Lodge a complaint
When can a complaint be lodged?
In case of violation of the provisions on personal data protection, the data subject can lodge a complaint with the President of the Personal Data Protection Office. After having conducted the proceedings in the case, the President of the Office - if there has been a violation of the provisions – shall, by means of an administrative decision, order to restore compliance with the law.
Who can lodge a complaint?
A complaint to the President of the Office may be lodged by a natural person if the incorrect processing concerns his/her personal data. If the complaint concerns the processing of personal data of another person, a power of attorney granted by that person to represent him/her in proceedings before the President of the Office is necessary.
Who can be a proxy?
- a natural person [1];
- non-for-profit body, association or organization, which has statutory objectives which are in the public interest and is active in the field of the protection of data subjects' rights and freedoms.
Before you lodge a complaint, address your request to the controller.
Exercise your rights before lodging a complaint with the Office. The controller is obliged to reply to your request as soon as possible - within a maximum of one month. If for some reason this is not possible, it must inform you why it is extending the deadline for replying by a maximum of further two months. Also within one month, the controller should inform you that your request has not been granted and the reasons for this. If the controller ignores your request or if you are not satisfied with the response, you can lodge a complaint with the Office.
The power of the President of the Personal Data Protection Office to order compliance with your request requires that you first address your request directly to the controller (including the processor). Pursuant to the GDPR, you have the following rights:
- to access to your data,
- to have your data rectified,
- to erasure of data,
- to restriction of processing,
- to data portability,
- to object,
- not to be subject to a decision which is based solely on automated processing.
Detailed information on the exercise of rights can be found here https://uodo.gov.pl/pl/383/579. Remember that rights do not have to apply in every situation. They may, for example, be limited by Polish law.
For example, it is better to raise an objection with the controller against the processing of your data for marketing purposes than to lodge a complaint with the Personal Data Protection Office. If the controller does not know that you do not want your personal data to be processed, the President of the Personal Data Protection Office may not be able to comply with such a request. In addition, the controller may handle your case more quickly than the Office, which has to conduct an administrative proceedings. Handling the case by the controller is also usually simpler, it does not require many formalities.
If you have evidence confirming the controller’s incorrect action (e.g. correspondence with the controller, contracts, certificates), attach them to the complaint. This will make it easier for the Office's staff to assess the complaint.
Financial liability of the controller
When lodging a complaint, you cannot request an administrative fine to be imposed on the controller. The decision to impose an administrative fine is within the exclusive competence of the President of the Office and is not fulfilled upon request.
Remember that regardless of the proceedings before the Personal Data Protection Office you still have the right to protect your rights in civil court. If you find that the processing of your personal data violates the law, you can sue the controller or the processor. Before the court, you can claim compensation for the violation of data protection legislation that has caused you material or non-material damage. Compensation issue can only be resolved before a court of law. It cannot be resolved in proceedings before the President of the Office.
Lodging a complaint in a traditional form
Procedure and deadlines for complaints handling
1. The power of attorney must meet the requirements indicated in Art. 32-34 of the Act of 14 June 1960 - Code of Administrative Procedure (Journal of Laws of 2017, item 1257, with amendments)
