: establish the controller and roles, map processes, classify relationships, then prepare notices, assess flows, update the record, put procedures in place, and report open risks. Where recruitment is already underway, prioritize the notice needed for the first CV without guessing at the controller’s identity.

Do not sign a data processing agreement between a head office and its own branch. Allocate their tasks internally, then assess agreements with separate group companies and vendors.

Start a new branch with process mapping, not an audit of operations that do not yet exist. Return to an audit once there is an operating framework to test.

Frequently asked questions

Does our Polish branch need its own GDPR framework, or can it use the head office’s documents?

The GDPR applies directly across the EU; it is not separately implemented for the branch. But head office documents must be adapted to the activities actually carried out in Poland. That includes Polish-language privacy notices, appropriate entries in the controller’s processing record, and procedures for requests and breaches. The information must also identify the President of UODO as an authority to which complaints may be made.

Can the branch itself be the controller?

As a rule, no. It is not a separate legal entity. The foreign company determining the purposes and means of processing remains the controller under Article 4(7) GDPR. Naming the branch instead is a substantive error that can require the affected documents to be replaced.

The head office has sent an Article 28 data processing agreement for it and the branch to sign. Should we sign it?

No. A data processing agreement between the head office and its own branch has no separate legal subject matter. Define the internal division of responsibilities instead. Use an Article 28 agreement where a separate group company or vendor actually acts as processor.

Does sending employee data to a UK head office require another legal basis?

First establish who actually receives the data and in what role. A flow to the head office as part of the same controller differs from a disclosure to another group company. The UK is covered by Decision 2021/1772, extended by Decision 2025/1226, but adequacy alone does not classify a separate recipient’s role or supply the instrument needed for that relationship. Monitor the decision’s period of application.

Why might a package take four months if the legal work is only a dozen or so hours?

The elapsed time allows for responses and approvals from abroad. Each deliverable depends on particular inputs, so its service deadline should start when those inputs are complete. Prompt head office replies may shorten the schedule.

What remains outside the startup package?

Typical exclusions include cookies and online tracking, vendor and subprocessor audits, DPIAs, group agreements and BCRs, and annual maintenance. List them expressly, with associated risks and recommendations for the second phase.