Poland

Art. 23(1) requires an internal reporting procedure in legal entities with at least 50 people performing paid work; Art. 23(3) removes the threshold for certain sectors such as financial services. Art. 25(1)(5) requires acknowledgement within 7 days and Art. 25(1)(7) feedback within 3 months. Retaliation is prohibited (Art. 11), and failing to set up a procedure is punishable by a fine (Art. 58).

Art. 10(1) requires the entity to notify the President of UODO within 14 days of designating a data protection officer; Art. 10(4) applies the same 14 days to changes and recall. Notification is electronic with a qualified or ePUAP trusted signature (Art. 10(6)), and the officer's details must be published on the entity's website (Art. 11).

UODO states that the controller must notify the supervisory authority 'without undue delay' under Art. 33(1) GDPR unless the breach is unlikely to result in a risk to individuals, and must record the reasons for any decision not to notify; high-risk breaches also require notice to the individuals (Art. 34). Recital 85 of the GDPR on EUR-Lex adds 'where feasible, not later than 72 hours after having become aware of it'. Art. 55 of the national act lets the President run an ICT system for breach notifications.