KRS Law Firm · Compliance
GDPR for Business
GDPR applies to every business processing personal data — about customers, employees or business partners — regardless of size or legal structure. Many business owners still see it as bureaucracy concerning only large corporations. That misconception can be costly: inspections include small entities, and properly implemented data protection can strengthen customer trust. We help implement data protection suited to the realities of your business. We are based in Łódź and advise clients throughout Poland.
We provide data protection support within a broader compliance system — GDPR works best alongside the company’s other obligations rather than in isolation.
KRS
01
Why GDPR Is More Than a Formality
Breaches can attract fines of up to EUR 20 million or 4% of annual turnover. Poland’s data protection authority, UODO, imposes lower but still significant penalties in practice, many avoidable through basic procedures. Its annual inspection plans for 2026 focus in particular on marketing businesses, online sales and delivery platforms and healthcare providers.
02
What GDPR Documentation Does a Business Need?
The scope depends on the scale of processing, but even microbusinesses need a minimum set of safeguards. These include a data protection policy, processing records and data processing agreements with external providers such as accountants or IT companies. Breach response procedures and evidence of appropriate safeguards are also important, particularly during an inspection.
A common mistake is copying templates without adapting them to actual operations. Such records can be as risky as having none, describing processes that do not exist while overlooking real ones. We therefore begin by analysing which data the business actually processes and why.
03
When Is a Data Protection Officer Required?
Contrary to a common belief, most small businesses do not need to appoint a Data Protection Officer. Appointment is generally required for public bodies, where core activities involve large-scale regular and systematic monitoring, or where special-category data is processed on a large scale. We assess whether the obligation applies. Where required, an external provider may fulfil the role under contract.
04
How We Implement GDPR
We begin with an audit of the data processed, the relevant processes and their legal bases. We then prepare tailored records, implement procedures, put processing agreements in place and train staff where needed. In complex cases, we conduct a Data Protection Impact Assessment (DPIA), required where processing creates a high risk for individuals.
Data protection is closely linked to online operations, where customer data is processed throughout. We therefore advise online businesses jointly on new technology and e-commerce law, including online shop terms that must align with the privacy policy.
Contact
Contact Us
Do You Want to Implement GDPR or Check Whether Your Current Documentation Will Stand Up to Inspection? Get in Touch. We will audit your arrangements and prepare lawful solutions suited to your business without unnecessary bureaucracy.