The right GDPR software for a Polish organisation is the system its people can maintain and explain. It should help an accountable owner describe processing, update security decisions, answer rights requests and show the Urząd Ochrony Danych Osobowych (UODO) the relevant evidence if asked. It cannot guarantee a favourable inspection, replace legal decisions or make a supplier contract valid by attaching a PDF. A spreadsheet with clear owners may be sufficient for a small, stable operation; a platform may earn its cost when several teams and companies need to coordinate versions and approvals.
This is a buying test, not a ranking or a current price list. Compare your existing process with the actual modules and services a vendor quotes. Product nationality does not prove Polish-language output, data location or suitability for UODO proceedings. The general GDPR software guide surveys broader categories. This page asks what a Polish buyer should make every shortlisted supplier demonstrate.
Use the Morele.net history accurately
The Morele.net case is a useful example of why security evidence matters, but its chronology cannot be reduced to “a PLN 2.8 million fine in 2019”. The 2019 UODO decision was set aside in the course of litigation. UODO issued a new decision on 17 January 2024 imposing more than PLN 3.8 million; its official case report explains the renewed security assessment. A later UODO account of the court judgment says the administrative court dismissed Morele.net’s complaint against that new decision. These are dated enforcement and court actions, not a benchmark for what another company will be fined; the general GDPR fines guide addresses the wider landscape. Review the exact procedural status before using a headline amount in procurement material.
For a buyer, the practical question is whether the system helps reconstruct what measures were in place before an incident, why they were chosen and how they changed. Give the vendor a fictional customer database with several access roles, a hosting supplier and a newly discovered exposure. Ask for the dated security assessment, owner, evidence of implementation, incident facts and later corrective measures. A checklist saying “encryption: yes” without identifying systems or verification is weak. The Article 32 security guide gives a separate framework for judging proportionality; no single control or product eliminates Article 32 risk.
Do not turn the case into a mandatory software purchase. Article 5(2) GDPR requires the controller to demonstrate compliance, Article 24 requires appropriate measures, and Article 32 concerns security appropriate to risk. A maintained manual file can hold credible evidence. Conversely, an expensive platform full of unreviewed default controls may make it harder to distinguish a real measure from an assertion. Ask who confirms a control, which source they checked and when they will review it again.
Establish the Polish and EU legal frame
The Polish Personal Data Protection Act of 10 May 2018 provides national institutional and procedural provisions alongside the GDPR. Sectoral Polish laws can matter for a particular processing activity; the Act’s title alone does not imply that a vendor has encoded every employment, health or public-sector rule. Have local counsel or the responsible compliance team identify the actual national provision relevant to the trial rather than buying a generic “Poland mode”. For information given to Polish individuals, clarity and accessibility matter under Articles 12–14 GDPR. A Polish-language notice may be needed for the actual audience even if the procurement team uses an English interface; no rule makes every internal screen Polish.
If the service is offered directly to children and consent is the Article 6 basis, Article 8’s age rule may matter. Polish UODO explains the under-16 position for such information-society services; it is not a general age of legal capacity or a rule that all children’s processing requires parental consent. The GDPR also distinguishes preventive or counselling services offered directly to a child in Recital 38. Include this only if your product actually has that use case. Most SME procurement trials are better spent on real current processing than on an irrelevant child-service toggle.
Make the Article 30 register test concrete
Use a Polish trading company that manages employees, an online shop and outsourced payroll. Ask for one activity record for each role: as controller over customers and staff, and as processor if it performs a service on another controller’s behalf. Article 30(1) and (2) do not have identical fields. The UODO register guidance explains that the controller or processor, not the IOD automatically, owns the obligation. The tool should make the responsible business owner visible. Ask them to change a recipient, purpose and retention decision, then produce an export with current information and a readable history of the change. The ROPA guide expands the required fields.
Do not demand a fictional “UODO-certified export”. Article 30(3) permits written electronic records, and Article 30(4) requires making them available to the supervisory authority on request. UODO offers examples but does not designate a single vendor format as the only acceptable one. It is also inaccurate to say the register is always the first document requested in every inspection. A useful export should be complete, legible and traceable to the owners who verified it. Separate legally required fields from helpful extras such as lawful basis, review date or evidence link, and test whether the extra fields obscure any required category.
A company below 250 people is not automatically exempt. Article 30(5) has activity-level limits: processing that is not occasional, is likely to result in risk to rights and freedoms, or includes Article 9 or 10 data still needs a record for the relevant activity. Payroll and ongoing customer management are generally not occasional. Ask the vendor to record the reason for an exceptional activity’s treatment instead of offering a button that marks the entire company “SME exempt”. A disciplined spreadsheet can do this too. The spreadsheets-versus-automation guide helps assess when coordination costs justify a change.
Test Polish notices, requests and processor terms
Generate a notice from the fictional shop’s actual facts: controller identity, purposes and lawful bases, recipients, retention or criteria, rights and relevant transfer information. Have a Polish reader who did not build the draft identify what happens to their data. A supplier-provided Polish template can save editing time, but it cannot decide that a particular marketing purpose rests on consent rather than legitimate interests, or that an indefinite retention statement is adequate. Keep the reviewed version and evidence of delivery. A translated placeholder is a starting point, not a legal conclusion.
Next, submit a fictional access request spanning the online shop and support system. Article 12 usually requires action without undue delay and within one month of receipt; an extension of up to two months is conditional, and the individual must be told why within the first month. If the controller does not act, Article 12(4) requires reasons without delay, at the latest within one month, plus information about a complaint and judicial remedy. Check that the system tracks receipt and communication, rather than restarting the clock when a task is assigned internally. Identity checks should be proportionate to reasonable doubt, not an automatic demand for a copy of an identity card. The access-rights guide helps test response substance and mixed third-party data.
For an outsourced payroll provider, review the processor relationship. GDPR Article 28 permits a written contract, including electronic form, or another binding Union or Member-State legal act meeting the required content. Ask where the documented instructions, confidentiality, security, subprocessors, assistance, audits and exit duties are reviewed. At exit, the processor returns or deletes the personal data at the controller’s choice and deletes existing copies, except where Union or Member-State law binding the processor requires storage. Test how it accounts for backups without asserting an invented immediate technical deadline. A processor-contract guide helps distinguish this legal review from merely uploading a signed file.
Compare vendor claims with a shared trial
The market includes privacy platforms, broader enterprise suites, consultancy-supported tools and an internal spreadsheet plus task system. Provider pages describe their own products; they do not establish a verified ranking, Polish localisation in every module, a particular hosting location or prices for your organisation. A comparison of two privacy platforms can frame breadth questions if both are on a shortlist, but a 50-person Polish company is not automatically better served by either one. If the group also has a German entity, the Germany software guide can flag separate local questions without treating either country guide as a substitute for the other.
Give each candidate the same fictional pack: three ROPA entries, a processor change, an access request, a missing security approval and a Polish notice. Make the buyer perform the work after a short introduction. Capture what was demonstrated, what required configuration, what was promised only by sales and what remained absent. Then ask a different employee to read the export without the product. The key criterion is not whether an interface looks polished; it is whether the organisation can explain a decision and correct an error after its original owner leaves. Keep the supplier’s exact version, demo environment and contract proposal with the evaluation.
The quote should cover licensed modules, entities, users, implementation, Polish writing or review work, support, integrations, storage, migration and export after termination. Old online starting prices and guessed euro-to-złoty conversions are poor procurement evidence. Use a software cost framework to compare like with like, not to claim what every vendor charges. Internal time matters too: a lower licence cost can conceal manual reconciliation across companies, while a broad suite can be expensive to configure for a narrow need. Do not compare a bare licence to a managed service as if they were the same offer.
Check where information actually flows. EU/EEA hosting is relevant, but support access, subprocessors and backups may create a transfer question; a provider incorporated outside the EU is not automatically forbidden. Document any Chapter V mechanism and safeguards where needed. Ask which people at the vendor can see personal data during support, how access is logged and what happens to exported copies. A contractual answer needs to match the demonstrable workflow. Never substitute an “EU based” badge for a data-flow map.
Sequence implementation around business owners
Begin with the activity owners, not a full import. Choose three representative activities, resolve ambiguous roles and identify the person who can confirm recipients and retention. Then assess security measures for those systems and connect the processor agreements. Only after the source information is reliable should the team automate recurring rights-request and review tasks. Otherwise the new system will distribute uncertain entries faster. A GDPR compliance checklist helps separate the obligation inventory from the software buying decision.
A practical migration includes a dated source snapshot, a mapping from old to new identifiers, a list of entries that were not imported and a review of permissions. Test an access request that arrives before the switchover and is answered after it; the legal deadline does not restart because of a software change. Preserve relevant historical decisions without keeping personal data beyond justified periods. Choose a cutover date after which the new record is authoritative, and leave old access read-only until the exit obligations are completed. Ask the vendor to demonstrate selective export for a single entity and complete export for the group if both matter to your organisation.
Review the first month after go-live: which entries were corrected, which owners are overdue, which requests required manual research and which promised connections did not work? If a new activity is likely to result in high risk, evaluate whether a data protection impact assessment is required under Article 35 rather than assuming every project or no small project needs one. This is not a universal implementation timetable. The length of a rollout depends on the number of systems, unresolved facts and available owners. A small company can still have complicated processing; a large group can maintain a good existing register. A tool earns its place by reducing the effort of keeping decisions accurate, not by fitting a staff-count bracket.
Questions from Polish buyers
Does UODO require a particular GDPR platform or export?
No. The legal duties concern the substance and availability of the records, responses and safeguards. Article 30 allows a written electronic record and requires availability to the authority on request. Ask for a complete readable export and an owner who can explain it, rather than a vendor claim of certification.
What happened to the original Morele.net fine?
The first decision, imposing roughly PLN 2.8 million in 2019, was set aside. UODO imposed a new fine exceeding PLN 3.8 million in January 2024, and its subsequent official account reports a court judgment dismissing the company’s complaint against that new decision. The dated case history matters; it should not be presented as a current 2019 fine or as a prediction for another buyer.
Must the whole product interface be in Polish?
There is no universal interface-language requirement of that sort. Test the notices, employee communications and access responses the actual Polish audience will receive, as well as the ability of staff to operate the tool. A translated template must still reflect the real processing facts.
What annual budget should an SME assume?
No reliable universal figure follows from employee count. Ask for quotes on the same modules, entities, services and exit scope; add implementation and internal work. A spreadsheet remains a valid baseline if it can be kept complete, accurate and available. Compare evidence produced and work saved, not a guessed price bracket.
A Polish software decision should leave the team able to show a current processing record, dated security reasoning, intelligible local communication, rights handling and reviewed supplier terms. Keep the UODO case chronology accurate and test vendors on your own facts. The outcome may be a platform, a narrower tool or a better-run existing process; none replaces accountable judgment.