What Polish employers can access and why
Polish employers may collect and access only data necessary to hire, pay, manage and protect the workplace, under GDPR and the Labour Code. Typically this includes identification and contact details, education and qualifications, bank and tax identifiers, social insurance numbers, and occupational health clearance certificates. Monitoring (email, GPS, CCTV) is permitted only for specific, lawful purposes with clear notice. Access must be strictly need-to-know; HR and payroll require broader visibility than line managers.
For foreign nationals, employers often need to process work authorisation and residence information to evidence lawful employment. This can include copies of permits and visas where a legal obligation or legitimate interest is documented. Keep only what is needed to demonstrate compliance to authorities and auditors, and define retention up front. Where obligations are unclear, document your reasoning and verify with counsel before retaining scans indefinitely.
Lawful bases and consent pitfalls under GDPR
In Poland, the most common lawful bases are: legal obligation (payroll, ZUS reporting, health and safety), contract necessity (managing the employment relationship), and legitimate interests (IT security, property protection, defending claims). Consent is rarely appropriate in employment due to imbalance of power; use it only for optional benefits or future recruitment pools, and ensure it is freely given, specific, informed and revocable without consequences.
Examples help anchor choices. Email or CCTV monitoring usually relies on legitimate interests, supported by a documented balancing test and clear internal rules. Health-check certificates align to legal obligations in occupational medicine. Diversity reporting may require anonymisation or explicit consent if not mandated. When in doubt, map each processing purpose to one lawful basis and avoid stacking multiple bases to “be safe.”
Practical retention periods: what to keep and for how long
Personnel files have long horizons. For employment started on or after 1 January 2019, files are typically retained 10 years; earlier hires remain 50 years unless the employer filed the relevant ZUS report (e.g., ZUS RIA) to shorten this to 10 years. Confirm document categories and dates with current ZUS and Labour Inspectorate guidance. Payroll and tax documentation is commonly kept five years from the end of the tax year; validate with your tax advisor.
Recruitment data should be deleted when a hiring process ends unless you can justify a short, defined retention to defend against claims, or you have separate, revocable consent for a talent pool. Many employers set 6–12 months for unsuccessful candidates with clear notices. CCTV footage is generally kept up to three months unless needed as evidence. Occupational health providers hold medical records; employers usually keep only the fit-for-work certificate and related referrals as required.
Handling special categories and criminal data
Special-category data (health, union membership, biometric data) needs a specific Article 9 condition. In employment, this is often Article 9(2)(b) for rights and obligations under labour and social protection law. Collect only what the law requires (e.g., pre-employment and periodic medical assessments, maternity protection, disability accommodation) and store it separately with tight role-based access and audit trails. Managers should see only what they need, not full medical details.
Criminal-conviction data is more restrictive. In Poland, employers may request a criminal record certificate only if a statute requires it for the role (for example, certain finance, education, or security positions). Use official channels, process under Article 10, and avoid self-declarations as a shortcut. Keep results only as long as necessary to prove compliance or as specified by sectoral rules, and define re-check intervals where legislation obliges periodic verification.
Data subject requests: a step-by-step workflow
A simple, repeatable DSAR workflow prevents panic. 1) Intake and verify identity. 2) Log the request and clarify scope (systems, dates, keywords). 3) Search mailboxes, HRIS, payroll, messaging, and archives. 4) Review for third-party data and legal privilege; redact as needed. 5) Decide on any two-month extension and explain why. 6) Respond within one month, securely, and record the outcome. Test this process quarterly.
A realistic case: a former employee asks for all messages with their manager over two years. The right of access covers personal data, not entire mailboxes. Provide a description of processing, categories, recipients, retention, and copies of personal data (email extracts) where feasible, redacting third-party details. Explain your legal basis, any exemptions applied, and how to complain. Keep an internal log to evidence timeliness and proportionality in case of inspection.
Secure handling in Polish operations: systems and vendors
Security should match risk. Map data flows; minimise fields in forms; restrict access by role; apply MFA; encrypt disks and databases; prefer managed email with DLP; separate production from test data; and enforce secure disposal (shredding, cryptographic wipe). Automate offboarding to revoke access the same day. Monitor admin actions, rotate secrets, and run quarterly awareness training focused on real incidents (misdirected emails, lost devices, phishing).
Most Polish employers rely on processors: payroll providers, occupational medicine clinics, recruitment portals, cloud HRIS. Sign GDPR-compliant data processing agreements with clear subprocessor lists, breach-notification windows, and assistance for DSARs and deletions. For any non-EEA access (global support teams, cloud analytics), use the EU Standard Contractual Clauses and document a transfer impact assessment. Check where backups and logs are stored, and who can see them during support.
Common mistakes, a checklist, and next steps
Frequent pitfalls include: letting too many people see salary and health data; keeping ID or visa scans without a defined purpose or end date; relying on consent for core HR processing; storing medical details in the HRIS instead of only fitness certificates; unlimited CCTV retention; and running monitoring without a documented legitimate-interest test and clear workplace rules.
Quick checklist: map data and purposes; select one lawful basis per purpose; publish a clear employee privacy notice; limit access and log it; document retention schedules (including the 10/50-year file rule); test DSARs; review CCTV and monitoring rules; audit vendors and cross-border transfers. For updates and inspections, see the Polish Labour Inspectorate (https://www.pip.gov.pl/en), the gov.pl family portal (https://www.gov.pl/web/family) and ZUS (https://www.zus.pl/en). If you want structured help aligning policies, records and contracts, Auranik’s Workforce Compliance Support (/poland/workforce-management) can coordinate the work and supply practical templates.
Community content reflects individual experiences and should not be treated as legal, immigration, financial or government advice.
Know someone who may find this guide useful?