{"id":1755,"date":"2026-10-13T12:47:03","date_gmt":"2026-10-13T12:47:03","guid":{"rendered":"https:\/\/autosmarts.co\/en\/guidebooks\/poland-gdpr-data-protection-compliance-guidebook\/"},"modified":"2026-10-13T12:47:03","modified_gmt":"2026-10-13T12:47:03","slug":"poland-gdpr-data-protection-compliance-guidebook","status":"publish","type":"guidebook","link":"https:\/\/autosmarts.co\/en\/guidebooks\/poland-gdpr-data-protection-compliance-guidebook\/","title":{"rendered":"Poland GDPR (RODO) Data Protection Compliance Guidebook for Automotive Companies"},"content":{"rendered":"\n

What this guidebook covers<\/h2>\n\n\n\n

A dealer holds more data than many banks: ID cards, driving licences, bank details, addresses and vehicle data, passed on to the importer, banks and insurers. GDPR (RODO in Polish) allows fines of up to \u20ac20 million or 4% of worldwide turnover. UODO (the Personal Data Protection Office) fined McDonald's Polska PLN 16.9 million over gaps in its risk analysis and security.<\/p>\n\n\n\n

This guidebook covers 5 data protection standards for dealers, with 12 checkpoints: marketing consent, the information clause, customer rights requests, data security with breach reporting within 72 hours, and processing agreements and retention. The guidebook PDF is in Polish.<\/p>\n\n\n\n

The 5 data protection standards<\/h2>\n\n\n\n
Code<\/th>Standard<\/th>Ideal fix time<\/th><\/tr><\/thead>
DAN-01<\/td>Marketing consent<\/td>Immediate<\/td><\/tr>
DAN-02<\/td>Information clause<\/td>30 days<\/td><\/tr>
DAN-03<\/td>Customer rights requests<\/td>7 days<\/td><\/tr>
DAN-04<\/td>Data security<\/td>24 hours<\/td><\/tr>
DAN-05<\/td>Processing agreements and retention<\/td>30 days<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

How to run a Polish GDPR (RODO) data protection audit, step by step<\/h2>\n\n\n\n
    \n
  1. Confirm what applies.<\/strong> Map every channel where customer data is collected and everyone it is passed to; data sent to the importer needs a legal basis and must be described in the information clause.<\/li>\n\n
  2. Walk the site, standard by standard.<\/strong> Score each of the 12 checkpoints Pass, Fail or N\/A. N\/A only where the standard rules it out, with the reason recorded. Check consent forms and test an opt-out, collect the clauses from every channel, walk the showroom to see where customer files are kept, and check MFA on the DMS and CRM.<\/li>\n\n
  3. Capture the evidence.<\/strong> A pass counts only with proof captured at the time of the audit: consent forms and opt-out test results, information clauses, the requests register, photos and system settings, processing agreements and the deletion schedule.<\/li>\n\n
  4. Give every fail an owner and a fix time.<\/strong> Record what you saw and who owns the fix. Each standard carries an ideal fix time, from immediate to 30 days, counted from audit submission (see the table above).<\/li>\n\n
  5. Fix it, then prove it.<\/strong> The site fixes the cause and uploads proof of closure; the auditor checks the proof before closing the finding.<\/li>\n\n
  6. Re-check at the next audit.<\/strong> Confirm closed findings stay closed, and look for the same fail at your other sites so one gap doesn't repeat across the network.<\/li>\n<\/ol>\n\n\n\n

    Who this guidebook is for<\/h2>\n\n\n\n
      \n
    • Boards: the size of the risk<\/li>\n\n
    • Marketing and sales: collecting consent correctly<\/li>\n\n
    • Data protection officers (IOD) and auditors: testing consent and requests<\/li>\n<\/ul>\n\n\n\n

      A reference document, not legal advice. Fines and rules change: check the current text with the regulator or your legal adviser before acting.<\/p>\n\n\n","protected":false},"excerpt":{"rendered":"

      Marketing consent, information clauses, customer requests, security and suppliers: what UODO checks, and why an open cabinet of customer files is a risk worth millions.<\/p>\n","protected":false},"featured_media":1837,"menu_order":36,"template":"","meta":{"footnotes":"","_as_region":"Poland","_as_topic":"Data protection","_as_edition":"Edition 1 \u00b7 2026","_as_standards":"5","_as_checkpoints":"12","_as_pages":"10","_as_language":"Polish","_as_law":"GDPR (RODO, Regulation (EU) 2016\/679) \u00b7 Personal Data Protection Act 2018 \u00b7 Electronic Communications Law","_as_regulator":"UODO (Personal Data Protection Office), with UKE (Office of Electronic Communications) and UOKiK for electronic marketing","_as_facts":"\u20ac20M | or 4% of turnover: the maximum GDPR fine\nPLN 16.9M | UODO fine for McDonald's Polska\n72 hours | to report a data breach to UODO","_as_pdf":1756,"_as_checklist_1":804,"_as_checklist_2":0,"_as_checklist_3":0,"_as_guide":0,"_as_solution":557},"class_list":["post-1755","guidebook","type-guidebook","status-publish","has-post-thumbnail","hentry"],"_links":{"self":[{"href":"https:\/\/autosmarts.co\/en\/wp-json\/wp\/v2\/guidebook\/1755","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/autosmarts.co\/en\/wp-json\/wp\/v2\/guidebook"}],"about":[{"href":"https:\/\/autosmarts.co\/en\/wp-json\/wp\/v2\/types\/guidebook"}],"version-history":[{"count":1,"href":"https:\/\/autosmarts.co\/en\/wp-json\/wp\/v2\/guidebook\/1755\/revisions"}],"predecessor-version":[{"id":1757,"href":"https:\/\/autosmarts.co\/en\/wp-json\/wp\/v2\/guidebook\/1755\/revisions\/1757"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/autosmarts.co\/en\/wp-json\/wp\/v2\/media\/1837"}],"wp:attachment":[{"href":"https:\/\/autosmarts.co\/en\/wp-json\/wp\/v2\/media?parent=1755"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}