UODO's 2025 Annual Report Shows Sharp Rise in Fines, Complaints, and Data Breach Notifications

Key Takeaways

• Poland's data protection authority (UODO) reported a 363% increase in total administrative fines and a 61% jump in complaints in 2025, signaling intensified enforcement activity.
• Compliance teams operating in Poland should note the sharp rise in breach notifications (51% increase) and inspections (52% increase), reflecting heightened regulatory scrutiny and public awareness of data protection rights.

Deep Dive

The UODO's annual report for 2025 reveals a marked escalation in regulatory activity across nearly every enforcement metric, signaling a more assertive supervisory posture under President Mirosław Wróblewski. Total administrative fines rose from PLN $13,907,740.96 in 2024 to PLN $64,436,940.25 in 2025—a 363% increase—despite only an 18.5% increase in the number of fines imposed (32 vs. 27). This suggests the UODO is pursuing larger, more impactful penalties rather than simply increasing enforcement volume, indicating a strategic shift toward deterrence through significant financial consequences for data controllers and processors operating in Poland.

For compliance teams, the 61% increase in individual complaints (12,827 vs. 8,056) and 51% increase in breach notifications (22,435 vs. 14,842) are particularly notable. Common complaint areas include email misdirection, video surveillance, debt collection data processing, marketing data use, children's data minimization, and banking sector data sharing (including creditworthiness assessments and bank secrecy issues). Organizations in these sectors—particularly banking, education, healthcare, and employers handling health data—should prioritize reviewing data handling practices in these specific risk areas, as they represent the most frequent sources of regulatory complaints and breach notifications.

The 52% increase in inspections (76 vs. 50) also reflects more proactive enforcement, with inspections conducted under sectoral plans, breach-triggered reviews, and EU large-scale systems oversight (including Schengen Information System and Visa Information System compliance). Compliance teams should anticipate increased likelihood of regulatory inspection, particularly if their sector falls under the UODO's sectoral inspection priorities or if they have experienced notified breaches.

Notably, the report also highlights the UODO's first criminal referral involving AI-generated deepfake imagery of a minor, underscoring emerging regulatory attention to AI-related privacy harms—an area compliance teams should monitor closely given growing AI deployment across industries. Additionally, the UODO issued opinions on 981 draft legal acts (up from 779), indicating active engagement in shaping Poland's evolving data protection legislative landscape.

Recommended actions include: (1) reviewing data breach notification procedures and response times given increased regulatory scrutiny; (2) auditing email correspondence protocols, video surveillance practices, and data sharing arrangements—particularly in banking and education sectors; (3) assessing AI tool usage for potential privacy risks, especially regarding minors; (4) preparing for potential inspections by ensuring documentation and compliance frameworks are current; and (5) monitoring UODO guidance and legislative opinions for forthcoming regulatory changes. Given the substantial increase in fine amounts, organizations should treat Polish GDPR compliance as a heightened enforcement risk area in 2026.

Source: Poland Inspector General for Personal Data Protection (UODO)