{"id":3110,"date":"2026-10-28T09:02:50","date_gmt":"2026-10-28T09:02:50","guid":{"rendered":"https:\/\/sawaryn.com\/us\/?p=3110"},"modified":"2026-10-28T09:03:06","modified_gmt":"2026-10-28T09:03:06","slug":"poland-product-launch-gdpr-checklist","status":"publish","type":"post","link":"https:\/\/sawaryn.com\/us\/poland-product-launch-gdpr-checklist\/","title":{"rendered":"Launching a Product in Poland? Address These 7 GDPR Issues Before You Go Live"},"content":{"rendered":"

Launching a Product in Poland? Address These 7 GDPR Issues Before You Go Live<\/h1>\n

The product is ready. The team is waiting for approval to launch. Then someone asks: \u201cWhat about GDPR?\u201d<\/p>\n

In many companies we work with, that question comes too late. Changing the way data is collected or used can then mean weeks of delay\u2014and rebuilding a product that already works.<\/p>\n

Enforcement is one reason to plan ahead. In 2025, the President of Poland\u2019s Personal Data Protection Office (Urz\u0105d Ochrony Danych Osobowych<\/em>, or UODO<\/strong>) imposed fines totaling PLN 64.3 million<\/strong>, more than three times the 2024 total. Those fined included Poczta Polska (PLN 27.1 million), ING Bank \u015al\u0105ski (PLN 18.4 million), and McDonald\u2019s Polska (PLN 16.9 million). Violations of Articles 24, 25, and 32 of the EU General Data Protection Regulation (GDPR<\/strong>), including failures to design appropriate data protection measures, are consistently penalized.<\/p>\n

A fine is not the only risk. Project delays, confusion between teams, loss of user trust, and post-launch changes to forms, consent mechanisms, and terms can all be costly. They can also be anticipated.<\/p>\n

This article covers seven areas to address before launching a new product, service, sales channel, or tool involving personal data in Poland<\/strong>. The aim is not to block the launch. It is to give the team a workable plan before changes become expensive.<\/p>\n

Key terms for a project involving personal data<\/h2>\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Term<\/th>\nWhat it means<\/th>\n<\/tr>\n<\/thead>\n
Controller<\/strong><\/td>\nThe entity that determines why and how personal data is processed\u2014often your company.<\/td>\n<\/tr>\n
Processor<\/strong><\/td>\nA provider that processes personal data on your behalf, such as a CRM, hosting, or marketing automation provider.<\/td>\n<\/tr>\n
Joint controllers<\/strong><\/td>\nTwo entities that jointly determine the purposes and means of processing. They need an arrangement allocating their responsibilities under Article 26 GDPR.<\/td>\n<\/tr>\n
Data processing agreement<\/strong><\/td>\nAn agreement governing processing carried out by a processor on your behalf under Article 28 GDPR.<\/td>\n<\/tr>\n
DPIA\u2014data protection impact assessment<\/strong><\/td>\nA formal risk assessment required before processing begins where that processing may result in a high risk to individuals\u2019 rights under Article 35 GDPR.<\/td>\n<\/tr>\n
Privacy by design<\/strong><\/td>\nThe obligation to build data protection into the design of a process, product, or service under Article 25(1) GDPR.<\/td>\n<\/tr>\n
Privacy by default<\/strong><\/td>\nThe obligation to ensure that, by default, only data necessary for a specific purpose is processed under Article 25(2) GDPR.<\/td>\n<\/tr>\n
Legal basis for processing<\/strong><\/td>\nA condition under Article 6 GDPR that permits processing, such as consent, performance of a contract, or the controller\u2019s legitimate interests.<\/td>\n<\/tr>\n
Privacy notice<\/strong><\/td>\nInformation given to individuals about who processes their data, why, on what basis, and what rights they have under Articles 13\u201314 GDPR.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

1. Map data flows before development begins<\/h2>\n

Before writing code or configuring a new tool, answer four questions:<\/p>\n

    \n
  1. Where does the data come from?<\/strong> A form, API, import, or partner integration?<\/li>\n
  2. Where does it go?<\/strong> A database, CRM, analytics tool, or provider\u2019s cloud?<\/li>\n
  3. Who can access it?<\/strong> Product, marketing, sales, or an external provider?<\/li>\n
  4. What happens to it?<\/strong> Storage, segmentation, scoring, personalization, or profiling?<\/li>\n<\/ol>\n

    The record of processing activities<\/strong> under Article 30 GDPR is a useful tool for this exercise. It records the controller\u2019s details, processing purposes, categories of individuals and data, recipients, information about transfers outside the EU<\/a>, retention periods, and a description of safeguards.<\/p>\n

    Why do this before launch? If a data flow changes after launch, you may need to update the record, privacy notices, terms, and data processing agreements. Discovering gaps late can also mean redesigning forms, obtaining consent again, and revising documentation.<\/p>\n

    The Polish Chamber of Digital Economy\u2019s \u201ce-Accurate 2024\u201d report puts the average annual cost of compliance with GDPR, the Omnibus Directive, and the DSA in the e-commerce sector<\/a> at PLN 159,500 per company<\/strong>, or approximately PLN 55.4 billion across the market. The report\u2019s figures represent approximately 6% of the sector\u2019s annual sales and 18\u201320% of its margin. A significant share of these costs comes from fixing issues after implementation.<\/p>\n

    2. Establish who is the controller, processor, or joint controller<\/h2>\n

    When outside providers or partners are involved, determine each party\u2019s role before personal data starts flowing. The answer drives both documentation and accountability.<\/p>\n\n\n\n\n\n\n\n
    Scenario<\/th>\nYour role<\/th>\nPartner\u2019s role<\/th>\nWhat to prepare<\/th>\n<\/tr>\n<\/thead>\n
    Implementing a CRM or marketing automation tool<\/td>\nController<\/td>\nProcessor<\/td>\nData processing agreement under Article 28 GDPR<\/td>\n<\/tr>\n
    Launching a marketplace with partners<\/td>\nJoint controller, or controller working with a processor\u2014depending on the model<\/td>\nJoint controller or processor<\/td>\nJoint-controller arrangement under Article 26 GDPR, or a data processing agreement<\/td>\n<\/tr>\n
    Integrating an outside provider\u2019s AI tool<\/td>\nController<\/td>\nProcessor or independent controller\u2014depending on the model<\/td>\nAnalysis of roles and the appropriate agreement<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

    Unclear roles create practical risk. In a UODO decision, DPD Polska was fined a total of more than PLN 11 million<\/strong>, among other things, for not having data processing agreements<\/a> with external carriers, in breach of Article 28(3) GDPR, and for lacking adequate organizational measures.<\/p>\n

    Before launch:<\/strong><\/p>\n

      \n
    1. List every provider, partner, and tool involved in the project.<\/li>\n
    2. Assess separately whether each party is a processor, joint controller, or independent controller.<\/li>\n
    3. Put the appropriate agreements in place before the data flow begins.<\/li>\n
    4. Plan periodic processor reviews\u2014at least annually and when you suspect a breach.<\/li>\n<\/ol>\n

      3. Identify a legal basis for each processing purpose<\/h2>\n

      A consent clause in the terms does not, by itself, resolve a project\u2019s GDPR obligations. One product can involve several distinct uses of personal data, and each purpose needs its own legal basis<\/a>.<\/p>\n

      For a new SaaS or e-commerce product, the source gives this typical breakdown:<\/p>\n\n\n\n\n\n\n\n\n\n\n
      Processing purpose<\/th>\nTypical basis under Article 6 GDPR<\/th>\n<\/tr>\n<\/thead>\n
      Customer service and order fulfillment<\/td>\nPerformance of a contract\u2014Article 6(1)(b)<\/td>\n<\/tr>\n
      Invoicing and accounting<\/td>\nLegal obligation\u2014Article 6(1)(c)<\/td>\n<\/tr>\n
      Newsletters and marketing communications<\/td>\nConsent\u2014Article 6(1)(a)\u2014plus consent to electronic communications under Poland\u2019s Act on Providing Services by Electronic Means<\/td>\n<\/tr>\n
      Analytics and usage statistics<\/td>\nController\u2019s legitimate interests\u2014Article 6(1)(f)<\/td>\n<\/tr>\n
      Lead scoring and offer personalization<\/td>\nLegitimate interests\u2014Article 6(1)(f)\u2014subject to a balancing test; the source identifies consent for profiling that produces legal effects<\/td>\n<\/tr>\n
      Remarketing and behavioral advertising<\/td>\nConsent\u2014Article 6(1)(a)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

      The important distinction is between analysis used to support a business decision and analysis that has legal or similarly significant effects on an individual<\/strong> under Article 22 GDPR. Scoring leads in a CRM is different from automatically rejecting a loan application. If scoring automatically excludes people from a service, additional safeguards are needed and a DPIA may be required.<\/p>\n

      If you need help identifying the legal bases for a particular project, contact us<\/a>.<\/p>\n

      4. Decide whether the project needs a DPIA<\/h2>\n

      Not every new project requires a DPIA. Every project does, however, need a deliberate, documented decision<\/strong> about whether one is necessary.<\/p>\n

      A notice issued by the President of UODO on June 17, 2019<\/strong> (Monitor Polski<\/em>, item 666) identifies 12 categories of processing operations<\/strong> for which a DPIA is required. The approach set out here is to conduct a DPIA if the project meets at least two<\/strong> of the following criteria:<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
      No.<\/th>\nCriterion<\/th>\nPossible example<\/th>\n<\/tr>\n<\/thead>\n
      1<\/td>\nEvaluation, assessment, profiling, or prediction<\/td>\nLead scoring or behavioral analysis<\/td>\n<\/tr>\n
      2<\/td>\nAutomated decisions with legal effects<\/td>\nAutomatic rejection of an application or recruitment decisions<\/td>\n<\/tr>\n
      3<\/td>\nSystematic monitoring of public areas with recognition of characteristics<\/td>\nVideo monitoring with facial analysis<\/td>\n<\/tr>\n
      4<\/td>\nProcessing special categories of data<\/td>\nHealth, biometric, or genetic data<\/td>\n<\/tr>\n
      5<\/td>\nUsing biometric data for identification or access control<\/td>\nFingerprint readers or facial recognition<\/td>\n<\/tr>\n
      6<\/td>\nProcessing genetic data<\/td>\nGenetic testing or health profiling<\/td>\n<\/tr>\n
      7<\/td>\nLarge-scale processing<\/td>\nMany individuals, extensive data, or long retention periods<\/td>\n<\/tr>\n
      8<\/td>\nCombining data from different sources<\/td>\nCRM data, online activity, and location data<\/td>\n<\/tr>\n
      9<\/td>\nProcessing data about people in a relationship of dependence<\/td>\nEmployees, students, or patients<\/td>\n<\/tr>\n
      10<\/td>\nUsing innovative technology<\/td>\nIoT, advanced AI systems, or new cloud solutions<\/td>\n<\/tr>\n
      11<\/td>\nProcessing that prevents access to a service<\/td>\nAutomatic exclusion from recruitment without an opportunity to appeal<\/td>\n<\/tr>\n
      12<\/td>\nProcessing location data<\/td>\nReal-time GPS or IoT-sensor tracking<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

      If two criteria are present but you conclude that a DPIA is unnecessary, document and justify that conclusion in detail. The more criteria the processing meets, the stronger the case for conducting the assessment.<\/p>\n

      Complete a required DPIA before processing begins\u2014not after launch.<\/strong><\/p>\n

      5. Build privacy by design and by default into the product<\/h2>\n

      Article 25 GDPR is a product-design issue, not simply a documentation exercise. Addressing privacy by design and privacy by default<\/a> early helps avoid costly changes later.<\/p>\n

      Privacy by design<\/strong>, under Article 25(1), means considering data protection during design rather than adding it after implementation. Measures can be technical\u2014such as encryption, pseudonymization, and access controls\u2014or organizational, such as policies, procedures, and training.<\/p>\n

      Privacy by default<\/strong>, under Article 25(2), means checking what the product does before a user changes any settings. Review four dimensions:<\/p>\n

        \n
      1. Data collected:<\/strong> Remove form fields that are not necessary by default.<\/li>\n
      2. Uses of data:<\/strong> Do not automatically reuse data collected for one purpose for another.<\/li>\n
      3. Retention:<\/strong> Configure deletion or anonymization after the necessary period.<\/li>\n
      4. Access:<\/strong> Give access only to those who need it, using defined roles, restricted permissions, and masking where appropriate.<\/li>\n<\/ol>\n

        UODO decisions illustrate the consequences of inadequate measures. In case DKN.5131.4.2024<\/strong>, the President of UODO imposed fines totaling more than PLN 1,145,891<\/strong> for violations including Article 25(1) GDPR, involving inadequate technical measures when processing data with external storage media. In DKN.5131.17.2022<\/strong>, a PLN 32,832<\/strong> fine concerned the absence of a risk analysis and measures to protect medical records.<\/p>\n

        The European Data Protection Board\u2019s Guidelines 4\/2019<\/strong> emphasize that Article 25 applies throughout the system life cycle: planning, design, implementation, operation, monitoring, updates, and decommissioning. Revisit the requirements when making a significant system change, changing providers, or moving to the cloud.<\/p>\n

        For SaaS, implementation may consist largely of configuration: creating accounts, assigning permissions, and setting defaults. That does not remove the Article 25 obligations. Configure roles, permissions, and privacy defaults before users receive access<\/strong>.<\/p>\n

        6. Have documentation and response procedures ready before launch<\/h2>\n

        The precise documents depend on the project, but the following list covers many common scenarios.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n
        Document or action<\/th>\nWhen needed<\/th>\nSource provision<\/th>\n<\/tr>\n<\/thead>\n
        Privacy notice or privacy policy<\/a><\/td>\nWhen collecting users\u2019 personal data<\/td>\nArticles 13\u201314 GDPR<\/td>\n<\/tr>\n
        Service terms containing data provisions<\/td>\nFor a digital service, e-commerce platform, or SaaS product<\/td>\nArticle 13 GDPR and Poland\u2019s Act on Providing Services by Electronic Means<\/td>\n<\/tr>\n
        Consent form for marketing, newsletters, or profiling<\/td>\nWhere consent is the processing basis<\/td>\nArticles 6(1)(a) and 7 GDPR<\/td>\n<\/tr>\n
        Data processing agreement<\/td>\nFor a provider processing data on your behalf<\/td>\nArticle 28 GDPR<\/td>\n<\/tr>\n
        Joint-controller arrangement<\/td>\nWhere you and a partner jointly determine processing purposes<\/td>\nArticle 26 GDPR<\/td>\n<\/tr>\n
        Updated record of processing activities<\/td>\nFor a new processing activity<\/td>\nArticle 30 GDPR<\/td>\n<\/tr>\n
        DPIA documentation<\/td>\nWhere the project meets UODO\u2019s listed criteria<\/td>\nArticle 35 GDPR<\/td>\n<\/tr>\n
        Data breach response procedure<\/td>\nBefore the first incident occurs<\/td>\nArticles 33\u201334 GDPR<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

        An incident is a poor time to design a response process. The source identifies a 72-hour<\/strong> deadline for reporting a breach to UODO<\/a> after becoming aware of it under Article 33 GDPR. Without a breach response procedure<\/a>, meeting that deadline may be difficult. A Polish court enforcement officer was fined approximately PLN 21,000<\/strong> in total for failing to report a breach and notify the affected person.<\/p>\n

        If the launch includes a CRM or marketing automation tool, set up consent management before the first campaign<\/strong>. The configuration should cover separate consents for different purposes, a history of consent changes\u2014including who changed wording, when, and how\u2014subscription and unsubscribe statistics, and consent information on each contact\u2019s timeline.<\/p>\n

        7. Check the AI Act alongside GDPR when deploying AI<\/h2>\n

        The first provisions of the EU AI Act<\/a> (Regulation (EU) 2024\/1689) have applied since February 2, 2025<\/strong>. The source highlights:<\/p>\n

          \n
        1. A ban on emotion-recognition systems<\/strong> in workplaces and educational institutions.<\/li>\n
        2. An AI literacy requirement<\/strong>: organizations deploying AI systems must ensure that people operating them have an appropriate level of competence.<\/li>\n
        3. The full application of AI Act provisions for high-risk systems<\/strong> from August 2, 2026<\/strong>.<\/li>\n<\/ol>\n

          Article 2(7) of the AI Act states that it does not affect GDPR obligations. An AI deployment may therefore require work under both<\/strong> regulations.<\/p>\n

          For a chatbot, automated customer service tool, recommendation system, or AI-based scoring system, ask:<\/p>\n

            \n
          1. What personal data enters the system, and on what legal basis?<\/li>\n
          2. Is the AI provider a processor or an independent controller?<\/li>\n
          3. Does the processing call for a DPIA\u2014for example, because it involves scoring, profiling, or automated decisions?<\/li>\n
          4. Could the system fall into a prohibited or high-risk AI Act category?<\/li>\n
          5. Does the team operating it have the required AI literacy?<\/li>\n<\/ol>\n

            The AI Act also introduces a fundamental rights impact assessment (FRIA)<\/strong> under Article 27 for high-risk AI systems. It is separate from a GDPR DPIA, although the assessments can complement each other.<\/p>\n

            A nine-question pre-launch GDPR checklist<\/h2>\n

            Work through these questions with the project owner before seeking legal advice. Unanswered questions show where further work is needed.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n
            No.<\/th>\nQuestion<\/th>\nWhat to check<\/th>\n<\/tr>\n<\/thead>\n
            1<\/td>\nWhat personal data are you collecting, and from whom?<\/td>\nCategories of people\u2014customers, leads, employees\u2014and data such as email, phone, location, or behavior<\/td>\n<\/tr>\n
            2<\/td>\nWhy is each category of data processed?<\/td>\nA separate legal basis for each purpose<\/td>\n<\/tr>\n
            3<\/td>\nWho is the controller, processor, or joint controller?<\/td>\nA separate role assessment for each provider and partner<\/td>\n<\/tr>\n
            4<\/td>\nDoes the project involve profiling, scoring, or automated decisions?<\/td>\nWhether a DPIA is needed<\/td>\n<\/tr>\n
            5<\/td>\nAre you implementing an AI tool?<\/td>\nAI Act and GDPR obligations in parallel<\/td>\n<\/tr>\n
            6<\/td>\nAre privacy notices and terms ready?<\/td>\nAvailability before the first collection of data<\/td>\n<\/tr>\n
            7<\/td>\nAre provider data processing agreements signed?<\/td>\nCompletion before the data flow starts<\/td>\n<\/tr>\n
            8<\/td>\nDo default settings collect only necessary data?<\/td>\nForms, access permissions, and retention<\/td>\n<\/tr>\n
            9<\/td>\nIs a breach response procedure in place?<\/td>\nUODO reporting, notifying individuals, and recording breaches<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

            If you cannot answer one of these questions, resolve it before launch.<\/p>\n

            Assign ownership across the business<\/h2>\n

            The controller\u2014typically the company, represented by its management board\u2014is responsible for GDPR compliance.<\/strong> Day-to-day coordination should sit with the project owner, working with product, marketing, sales, and IT.<\/p>\n

            We recommend:<\/p>\n

              \n
            1. Holding a GDPR kickoff with the project owner and each team that will handle personal data.<\/li>\n
            2. Creating one shared compliance task list with named owners for notices, tool configuration, and provider agreements.<\/li>\n
            3. Appointing one coordinator to track deadlines and documentation. This does not have to be the data protection officer (DPO<\/strong>).<\/li>\n
            4. Giving the management board a short decision paper: key risks, conditions for a data-protection-ready launch, and a go\/no-go recommendation.<\/li>\n<\/ol>\n

              Without a shared list and coordinator, teams can move in different directions: marketing may collect data without an identified legal basis, sales may start a campaign before notices are ready, and IT may connect a tool before a data processing agreement is in place.<\/p>\n

              Compare preparation costs with post-launch remediation<\/h2>\n

              There is no precise empirical study of GDPR remediation costs for SaaS and e-commerce in the material discussed here. The available indirect figures do, however, support an illustrative estimate<\/strong>, not a budget for every project.<\/p>\n\n\n\n\n\n\n\n\n
              Category<\/th>\nEstimated cost<\/th>\n<\/tr>\n<\/thead>\n
              Preventive GDPR implementation<\/a> before launch for a medium-sized SaaS or e-commerce company<\/td>\nPLN 100,000\u2013150,000<\/td>\n<\/tr>\n
              Remediation after discovering noncompliance\u2014including redesign, renewed consent, a possible fine, and lost revenue<\/td>\nPLN 220,000\u2013250,000 or more<\/td>\n<\/tr>\n
              Average annual e-commerce company cost of GDPR, Omnibus, and DSA compliance<\/td>\nPLN 159,500<\/td>\n<\/tr>\n
              GDPR-related website redesign<\/td>\nFrom tens of thousands to several hundred thousand PLN<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

              Intrum Justitia data puts the average cost of initial GDPR implementation at approximately PLN 32,000 for small and medium-sized enterprises<\/strong> and PLN 270,000 for large corporations<\/strong>. More than half of Polish companies could not estimate those costs.<\/p>\n

              Architecture matters too. In a multi-tenant SaaS system<\/strong>, where one software instance serves many customers, a design error may require a fix affecting every customer. A campaign to obtain consent again can reduce the available marketing contact list: renewed consent has a lower success rate than initial consent collection.<\/p>\n

              The source estimates a return on investment of approximately 100% over several years<\/strong> for a preventive approach, assuming a difference of about PLN 120,000<\/strong> between preparation and remediation costs. Treat that as a scenario based on stated assumptions, not a guaranteed result.<\/p>\n

              Get GDPR ready before the launch decision<\/h2>\n

              A pre-launch GDPR review should give decision-makers clear conditions for going live, not an open-ended reason to delay. Cover these seven areas:<\/p>\n

                \n
              1. Map data flows.<\/li>\n
              2. Establish controller, processor, and joint-controller roles.<\/li>\n
              3. Identify the legal basis for each purpose.<\/li>\n
              4. Assess whether a DPIA is required.<\/li>\n
              5. Implement privacy by design and by default.<\/li>\n
              6. Complete documentation and breach procedures.<\/li>\n
              7. Address the AI Act if the project uses AI.<\/li>\n<\/ol>\n

                If you are planning a product, service, or sales channel involving personal data in Poland, contact us<\/a> to review its GDPR readiness before problems arise.<\/p>\n

                Frequently asked questions<\/h2>\n

                We plan to launch in six weeks. Is there enough time?<\/strong><\/p>\n

                Yes, if you begin with data-flow mapping and provider roles. With a clear picture of the project, most notices, terms, and data processing agreements can be prepared in three to four weeks<\/strong>. A required DPIA takes additional time, so decide whether one is needed as early as possible.<\/p>\n

                How do we know whether a DPIA is required?<\/strong><\/p>\n

                Check the President of UODO\u2019s 2019 list (Monitor Polski<\/em>, item 666), which identifies 12 categories of operations. Under the approach described above, a project meeting at least two criteria\u2014such as profiling and large-scale processing\u2014generally requires a DPIA. The controller should make the assessment, usually with the DPO or an external adviser.<\/p>\n

                Is our commercial contract with a CRM provider enough?<\/strong><\/p>\n

                No. Where the provider processes personal data on your behalf, you also need a data processing agreement under Article 28 GDPR<\/strong>. Configure the tool before use: limit default data collection, assign access roles, and set up consent management.<\/p>\n

                Does GDPR matter if a landing page asks only for a first name and email address?<\/strong><\/p>\n

                Yes. Those are personal data. Identify a processing basis\u2014usually consent to marketing communications in the scenario described here\u2014make a privacy notice available beside the form, and include the activity in the record of processing activities. If an outside tool, such as Mailchimp or HubSpot, processes the data on your behalf, put a data processing agreement in place.<\/p>\n

                Who should lead GDPR work on the project?<\/strong><\/p>\n

                The company as controller, represented by its management board, remains responsible for compliance. The project owner should coordinate the work with product, marketing, sales, and IT. Assign one person to monitor deadlines and documentation; that person need not be the DPO.<\/p>\n

                When does analytics become higher-risk profiling?<\/strong><\/p>\n

                The distinction becomes particularly important where analysis produces legal or similarly significant effects<\/strong> for an individual under Article 22 GDPR. CRM segmentation for a campaign differs from automatically rejecting a service application. If scoring automatically excludes people from a service, additional safeguards are needed and a DPIA may be required.<\/p>\n","protected":false},"excerpt":{"rendered":"

                Planning a product launch in Poland? Check data flows, provider roles, legal bases, DPIA needs, privacy defaults and AI use before going live.<\/p>\n","protected":false},"author":14,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":"","sip_alt_url":"https:\/\/sawaryn.com\/publikacje\/rodo-przed-startem-produktu\/","sip_en_pl_url":"https:\/\/sawaryn.com\/en\/publikacje\/gdpr-before-new-product-launch\/","sip_pair_uuid":"d6da5951-9205-4261-8e06-4354279d812a","sip_pair_state":"verified"},"categories":[16,1258],"tags":[33,1206,1247,1271,1237],"specialization":[1132],"practice_area":[],"class_list":["post-3110","post","type-post","status-publish","format-standard","hentry","category-gdpr","category-market-entry","tag-ai-act","tag-gdpr","tag-gdpr-audit","tag-high-risk-ai-systems","tag-personal-data-protection","specialization-gdpr"],"acf":[],"_links":{"self":[{"href":"https:\/\/sawaryn.com\/us\/wp-json\/wp\/v2\/posts\/3110","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sawaryn.com\/us\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sawaryn.com\/us\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sawaryn.com\/us\/wp-json\/wp\/v2\/users\/14"}],"replies":[{"embeddable":true,"href":"https:\/\/sawaryn.com\/us\/wp-json\/wp\/v2\/comments?post=3110"}],"version-history":[{"count":1,"href":"https:\/\/sawaryn.com\/us\/wp-json\/wp\/v2\/posts\/3110\/revisions"}],"predecessor-version":[{"id":3111,"href":"https:\/\/sawaryn.com\/us\/wp-json\/wp\/v2\/posts\/3110\/revisions\/3111"}],"wp:attachment":[{"href":"https:\/\/sawaryn.com\/us\/wp-json\/wp\/v2\/media?parent=3110"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sawaryn.com\/us\/wp-json\/wp\/v2\/categories?post=3110"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sawaryn.com\/us\/wp-json\/wp\/v2\/tags?post=3110"},{"taxonomy":"specialization","embeddable":true,"href":"https:\/\/sawaryn.com\/us\/wp-json\/wp\/v2\/specialization?post=3110"},{"taxonomy":"practice_area","embeddable":true,"href":"https:\/\/sawaryn.com\/us\/wp-json\/wp\/v2\/practice_area?post=3110"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}