Poland's UODO and ZUS to Host Digital Administration Data Protection Seminar in Legnica

Key Takeaways

• Poland's data protection authority (UODO) and the Social Insurance Institution (ZUS) will co-host a free seminar on September 24, 2026, on controller responsibilities for collecting, storing, and disclosing personal data in digital administration.
• The event is not a new rule, but it signals UODO's current supervisory priorities, including lawful processing and digital sovereignty in the age of AI.
• Compliance teams with Polish operations should treat it as an informal view into regulatory expectations.

Deep Dive

Poland's data protection authority (UODO) and the Social Insurance Institution (ZUS) will co-host a free seminar on September 24, 2026, on controller responsibilities for collecting, storing, and disclosing personal data in digital administration. The event is not a new rule, but it signals UODO's current supervisory priorities, including lawful processing and digital sovereignty in the age of AI. Compliance teams with Polish operations should treat it as an informal view into regulatory expectations.

The seminar title centers on the controller's responsibility across the data lifecycle (collection, storage, and disclosure), which reflects core GDPR accountability principles. The agenda includes two panels, one on the importance of data protection in digital administration and one on the principles of lawful data processing as organizations carry out their tasks. UODO staff from the Law and New Technologies Department and the Division of Cooperation with Data Protection Officers will participate, which suggests a focus on practical DPO guidance.

The opening lecture, "Where Does Data Reside in the Age of AI? Digital Sovereignty as a New Perspective on Data Protection," is the most notable signal. It points to growing regulatory attention on data location, cross-border transfers, cloud and AI processing arrangements, and the control organizations retain over data held by vendors. Financial institutions with Polish operations or Polish data subjects should expect these topics to feature in future UODO guidance, inspections, or enforcement. Public administration participation also suggests that data disclosure between public bodies and private controllers may draw scrutiny.

Key dates are as follows. The seminar takes place September 24, 2026, at 10:00 a.m. at Collegium Witelona State University in Legnica. In-person registration closes September 21, 2026, and space is limited, with confirmation by email. Attendance is free. The event will also be streamed live on the "Elektroniczny ZUS" YouTube channel, with no registration required for online viewing. The audience includes public administration representatives, data controllers, and data protection officers.

Recommended actions: Have the Polish DPO or privacy team register or watch the livestream, and have them summarize takeaways, especially any UODO statements on AI, data residency, and digital sovereignty. Review current records of processing, vendor and cloud contracts, and transfer mechanisms against these themes. Confirm that policies on data disclosure to public bodies and other third parties align with controller accountability expectations. Monitor UODO publications after the event for related guidance or published materials.

Risk impact is low and indirect. There is no deadline for compliance and no direct penalty exposure from this notice. The residual risk is strategic: organizations that overlook the emphasis on AI-related data governance and data location may be less prepared if UODO later issues guidance or begins targeted supervision.

Source: Poland Inspector General for Personal Data Protection (UODO)