{"id":3337,"date":"2026-11-13T13:52:10","date_gmt":"2026-11-13T13:52:10","guid":{"rendered":"https:\/\/sawaryn.com\/us\/?p=3337"},"modified":"2026-11-13T13:52:10","modified_gmt":"2026-11-13T13:52:10","slug":"polish-website-gdpr-privacy-policy-audit","status":"publish","type":"post","link":"https:\/\/sawaryn.com\/us\/polish-website-gdpr-privacy-policy-audit\/","title":{"rendered":"After GDPR Implementation: Does Your Polish Website Match Your Privacy Policy?"},"content":{"rendered":"

Your company has published a new privacy policy, launched a cookie banner, and updated its privacy notices. The implementation report says the GDPR work is complete. Then someone opens your online store in a clean browser session and finds that one tool named in the policy is not on the website, while three others are running but appear in neither the policy nor the record of processing activities.<\/p>\n

This pattern regularly emerges several weeks after implementation. Management believes the documentation is complete, but the website keeps changing: marketing installs plugins, a provider updates integrations, and no one tells the person responsible for data protection.<\/p>\n

A post-implementation website audit<\/strong> compares what the documents say with what the website actually does. For a business operating in Poland, it should address both the GDPR and the Polish Electronic Communications Law (Prawo komunikacji elektronicznej<\/em>, or PKE). This article explains how to run that comparison, identify gaps, and assign the resulting work before the President of Poland\u2019s Personal Data Protection Office (Prezes Urz\u0119du Ochrony Danych Osobowych<\/em>, or UODO) raises the questions.<\/p>\n

The documents and mechanisms you need to check<\/h2>\n\n\n\n\n\n\n\n\n\n\n
Term<\/th>\nWhat it means for your website<\/th>\n<\/tr>\n<\/thead>\n
Post-implementation audit<\/strong><\/td>\nA technical and documentation review conducted several weeks after GDPR recommendations have been implemented. It tests whether the changes work and whether new discrepancies have appeared.<\/td>\n<\/tr>\n
Record of processing activities<\/a><\/strong> (Article 30 GDPR)<\/td>\nThe controller\u2019s record of operations involving personal data, including their purposes, legal bases, data categories, and recipients. The approved approach addressed here treats this as an obligation for every controller, regardless of company size.<\/td>\n<\/tr>\n
Consent mode<\/strong><\/td>\nThe technical configuration of analytics and advertising tools that determines whether their scripts run before or after a user gives consent.<\/td>\n<\/tr>\n
Consent management mechanism, or cookie banner<\/a><\/strong><\/td>\nThe interface through which users give or refuse cookie consent. The source identifies Article 7(3) GDPR and Article 399 PKE as relevant requirements.<\/td>\n<\/tr>\n
Privacy notice<\/strong> (Article 13 GDPR)<\/td>\nInformation given when personal data is collected, including the controller\u2019s identity, processing purpose and legal basis, retention period, and the individual\u2019s rights.<\/td>\n<\/tr>\n
Data processing agreement<\/a><\/strong> (Article 28 GDPR)<\/td>\nThe agreement governing a provider that processes personal data on the controller\u2019s behalf, including the scope, purpose, and conditions of that processing.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

The privacy policy is only one part of this picture. It cannot establish what a plugin does, whether a script fires before consent, or whether a provider has changed an integration.<\/p>\n

Why implementation is a starting point, not the finish line<\/h2>\n

Publishing a privacy policy<\/a>, enabling a cookie banner, and updating notices establish a starting position. The accountability principle in Article 5(2) GDPR requires the controller to be able to demonstrate compliance over time, not just on publication day.<\/p>\n

A website often changes faster than its documentation. Marketing adds a tracking pixel. Accounting connects an invoicing tool. A website provider updates a review plugin that, by default, automatically emails customers after a purchase. Each change can introduce a processing activity with its own purpose and legal basis. Email communications may also raise a consent requirement under Article 398 PKE.<\/p>\n

Discrepancies run in both directions<\/h3>\n\n\n\n\n\n\n
What the audit finds<\/th>\nWhy it matters<\/th>\nProvisions identified in the source<\/th>\n<\/tr>\n<\/thead>\n
A tool is described in the policy but is not operating on the website.<\/td>\nThe company declares processing it does not carry out, potentially misleading users about how their data is handled.<\/td>\nArticle 5(1)(a) GDPR (fairness) and Article 12(1) GDPR (transparency).<\/td>\n<\/tr>\n
A tool operates on the website but is absent from the policy and processing record.<\/td>\nThe processing has no documented legal basis, and the controller cannot demonstrate how it has addressed it.<\/td>\nArticle 6 GDPR (legal basis), Article 13 GDPR (information), Article 30 GDPR (record entry), and Article 24 GDPR (accountability).<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Reading the policy alone will not reveal either discrepancy. You must examine the live website and compare the findings with the documents.<\/p>\n

Where the gaps commonly come from<\/h3>\n
    \n
  1. Default plugin settings.<\/strong> A post-purchase review plugin may start emailing review invitations as soon as it is installed, before anyone deliberately approves that function. The emails are a separate processing activity and, as the source explains, also engage Article 398 PKE.<\/li>\n
  2. Integrations added by other teams.<\/strong> An accounting or invoicing connection, analytics tool, or marketing pixel may process personal data without being added to the processing record or policy. Check the provider\u2019s role and whether a data processing agreement is needed.<\/li>\n
  3. The consent management provider itself.<\/strong> A tool installed for compliance can be left out of the policy and processing record because no one thinks to review the \u201ccompliance tool\u201d as a data-handling service.<\/li>\n<\/ol>\n

    If you want an independent check for these gaps, contact us<\/a>.<\/p>\n

    How to audit the website, step by step<\/h2>\n

    The initial review does not require specialist software. It does require a consistent sequence: observe the website before consent, test the banner, identify tools, and only then assess the documents against the facts.<\/p>\n

    1. Start with a clean browser session<\/h3>\n
      \n
    1. Open a private browsing session or clear the site\u2019s cookies, cache, and local data.<\/li>\n
    2. Visit the website and do not interact with the cookie banner<\/strong>.<\/li>\n
    3. Open the browser\u2019s developer tools\u2014F12 in many browsers.<\/li>\n
    4. Under Application \u2192 Storage \u2192 Cookies<\/strong>, list cookies stored before any banner interaction.<\/li>\n
    5. Under Network<\/strong>, identify requests to analytics, advertising, and other third-party domains.<\/li>\n
    6. Classify each cookie and request: is it technical and necessary for the site to operate, or does it require consent?<\/li>\n<\/ol>\n

      Analytics or advertising cookies, or requests to advertising-provider domains before consent, are warning signs. They do not automatically establish a violation. Investigate the legal basis for the activity and whether users have been informed.<\/p>\n

      2. Check the default consent mode settings<\/h3>\n

      Look for these parameters in the site\u2019s consent mode configuration:<\/p>\n\n\n\n\n\n\n\n\n
      Parameter<\/th>\nDefault before consent<\/th>\n<\/tr>\n<\/thead>\n
      analytics_storage<\/code><\/td>\ndenied<\/code><\/td>\n<\/tr>\n
      ad_storage<\/code><\/td>\ndenied<\/code><\/td>\n<\/tr>\n
      ad_user_data<\/code><\/td>\ndenied<\/code><\/td>\n<\/tr>\n
      ad_personalization<\/code><\/td>\ndenied<\/code><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

      Under the configuration described in the source, a default of granted<\/code> for any of these parameters means analytics or advertising tools run before the user consents.<\/p>\n

      3. Review the first layer of the cookie banner<\/h3>\n

      Check the choices available on the first screen, without requiring the user to open settings.<\/p>\n\n\n\n\n\n\n\n
      Element<\/th>\nWhat to look for<\/th>\nWarning sign<\/th>\n<\/tr>\n<\/thead>\n
      \u201cAllow all\u201d<\/td>\nPresent.<\/td>\n\u2014<\/td>\n<\/tr>\n
      \u201cReject all\u201d<\/td>\nPresent and visually equivalent<\/strong> to \u201cAllow all.\u201d<\/td>\nMissing or available only in a second layer.<\/td>\n<\/tr>\n
      \u201cCustomize\u201d or \u201cSettings\u201d<\/td>\nOptional.<\/td>\nOffered as a substitute for \u201cReject all.\u201d<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

      The source identifies a \u201cCustomize \/ Allow all\u201d first layer without an equivalent rejection option as a pattern described as unlawful in EDPB Guidelines 03\/2022. Article 7(3) GDPR requires withdrawing consent to be as easy as giving it. In C\u2011673\/17, Planet49<\/em>, the Court of Justice of the European Union confirmed that consent requires an active, specific act; in C\u201161\/19, Orange Rom\u00e2nia<\/em>, it addressed the absence of freely given consent where a user must actively object to processing. See also the list of decisions of the President of UODO<\/a>.<\/p>\n

      A missing button may be fixable in the provider\u2019s configuration rather than through a new website project.<\/p>\n

      4. Compare the live tools with the policy and processing record<\/h3>\n

      Prepare two lists:<\/p>\n