Job Postings in Poland: Salary Transparency, Candidate Data and Recruitment Risk
Open the most recent job posting your company published for a position in Poland. Does it state the proposed base salary or a range? If not, the template may not have been updated since the changes that took effect on December 24, 2025. That may not be its only problem.
A job posting can look like a routine HR document: a template reused from an earlier search, perhaps with a few fields changed. In Poland, however, employee recruitment must be assessed under both the Polish Labour Code and the General Data Protection Regulation (GDPR). An overbroad “required documents” section can result in unnecessary processing of hundreds of applicants’ personal data. A question about current or previous pay—prohibited in employee recruitment since December 2025—can contribute to a compensation claim.
For a company recruiting in Poland, the practical review is wider than the advertisement itself. It includes the application form, applicant tracking system (ATS), interview questions, privacy notice, access permissions and data-retention process.
Key Polish rules and terms
| Term | What it means for recruitment |
|---|---|
| Article 22¹ of the Polish Labour Code | Sets out the categories of information an employer may request from an applicant. These include name, date of birth and contact details; education, professional qualifications and employment history may be requested when necessary for the position. |
| Article 18³ca of the Polish Labour Code | In force since December 24, 2025. It requires information about the proposed base salary or range and prohibits questions about pay in current or previous employment. |
| Data minimization—Article 5(1)(c) GDPR | Personal data must be adequate, relevant and limited to what is necessary for the purpose. In recruitment, collect only what you need. |
| Privacy notice—Article 13 GDPR | Applicants must be told who processes their data, why, on what legal basis, for how long and what rights they have. Provide the notice when collecting their data. |
| Special categories of data—Article 9 GDPR | These include information about health, disability, religion, sexual orientation and trade union membership. At the recruitment stage, the source addresses processing data supplied on the applicant’s own initiative and with consent. |
Four questions to ask before publishing a job posting
1. Which rules apply to the recruiting organization?
A private employer recruiting employees in Poland must account for the Labour Code and GDPR. A local government entity is also subject to rules including the Act on Local Government Employees and a regulation on remuneration.
Do not copy a public-sector recruitment notice into a private company’s process without reviewing it. You may present applicants with procedural commitments that your organization is not required—or prepared—to follow.
2. Which requirements are essential to the role?
In private-sector fields such as IT, SaaS and e-commerce, there is no general statutory list of qualifications for every position. The employer must be able to link each requirement to the work. Requiring a university degree where it is not necessary for the role, for example, does not meet the test described in Article 22¹ § 2 of the Labour Code.
Treat a requirement as essential if you can identify the task it serves, explain why a less intrusive way to assess the applicant is unavailable, and apply it consistently to all applicants. Place other criteria—such as preferred experience or soft skills—in an additional or “nice to have” category.
3. What is the legal basis for each application field?
A common error is to rely on applicant consent for all personal data in an application. The source distinguishes information requested under the Labour Code, information needed to enter into a contract, and additional information voluntarily provided by the applicant.
| Data category | Legal basis identified in the source | Example |
|---|---|---|
| Data requested under the Labour Code | Article 6(1)(c) GDPR together with Article 22¹ of the Labour Code | Name in an application form |
| Data necessary to enter into a contract | Article 6(1)(b) GDPR | Confirmation of qualifications required for the role |
| Additional data provided voluntarily | Article 6(1)(a) GDPR—consent | A photograph in a CV or additional certificates |
| Special categories of data | Article 9 GDPR and Article 22¹b of the Labour Code | A disability certificate supplied on the applicant’s initiative |
Consent is not freely given if an applicant cannot realistically refuse it. Refusing or withdrawing consent cannot justify unfavorable treatment or a refusal to hire under Article 22¹a § 2 of the Labour Code.
4. When will applicants receive salary information?
Since December 24, 2025, Article 18³ca of the Labour Code has allowed three alternative points for providing the proposed base salary or range:
- In the job posting.
- Before the interview, if the information was not in the posting.
- Before the employment relationship begins, if it was not provided earlier.
The choice concerns timing, not whether to provide the information. The amount or range must rest on objective, gender-neutral criteria. The source recommends a pay scale or remuneration policy; an entirely discretionary range is not enough.
The same provision prohibits asking applicants what they earn or earned in current or previous employment. Remove that question from application forms, ATS fields and interview scripts—not just from the published posting.
Recruitment checklist: allowed, prohibited or dependent on the role
| Posting or recruitment element | Status in the approved source |
|---|---|
| Applicant’s first name, surname and date of birth | May be requested. |
| Contact details indicated by the applicant | May be requested. |
| Education, qualifications and employment history | Request only when necessary for the position. |
| PESEL number, home address or bank account number | Do not request at the recruitment stage. PESEL is Poland’s personal identification number. |
| Current or previous earnings | Do not ask in employee recruitment from December 24, 2025. |
| Proposed base salary or range | Information must be provided; choose one of the permitted points in the process. |
| Photograph as a mandatory CV requirement | Do not require it; consent to use an applicant’s image cannot be forced. |
| Photograph supplied voluntarily | The source identifies consent as the basis for processing it. |
| Certificate from the Polish National Criminal Register (Krajowy Rejestr Karny, or KRK) | Assess whether a legal provision or justified need of the position supports requesting it. Do not make it a standard requirement. |
| Medical certificate | Do not require it as part of the recruitment application. The employer’s pre-employment medical examination obligation concerns a person being hired. |
| Health or disability information | The source addresses data supplied on the applicant’s initiative, with consent in the form of a declaration. |
| Age range in a posting | Do not include it; the source identifies it as discriminatory. |
| “Young, dynamic team” | Remove it; the source identifies it as indirect age discrimination. |
| Gender specified in a job title | Do not specify it unless it is a genuine occupational requirement. |
| GDPR Article 13 privacy notice | Provide it when collecting applicant data. |
| Consent to retain details for future recruitment | Obtain it separately and voluntarily; it cannot be a condition of participating in the current process. |
Five recurring mistakes—and how to correct them
1. No salary section in the template
A template without a salary section is a useful signal that it needs review, even though the source identifies other lawful points at which salary information may be given. For operational consistency, add a “Proposed base salary” section containing:
- The amount or range.
- A statement that it is based on objective, gender-neutral criteria, such as those set out in a remuneration policy.
If the organization has no pay scale, the source’s recommendation is to create one. A range based only on discretion does not meet the stated objective-criteria requirement.
2. One blanket consent clause for every applicant’s data
A generic statement such as “I consent to the processing of my personal data” is not the right basis for information requested under the Labour Code. The Polish Personal Data Protection Office (UODO) indicates that purported consent of this kind is not freely given when the applicant cannot realistically decline it.
Set out the legal bases separately in the privacy notice. Reserve consent for additional information voluntarily supplied beyond the Labour Code categories.
3. A “required documents” list that collects too much
A mandatory package consisting of a photo CV, diploma copy, KRK certificate, PESEL number and medical certificate is, for the most part, excessive at the application stage. Remove documents and fields that cannot be required before employment begins. Where confirmation of a fact is needed—for example, the absence of a criminal record—the source recommends considering an applicant declaration instead of routinely collecting a certificate.
Under Article 229 § 1 of the Labour Code, a pre-employment medical examination is an employer obligation concerning a person being hired. It is not part of the initial application package.
4. An undefined retention period
“We keep applications for as long as necessary” does not give a sufficiently specified or determinable period under Article 5(1)(e) GDPR. UODO indicates that an unsuccessful applicant’s data should be deleted promptly when recruitment ends; longer retention requires a separate basis.
State a defined period in the notice and retention policy, and make sure the system follows it. The source gives destruction or return of documents no later than three months after recruitment ends as an example and recommends setting a reminder. Any longer retention—including for claims or future searches—needs its own assessment and stated basis.
5. Discriminatory wording in an otherwise routine description
Article 18³a § 1 of the Labour Code prohibits discrimination in access to employment. Poland’s National Labour Inspectorate (Państwowa Inspekcja Pracy, or PIP) advises against postings that suggest preferences based on gender, age or characteristics unrelated to the work. Article 18³ca § 3 also requires gender-neutral postings and job titles.
Phrases such as “young person,” “man for manual work” and stated age ranges may be evidence of a discriminatory criterion. An applicant may seek compensation under Article 18³d of the Labour Code. The source states a minimum of one statutory minimum monthly wage—PLN 4,806 gross from January 1, 2026—with no upper limit. In judgment II PSKP 17/21, the Polish Supreme Court confirmed that this compensation has a sanctioning function and is not limited to proven financial loss.
The GDPR privacy notice: eight points to cover
Provide the Article 13 GDPR information when applicants submit their data, whether through the posting or an application form. A complete notice in the source covers:
- The controller’s name, address and contact details.
- Contact details for the data protection officer, if one has been appointed.
- The purposes and legal bases for processing, distinguishing legal requirement, contract and consent.
- Data recipients and processing by service providers, such as an ATS provider.
- Whether data is transferred outside the European Economic Area (EEA), and the relevant safeguard mechanism if it is.
- A specified retention period.
- Applicant rights: access, rectification, erasure, restriction, portability, objection, withdrawal of consent and complaint to the President of UODO.
- Whether providing data is voluntary, the consequences of not providing it, and information on automated decision-making and profiling.
If you use an ATS, confirm that applicants can see the full notice before submitting an application. The source treats an ATS provider processing data on the employer’s behalf as a processor under Article 28 GDPR, requiring a data processing agreement. Before choosing a provider, check where data is stored, which subprocessors are used, the basis for any transfer outside the EEA and how records are deleted when the retention period ends.
Limit access to applications
A shared recruitment inbox accessible to a large team creates risk. An applicant may independently attach a disability certificate or mention their health or trade union membership. Special-category data can then reach people who have no reason to see it.
Article 22¹b of the Labour Code requires access to special categories of data to be limited to people authorized in writing. The source describes an authorization issued by the controller that specifies its scope and purpose and is acknowledged by the authorized person’s signature.
Take three operational steps:
- Limit access to recruitment inboxes and CV folders to those directly involved.
- Put written authorizations in place for people who may view applicant data.
- Configure ATS roles so that special-category data is visible only to designated people.
Employee hiring versus B2B contractor recruitment
Polish companies also recruit individuals for business-to-business (B2B) contracts. Article 22¹ of the Labour Code concerns recruitment for an employment relationship; it does not automatically extend to contractor selection.
| Issue | Employee recruitment | B2B contractor recruitment |
|---|---|---|
| Categories of data that may be requested | Labour Code Article 22¹ applies. | No equivalent separate list identified in the source; apply GDPR principles. |
| Processing basis identified in the source | Article 6(1)(b) and (c) GDPR. | Article 6(1)(b) GDPR for pre-contract steps, or Article 6(1)(f) for legitimate interests. |
| Salary or rate disclosure | Article 18³ca applies. | No confirmed equivalent statutory obligation identified. |
| Questions about prior earnings | Prohibited under Article 18³ca from December 24, 2025. | No confirmed equivalent statutory prohibition identified. |
| GDPR data minimization | Applies. | Applies. |
| GDPR privacy notice | Required. | Required. |
For B2B recruitment, decide what data to request by reference to the proposed contract and GDPR principles, not by automatically importing Article 22¹. Publishing a proposed contractor rate may be good practice, but the source does not identify a current statutory requirement to do so.
Directive (EU) 2023/970, with an implementation deadline of June 7, 2026, concerns employment relationships. The source notes that the scope of Polish implementing legislation should be checked before publishing a B2B posting, particularly where an individual contractor would perform the work personally without subcontractors.
Agencies and job boards: responsibility does not disappear
Giving discriminatory requirements to a recruitment agency does not release the employer from responsibility. Responsibility for a posting rests primarily with an entity that creates, approves or knowingly publishes its content.
The agency’s GDPR role depends on what it actually does:
- Processor: If it handles data only on the employer’s instructions, Article 28 GDPR applies and a data processing agreement is required.
- Potential joint controller: If it jointly determines the purposes and means of processing, Article 26 GDPR may apply, requiring an arrangement that defines responsibilities.
- Publication intermediary: Merely helping publish a posting does not, by itself, establish joint controllership. In Case C-683/21, the Court of Justice of the European Union addressed the need for joint determination of processing purposes and means.
The Polish Act of March 20, 2025 on the Labour Market and Employment Services also prohibits vacancies that breach equal-treatment principles from being posted in the ePraca system.
Three areas of exposure from a defective posting
| Area | Authority or claimant | Potential consequence identified in the source |
|---|---|---|
| GDPR | President of UODO | Under Article 83 GDPR, an administrative fine of up to EUR 20 million or 4% of annual worldwide turnover (UODO). |
| Employment discrimination | Applicant bringing a claim before a Polish labor court | Compensation under Article 18³d of the Labour Code: at least one minimum monthly wage, stated in the source as PLN 4,806 gross from January 1, 2026, with no upper limit. |
| Employment-law inspection | PIP | An inspection concerning Articles 18³ca and 22¹ of the Labour Code; potentially an offense under Article 282 § 1 if the conduct satisfies its statutory elements. |
These routes can overlap. A posting may prompt excessive collection from many applicants, an employment-law inspection and an individual compensation claim. After recruitment, an applicant may also exercise GDPR rights, including access under Article 15 and erasure under Article 17.
Preparing for the EU Pay Transparency Directive
Article 18³ca of the Labour Code anticipates part of Directive (EU) 2023/970. The Directive’s implementation deadline is June 7, 2026, and its scope is broader than providing applicants with a salary figure. The source highlights:
- An employee right to information on average pay levels broken down by sex, under Article 7.
- Gender pay-gap reporting: annually for employers with at least 250 employees, with the first report due by June 7, 2027; every three years for those with 150–249 employees; and every three years for those with 100–149 employees, with the source identifying June 7, 2031 for that group.
- A joint pay assessment with workers’ representatives under Article 10 where a gap of at least 5% in a category is not justified by objective criteria and is not remedied within six months.
The approved source does not confirm that Poland has adopted comprehensive legislation implementing every Directive requirement. If your organization has at least 100 employees, begin preparing pay records broken down by sex and job category, and check the legislative position as implementation develops.
Action plan: what to change first
| Priority | Action |
|---|---|
| 1. Audit templates | Check every employee-recruitment posting template for proposed base salary information or a range. Update templates that lack it, while ensuring salary information is provided at a permitted point in the process. |
| 2. Remove pay-history questions | Review forms, ATS fields and interview scripts. Give recruiters explicit instructions not to ask about current or previous employment pay. |
| 3. Correct processing bases | Separate legal requirement, contract and consent in the privacy notice. Do not use blanket consent for all data. |
| 4. Cut excessive document requests | Remove routine requests for PESEL, address, bank details, a photo, a medical certificate and a KRK certificate from the initial application package. Assess any role-specific exception. |
| 5. Set retention rules | State a defined period, configure deletion or return, and set a reminder. Assess a separate basis for any longer retention. |
| 6. Complete the Article 13 notice | Cover the eight points above and make the notice available before applicants submit data. |
| 7. Classify requirements | Separate qualifications necessary for the work from preferences. Record the rationale for essential requirements. |
| 8. Review wording | Remove age ranges, unjustified gender references and phrases such as “young, dynamic team.” |
| 9. Control access | Restrict recruitment inboxes and ATS permissions, with written authorizations where required for special-category data. |
| 10. Train and approve | Train recruiters and hiring managers on permitted questions and data requests. Require approval before a posting goes live. |
Correcting one advertisement is not enough if the same issue remains in the application form, ATS, interview process or retention settings. Support may range from a corrected posting and Article 13 notice to a full recruitment-process review, GDPR documentation, training and assistance during a PIP or UODO inspection. Contact us to review the materials and process you currently use in Poland.
Frequently asked questions
Must the salary range appear in the posting?
Not necessarily. The source identifies three points under Article 18³ca: in the posting, before the interview, or before the employment relationship begins if it has not been provided earlier. The obligation to give the information remains. The amount or range must be based on objective, gender-neutral criteria.
Can recruiters ask about salary expectations?
A question about what an applicant would like to earn is different from asking what they currently earn or previously earned. Article 18³ca prohibits the latter; the source does not treat a question about expectations as expressly prohibited. Its practical value may be lower once the employer provides its proposed amount or range.
Can unsuccessful applications be kept for future searches?
UODO’s position cited in the source is that data should be deleted promptly when the recruitment process ends. Longer retention requires a separate basis. The source identifies defense against claims—referring to the three-year limitation period in Article 291 § 1 of the Labour Code—and consent for future recruitment as possible considerations.
A talent pool needs its own purpose, legal basis and stated retention period. Consent for future searches must be specific, voluntary and withdrawable, and cannot be a condition of the current application.
What if an applicant volunteers health or trade union information?
Do not request it as a routine application field. The source states that special-category data supplied on the applicant’s initiative may be processed with consent given in the form of a declaration under Article 22¹b of the Labour Code and Article 9 GDPR. Limit access to people authorized in writing, including when the information arrives in a shared inbox.
Do these employee-recruitment rules apply to B2B contractors?
Articles 22¹ and 18³ca of the Labour Code address employee recruitment, not automatically B2B contractor selection. GDPR duties—including data minimization, a privacy notice and a defined retention period—still matter. The source identifies no confirmed equivalent B2B statutory duty to disclose rates or prohibition on pay-history questions; check for legislative developments when preparing a posting.
Could one posting lead to both an inspection and a claim?
Yes. Excessive data collection may create GDPR exposure, employment-law issues may attract a PIP inspection, and discriminatory requirements may support an applicant’s compensation claim. Reviewing the full recruitment process before reusing a template is more effective than correcting the published wording alone.
