Third-party data breach in Poland – what should your company do under GDPR?

Following a third-party data breach in Poland, companies should identify compromised information, secure access and assess financial fraud risks. If personal data under their control is affected, they must evaluate their GDPR obligations. Notification to the Polish Personal Data Protection Office (UODO) is generally required within 72 hours of awareness unless a risk to individuals is unlikely.

---

When does a corporate data leak become a GDPR breach?

Not every third-party data breach in Poland constitutes a personal data breach under Article 4(12) of the General Data Protection Regulation (GDPR).

Compromised accounting, invoicing or payroll systems may expose:

• Login credentials and user permissions;
• Invoices, transaction amounts and bank details;
• Customer and supplier information, including sole traders;
• Employee and business contact details.

Commercial information may require protection against fraud even when GDPR notification obligations do not apply.

---

What should companies do after a third-party breach?

Businesses using a compromised system should take five steps:

1. Establish the scope – retain the provider’s notification, identify affected records and record when the information was received.
2. Secure access – review passwords, user permissions, active sessions and potentially compromised integration keys.
3. Protect payments – monitor fraudulent invoices and independently verify unusual bank account change requests.
4. Assess GDPR obligations – determine whether personal data has been exposed and evaluate the risks to individuals.
5. Document the incident – retain correspondence, findings and records of remedial measures.

Article 33(5) GDPR requires controllers to document personal data breaches even when supervisory authority notification is unnecessary.

---

When must a breach be reported to UODO?

Under Article 33(1) GDPR, notification must be made without undue delay and, where feasible, within 72 hours of becoming aware of the breach.

The requirements depend on the risk assessment:

• Risk unlikely: Neither UODO notification nor communication with individuals is required.
• Risk exists but is not high: UODO notification is required.
• High risk: UODO notification and generally communication with affected individuals are required, subject to GDPR exceptions.

Late notifications must include reasons for the delay. Missing information may be submitted in phases.

A provider’s own notification does not automatically fulfil the customer’s obligations as data controller.

---

What happened in the 2026 Fakturownia data breach?

On 28 September 2026, Polish invoicing platform Fakturownia identified unauthorised access involving the copying of a substantial portion of its database.

All accounts were affected, although the scope varied. According to the company, approximately 2,250 accounts had all available data from 2022–2026 copied, up to the applicable account-specific cut-off date.

Fakturownia reported the breach to UODO on 29 September 2026 and began issuing individual notifications on 1 October.

Affected businesses should check their exposed records, secure accounts and assess their own GDPR responsibilities.

---

How can businesses reduce third-party data risks?

Article 28 GDPR requires controllers to use processors providing sufficient security guarantees.

Companies should review vendor security arrangements, establish data processing agreements, restrict access permissions and maintain incident response procedures.

Business continuity arrangements are also important where accounting or payroll systems become unavailable.

Failure to comply with obligations under Articles 33 and 34 GDPR, among others, may result in fines of up to EUR 10 million or 2% of total worldwide annual turnover in the preceding financial year, whichever is higher.

---

If you have any further questions or require additional information, please contact your business relationship person or use the enquiry form on the HLB Poland website.

Contact us »

***