Data privacy and data protection in Poland

Bird & Bird Szepietowski i wspólnicy sp. k.

'Extremely skilled and active', Bird & Bird Szepietowski i wspólnicy sp. k.'s data protection team regularly works alongside the firm's offices in other jurisdictions to provide clients with cross-border data protection services across Europe; often coordinating matters from Warsaw. The group is instructed on data protection implementation projects and is noted for assisting clients with issues such as digital marketing and customer loyalty programmes. The group is led by Izabela Kowalczuk-Pakuła, a lawyer with 'in-depth knowledge in the various aspects of data protection laws and regulatory practice and demonstrating an excellent understanding of the digital advertising sector'. Senior associate Marta Kwiatkowska-Cylke, 'an outstanding lawyer', is recommended for GDPR implementation projects and compliance issues. Consultant Emilia Stępień, who has experience working as a data protection officer, is another name to note for GDPR implementation and day-to-day data-related issues.

Practice head(s):

Izabela Kowalczuk-Pakuła

Other key lawyers:

Marta Kwiatkowska-Cylke; Emilia Stępień; Paulina Bełzak


‘Expert team that is very easy to deal with. Advice is always pragmatic and on time. Both proactive and responsive. An excellent service. ’

‘We have huge confidence in Iza’

‘Izabela Kowalczuk-Pakuła is a brilliant partner, her knowledge and intuition regarding data protection is outstanding.

Paulina Bełzak is an associate with great knowledge, dedicated to her work.’

‘The data protection team is extremely skilled and active. Izabela Kowalczuk-Pakula is heading the team in a very remarkable way. She is extremely dedicated and strong that she stands out in comparison to other peers. She is particularly also extremely well connected in the data protection community leaving an impact there. 

‘Izabela Kowalczuk-Pakula is heading the team. She is focused and swift in her replies. Always on the spot. Great industry knowledge. Really a pleasure to work with.’

Marta Kwiatkowska-Cylke is responsive and an outstanding lawyer.

‘This team has an excellent knowledge of data protection laws, including all current opinions and rulings of the European courts and authorities. They can apply this knowledge in practice and provide business-oriented and “out of the box” solutions for our business (in particular new products and services). They understand business based on new technologies, including machine learning.’

‘The department is very professional with an extensive knowledge of GDPR in marketing. I can rely on the lawyers’ opinions and advice, they keep their eyes on changing GDPR rules and regulations on Polish market, helping us to update our Policies, other documents and general approach to Data Protection. They are very helpful and quick in their reaction.’

‘Very approachable and responsive.’

Combination of thorough knowledge of privacy legislation and practical approach to solving privacy issues. Proactive attitude to client.’

‘Izabela Kowalczuk-Pakuła and Marta Kwiatkowska-Cylke are real privacy geeks. Curious not only about pure data privacy legislation but also about TMT sector challenges, Information Security, HR and other areas of common concern. Carefully listening to business needs and quickly adapting to client.’

‘The team is very professional. The lawyers are true specialists with a justifiably excellent reputation. Within the projects they handled for us they managed to build great trust. Advice and legal opinions are always carefully prepared while expressing a pragmatic approach to the problem. They are open-minded, flexible, and not afraid of taking challenging projects, at the same time demonstrating focus on business needs.’

‘Working with Izabela Kowalczuk-Pakula is absolutely a great pleasure She is very friendly and creates an atmosphere of trustworthy business relationship. I find her an exceptional expert in data protection law. I have observed her working style for the last few years and I think, she is a great manager and always pays the same level of attention to all her clients. She is always ready to help, extremely good and sufficient in anticipating any potential risks, with the ability to communicate them to business and make sure the potential solutions are presented to the client.’

‘I was asked by my colleagues in the UK who in Poland would be good to help them in one complex case where the HR and GDPR issues were mixed together and should be resolved according to Polish law. I have no doubts that this firm, in particular Izabela Kowalczuk-Pakula, will be ready to help us professionally taking into consideration tight deadliness and language. ’

‘Izabela Kowalczuk-Pakuła leads the law firm’s data protection practice. She has an in-depth knowledge in the various aspects of data protection laws and regulatory practice and demonstrates an excellent understanding of the digital advertising sector. ’

‘Client oriented, the team is able to deliver material, which is meeting the client’s needs in his specific field of operation and at the same time which is GDPR compliant, well written and edited and thus understandable not only for in-house lawyers but also for the staff of the company. ’

‘The team is determined to understand the business challenges and find a solution which works for the business, not only addressing legal aspects.’

Key clients

Oriflame Cosmetics Global S.A., Luxembourg, Schaffhausen Branch

Media Direction Sp. z o.o.


IKEA Retail

Grupa Pracuj sp. z o.o., eRecruitment Solutions sp. z o.o.

Stock Polska Sp. z o.o.

Skanska Group

FS File Solutions / Kelo Corporation (


Michael Page International (Poland) sp. z o.o.

Work highlights

  • Supporting Media Direction, an international advertising agency and its Polish branches, with organising its digital marketing activities (retargeting, programmatic, look-alike retargeting, Facebook custom audience, among others).
  • Advised Grupa Pracuj and eRecruitment Solutions on the Code of Personal Data Protection in recruitment, initiated by Grupa Pracuj.
  • Assisted Oriflame Cosmetics Global S.A., Luxembourg, Schaffhausen Branch, a leading global cosmetics manufacturer, with a number of issues where a pragmatic approach towards the data protection rules was essential.

Kobylanska Lewoszewski Mednis

Data privacy is at the core of Kobylańska Lewoszewski Mednis' focus as a firm and the group is a key name for clients in the e-commerce, media, technology, video gaming and financial services sectors. Jointly leading are co-founding partners 'very skilled lawyerAnna Kobylańska, whose specialisms include big data and the use of personal data in the internet of things (IoT) and behavioural targeting, as well as IT systems implementation projects; Marcin Lewoszewski, who has vast experience representing clients in proceedings before the data protection authorities; and Arwid Mednis, whom clients see as 'an absolutely star practitioner in the field which makes the firm very competitive when it comes to seeking advice'. Mednis is regularly instructed on GDPR implementation projects, including in relation to government entities.

Practice head(s):

Anna Kobylańska; Marcin Lewoszewski; Arwid Mednis, Partner


The law firm provides high level of legal advice in data privacy and data protection matters. The lawyers have profound knowledge, extensive experience and a business approach. A special knowledge in data protection can be easily applied to a given business case in such a way that a comprehensive product is worked out.’

Top-notch and best on the market knowledge in GDPR related issues, supported with a relevant practice and efficiency with defending the client’s position during potential proceedings.

KLM law firm is very eager to learn about business of their clients, they listen a lot before proposing solutions and giving answers. They have a good combination of being knowledgeable about law and about business.’

Anna Kobylańska is a very skilled lawyer, with broad knowledge, having profound experience. She is a very good advisor for structuring business scenarios where data protection regulations have to be taken into account. Anna knows diverse practices available on the market and related to data protection, which is a significant benefit in cooperation with her. She is always up-to-date with new regulations and their interpretations same as with significant court’s decisions.’

The undoubted added value is that employees analyse the problem not only of the current step, which is subject to analysis, but also very thorough and detailed analysis of the activities before and after it. Together with the client, they consider various scenarios, asking for details, often making the client aware of some actions or circumstances that occur in the process. They are able to identify risks and make the client aware of the necessary actions.’

Marcin Lewoszewski and Anna Kobylańska – they communicate well and are real experts in their fields.’

Arwid Mednis is an absolutely star practitioner in the field which makes the firm very competitive when it comes to seeking advice.’

Arwid Mednis is a star individual on the Polish market with academic background and so his specialized knowledge is very valuable. His extensive professional experience makes him an industry leader and a first choice counsel when it comes to even the most complex matters. He is actively involved in public discussions on industry problems and so may easily relate to practical challenges businesses face.

Key clients

City of Warsaw

Work highlights

  • Advising a client on the legal risks related to employee health checks concerning Covid-19, in particular in the light of personal data protection rules.
  • Advising a leading international producer of building materials in relation to personal data protection issues in the setting up of an online marketing platform for its customers.

Maruta Wachta sp. j.

Maruta Wachta sp. j. is consistently praised for its 'vast experience in niche areas of IT law', which it combines with 'a wide experience in GDPR implementation for companies from various economic sectors'. The sizeable team is able to handle data protection and privacy work across the CEE region. The group also has expertise in issues such as profiling, cookies, advertising and real-time bidding. The department is co-led by Sławomir Kowalski, who has been a member of the personal data working group at the Polish ministry of digital affairs; and Marcin Serafin, who is 'talented and solution-oriented'. Senior associate Paweł Tobiczyk is another key team member, having built up a solid GDPR implementation practice. Of counsel Maciej Kawecki draws on previous experience at the data protection authority and ministry of digital affairs to lend the team high-level expertise in compliance issues.

Practice head(s):

Marcin Serafin; Sławomir Kowalski

Other key lawyers:

Paweł Tobiczyk; Maciej Kawecki


‘I worked with several people; all of them are very professional, strict to agreed deadlines, and provide very good quality of work.’

‘Close cooperation with IT-specialists, which allows advice to be given with a very high degree of practicality ’

‘Sławomir Kowalski has profound knowledge in GDPR and IT-issues’

‘Maruta Wachta is a law firm with a unique business approach. Its lawyers are able to estimate and present the risks of certain solutions very well.’

‘People with whom we work with at Maruta Wachta: 1) They have a very good business approach; 2) They communicate in intelligible, plain language; 3) They have experience in the issues they deal with in our cooperation; 4) They are available and timely.’

‘Maruta Wachta’s real strength and added value lies in the fact that they offer full scope support in the area of GDPR compliance combined with vast experience in niche areas of IT law. This combination is ideal for our needs. They also demonstrate international data protection competences, which is invaluable as we work with suppliers from different countries. The data privacy team of Maruta Wachta also has unrivalled experience in working on some of the most sensitive data breaches in Poland. I think that this is the reason why they are so good at advising our company on mitigation strategies. ’

‘We had the pleasure to work with Marcin Serafin, Slawomir Kowalski and Pawel Tobiczyk. They are professional experts in the area of personal data protection and provide practical recommendations to ensure our business is GDPR compliant. They are very flexible, knowledgeable in GDPR issues and detail-oriented. They convey complex legal advice and supports us in the process of concluding and negotiating data processing agreements.’

‘The team is responsible for leading most (and definitely all top ones) of the proceedings relating to GDPR complaints in our country, so it has the unique insight into the actual proceedings in front of a court’

‘I work with Marcin Serafin, who is very knowledgeable both in law and IT topics, which allows us to gather the needed data from the companies we work with. ’

‘Wide experience in the GDPR implementation in companies from various economic sectors. They have been extremely helpful and reacted instantly with pragmatic solutions. The firm excellently deals with complex privacy contexts that also involve cross-border considerations.’

‘Marcin Serafin is a talented and solution-oriented legal adviser. He has not only very impressive knowledge of GDPR, but also in the field of e-commerce technologies, ERP systems, AI and others. He fully understands the need for practical solutions. Besides his encyclopaedic knowledge, he is a very nice person, easy to work with. ’

‘Wide range of experience, openness to non-standard queries, focus on the result pursued by the client ’

‘Marcin Serafin leads the client seamlessly through the complex mix of law and technology’

‘Excellent knowledge of market practices and business expectations. Creativity and the ability to develop solutions that constitute a compromise between regulatory requirements and business goals.’

‘Extensive experience in servicing entities operating in the same industry and the ability to choose the most appropriate solutions.’

‘Very good IT law and data protection practice. An excellent understanding of the data privacy sector and requirements within this area.’

‘Marcin Serafin is a very competent lawyer with outstanding know-how in technologies and data protection.’

‘Very “personalized” client support. The firm always wants to wear the client’s shoes. ’

‘The Maruta Law Firm is a team of highly motivated people, with incredible knowledge, and an innovative approach to solutions.’

Key clients



Biblioteka Publiczna Warszawy – Biblioteka Główna Województwa Mazowieckiego

Circle K


Główny Geodeta Kraju [EN: Surveyor General of Poland]


Inter Cars


Noble Funds

NTT Poland

Operator Chmury Krajowej

Perła – Browar Lubelski


Work highlights

  • Acted for Morele.Net in administrative and court proceedings regarding a breach resulting from a hacker attack.
  • Represented Główny Geodeta Kraju in administrative and court proceedings regarding the qualification of the number of the Land and Mortgage Register as personal data and on charge of obstruction of the investigation by the DPA
  • Advised Warsaw Public Libraries on the Extension of the Central Catalogue of Warsaw Public Libraries project.

Traple Konarski Podrecki & Partners

Data protection and privacy and cybersecurity are core areas for specialist TMT firm Traple Konarski Podrecki & Partners, where lawyers provide a fuller service that includes compliance audits and internal training of data controllers, privacy polices, consulting on data issues arising from new technologies, cross-border data transfers and the protection of trade and business secrets. Xawery Konarski ('a leading figure commanding respect for his depth of knowledge and networking capabilities') heads the team. Jan Byrski focuses on data protection in the financial services sector; administrative law expert Grzegorz Sibiga has a niche in the right to access public information and personal data protection, with experience in proceedings with the regulators.

Practice head(s):

Xawery Konarski

Other key lawyers:

Jan Byrski; Grzegorz Sibiga; Katarzyna Syska


‘This team has an amazing depth of knowledge and expertise and lots of difficult cases under their belt. It also has first-class connections to other privacy experts and regulators in their jurisdiction and is capable of coordinating large scale multi-jurisdictional projects throughout CEE.’

‘Xawery Konaski is a leading figure commanding respect for his depth of knowledge and networking capabilities’

Piotr Wasilewski is a steady coordination hand

‘Very comprehensive knowledge of their clients business, in particular in the IT sector and a wealth of experience predating the GDPR in all matters relating to data protection. ’

‘Xawery Konarski is very well versed in all the relevant data protection issues for IT firms which makes him an invaluable partner when ensuring day-to-day compliance with data protection law. ’

‘Traple Konarski Podrecki & Partners is a well-renowned legal office that combines academic knowledge and functional approach in assisting companies from the IT sector in various areas of business. Their professionalism and understanding of market challenges makes the cooperation effective business-wise and exceptionally convenient.’

‘Katarzyna Syska is a specialist in the field of personal data protection, demonstrates knowledge, professionalism and commitment required to make day-to-day cooperation productive. Her inquisitive and methodical approach allows her to thoroughly examine the challenges and propose accurate recommendations.’

Xawery Konarski, an expert in the field, has deep understanding of all aspects of data protection law, in particular in the area of new technologies. His advice proves crucial for fully understanding both legal challenges and market tendencies in a broad perspective.

‘ Each of the lawyers of the Law Firm deserves special recognition.’

Key clients

Polski Standard Płatności Sp. z o.o.

AV System Sławomir Wolf Sp. j.

Work highlights

  • Advises Polski Standard Płatności Sp. z o.o. (a company established by six banks) on obtaining a license from the National Bank of Poland for the first mobile payment system in Poland.
  • Advised AV System Sławomir Wolf on negotiations for a major IT contract for providing and licensing AV System’s software for global technology corporation in the fields of mobility and digitalisation.
  • Advised a major internet search company on the legal environment concerning cloud services for banks and other financial institutions.

CMS Cameron McKenna Nabarro Olswang Posniak i Bejm sp.k.

At CMS Cameron McKenna Nabarro Olswang Pośniak i Bejm sp.k., lawyers are actively involved in the area of data protection and GDPR advisory work, with experience representing clients before the data protection authorities. The department is led by Tomasz Koryzma, who is increasingly active in new technologies law, including in relation to AI. Koryzma has deep experience in data privacy, and the multijurisdictional use of data. Senior associate Damian Karwala specialises in international digital businesses and financial institutions, which he advises on the spectrum of TMT law, including cybersecurity.

Practice head(s):

Tomasz Koryzma

Other key lawyers:

Damian Karwala; Paulina Komorowska

Key clients

ING Aleo

International Paper

Partner in Petfood



Iron Mountain


Grid Dynamics

Work highlights

  • Advised International Paper on the verification of GDPR implementation in a Polish subsidiary of International Paper and assisted in full-scope GDPR implementation in another International Paper subsidiary.
  • Advised the Polish subsidiary of Partner in Pet Food with regard to GDPR implementation.
  • Assisting Aleo on a day-to-day basis in handling data subject requests (including requests “to be forgotten”), as well as representing the client in the proceedings conducted by the Polish Data Protection Authority in the context of the processing of personal data by Aleo.


Lawyers at Dentons handle the data protection needs of multinationals including Facebook, advising on data protection and privacy issues, including representing them before the Polish authorities. The group has substantial experience advising on the data protection aspects of new services. The group sits within the firm's intellectual property and technology department, which is led by Karol Laskowski. Counsel Dariusz Czuchaj is instructed on GDPR, e-privacy and cybersecurity issues, while associate Izabela Tarłowska's practice involves data issues as they apply to new technologies.

Practice head(s):

Karol Laskowski

Other key lawyers:

Dariusz Czuchaj; Izabela Tarłowska


‘Because data privacy and data protection team is combined with the IP team, it can provide a comprehensive legal service.’

‘ Izabela Tarłowska is a person who listens and takes into account all the client’s needs.’

Key clients

BBC Studios




CPI Property Group




Work highlights

  • Acting for Facebook in cases before the Polish Data Protection Authority and administrative courts regarding data privacy, protection of user data and freedom of speech.
  • Providing ongoing support to Whirlpool with respect to the Polish law specific aspects of personal data protection and privacy.
  • Ongoing advice to Skanska on the implementation of the “Connected by Skanska” building integration system in a number of newly developed top-class office buildings in Poland.

DLA Piper

DLA Piper is noted for its expertise in complex GDPR projects, including implementation and compliance. The group has an impressive array of multinational corporate and banking clients, which it assists with issues including data breach responses, audits and data mapping, data subject rights and online tracking and consumer protection issues. The practice is led by Ewa Kurowska-Tober who has substantial experience assisting clients in regulated sectors, and is regularly instructed on global privacy compliance. Counsel Łukasz Czynienik specialises in cybersecurity, media and telecoms law, advising on cross-border data transfers and the implementation of data security policies. Senior associate Magdalena Koniarska is a specialist in data processing agreements, and data transfer.

Lubasz i Wspólnicy - Kancelaria Radców Prawnych

Lubasz i Wspólnicy - Kancelaria Radców Prawnych is a Łódź-based firm that predominantly focuses on data protection issues for IT security administrators, as well as representing clients before the Polish data protection authorities in crisis situations. The team is led by founding partner Dominik Lubasz.

Olesinski & Wspolnicy

Lawyers at Olesinski & Wspolnicy have longstanding expertise in data protection issues, with a strong track-record in GDPR implementation and compliance projects, working with in-house data protection and compliance officers for its impressive Polish client base. The overall data protection and new technologies department is led by Justyna Korycka and includes e-commerce expert Magdalena Kaleta-ManiakLudmiła Łuczak, who specialises in data protection in an HR context; and Andrzej Boboli, who is focused on new technologies.

Practice head(s):

Justyna Korycka

Other key lawyers:

Magdalena Kaleta-Maniak; Ludmiła Łuczak; Andrzej Boboli; Katarzyna Serwatka


High level of qualification and competence.’

Eager to help, they quickly find a proper and effective solution to the problem.’

They have exceptional experience and practices in this area. The firm helps us implement GDPR and successfully manage this area. I have been working with a few other law teams in the area of GDPR but I would admit that engagement and expertise from Olesinski & Wspolnicy is outstanding.

They are ready to work under big pressure and adapt to quick changes in legislation.’

Key clients

AI Busters Sp. z o.o.

Aneks Polska Sp. z o.o. sp.k.


AKS Precision Ball Polska Sp. z o.o.

ATM Grupa S.A.

Black Swan sp. z o.o. ASI SKA

bValue sp. z o.o. ASI sp. k.


Cooper Standard Polska Sp. z o.o.

CSF Poland Sp. z o.o.

Curaden Polska Sp. z o.o.

DEVnet High Performance Solutions Sp. z o.o.

DIP Draexlmaier Engineering Polska Sp. z o.o.

DSV International Shared Services sp. z o.o.

DWS Draexlmaier Wyposażenie Wnętrz Samochodowych Sp. z o.o. S.A.

Exlabesa Building Systems Sp. z o. o.

Fidiasz EVC

Gigaset Communications Polska Sp. z o.o.

GKN Driveline Polska Sp. z o.o.

GOK Regler und Armaturen Polska Sp. z o.o.


JOST Polska Sp. z o.o.

Karmar S.A.

KIK Textil Sp. z o. o.

Leoni Kabel Pol

Work highlights

  • Advised Branded Shoes & Bags on the acquisition of Rage Age brand and client portfolio, which included the acquisition of the customer database and related GDPR issues.
  • Produced a comprehensive arrangement of the personal data flow model in the international capital group Transfer Multisort Elektronik, which includes companies located in ten countries, including those outside the European Economic Area.
  • Supported AI Busters in adjusting its activities to the provisions on the protection of personal data.

Allen & Overy, A. Pedzich sp. k.

At Allen & Overy, A. Pedzich sp. k., the data protection group is well-connected to the firm's international network, advising clients across the fintech, life sciences, manufacturing and telecoms sectors, as well as advising state-owned entities on cross-jurisdictional data projects and compliance programmes. As well as GDPR implementation and compliance work, the group also advises on day-to-day privacy issues involving online marketing and advertising. Intellectual property lawyer Krystyna Szczepanowska-Kozłowska heads the team, which includes senior associate Justyna Ostrowska; an expert in the cross-border use of personal data within capital groups and data processing.

Practice head(s):

Krystyna Szczepanowska-Kozłowska

Other key lawyers:

Justyna Ostrowska

Key clients

OLX Group

Abriso NV

Work highlights

  • Advised OLX Group on the data privacy aspects of its acquisition of the majority stake in Kiwi Jobs from
  • Advised Abriso NV on the data privacy aspects of its acquisition of Jiffy Packaging, a protective packaging manufacturer.

APLaw Artur Piechocki

APLaw Artur Piechocki is an IT and TMT specialist firm with ' unique knowledge and engagement in finding the best solution' that draws on substantial expertise in GDPR audits and compliance issues as well as personal data processing for marketing purposes. The firm also offers external data protection officer services to Polish SMEs. Co-heading the team are founding partner Artur Piechocki and Ireneusz Matusiak.

Practice head(s):

Artur Piechocki; Ireneusz Matusiak


The team have unique knowledge and engagement in finding the best solution.’

Open and direct relationships with the client.’

We were impressed with the individual approach to the client, the willingness to look for a solution perfectly suited both in terms of finance and compliance with the order.’

A personal approach, always open to cooperation, helpful and competent.’

The lawyers always seek solutions from the beginning of the legal issue we have to solve, they understand that data protection is not limited to GDPR text, but requires basic understanding of data processing procedures and complicated relations between controllers, processors and electronic systems of data processing.’

Artur and his team are very responsive and always up to date.’

In my opinion, they are very efficient in working on data processing documents adjusting them to our needs and environment of data processing.’

Artur Piechocki has been working with personal data protection since the early 2000s and uses his experience in every case. Clients appreciate it and use his experience and knowledge for their benefit since it is unique in comparison with other lawyers, who just starting working with personal data protection. You cannot learn that in a few months after GDPR.

Artur Piechocki has vast and outstanding knowledge in data privacy law.

Key clients


TVN and Discovery Group


Michau Enterprises (



Hobo Systems



Work highlights

  • Advise Natexo, a French marketing and e-commerce solutions company, on personal data protection and privacy protection in terms of big data projects based particularly on internet profiling and targeting issues.
  • Advise Michau Enterprises Ltd., the owner of, on personal protection and privacy policy.
  • Advise Totalbet, a Polish sports betting and gambling group, on the complex GDPR legal services in terms of: GDPR audits, implementation of GDPR procedures, applications to the Personal Data Protection Office, GDPR trainings for board members and staff. Also serving as a Data Protection Officer.

Baker McKenzie Krzyżowski i Wspólnicy Sp.k.

Baker & McKenzie Krzyżowski i Wspólnicy Spółka Komandytowa's privacy and data protection practice group sits within the firm's intellectual property and technology department, advising international corporates on the processing of personal data across multiple jurisdictions. The department is led by Marek Rosiński.

Practice head(s):

Marek Rosiński

Other key lawyers:

Radosław Nożykowski


‘Baker – team in general has a high level of understanding and expertise.’

‘High responsiveness, deep expertise, building solid business relations, customer oriented’

‘We highly value the services that they provide us with. In particular, one of their biggest assets is the exceptional quality of advice that the firm provides. They impressed us with their pro activeness which was hugely beneficial for us.’

Key clients

RTB House SA

Oxford University Press

Work highlights

  • Advising RTB House SA and its affiliates, a global group that provides retargeting technology solutions for top brands worldwide, on data privacy and corporate matters in various jurisdictions.
  • Provided legal advice to the Oxford University Press on compliance with e-commerce laws and data protection rules in conducting a new marketing campaign on the Polish market, including on the maintenance and management of the customer database, activation of client contacts, processing of customer data (teachers) and permissibility of e-marketing activities and launch of dedicated online sites.


BARTA LITWINSKI KANCELARIA RADCÓW PRAWNYCH I ADWOKATÓR SPÓLKA PARTNERSKA is a Kraków-based data protection boutique providing consultancy and advisory services to Polish and European corporates active in the internet and new technologies sector, as well as to personal data controllers and database brokers. Paweł Litwiński jointly leads the team alongside co-founding partner Paweł Barta.

Practice head(s):

Paweł Litwiński; Paweł Barta


The team is very professional, but also kind and easy going. Working with them was a pleasure. Always on time and always there for you. There is virtually no obstacle that they cannot overcome with knowledge and flexibility.’

The law firm has a multi-person team consisting only of specialists in the field of personal data protection, which ensures the possibility of constant service (also in emergencies).’

Paweł Litwiński is an outstanding expert in the data protection field. I value him for openness, knowledge, flexibility and reliability.’

Paweł Litwiński is one of the most respected Polish lawyers of data protection area.’

Key clients

Fundacja ePaństwo

Work highlights

  • Represented Fundacja ePaństwo pro bono in precedential administrative proceeding before the Polish supervisory authority, the President of the Personal Data Protection Office, in a matter concerning the client’s GDPR obligations.
  • Performed a complete privacy audit regarding ProteGO Safe – application which supports contact tracing in the EU’s fight against Covid-19.

Domanski Zakrzewski Palinka

Domanski Zakrzewski Palinka has a well-established data protection group that has substantial experience in GDPR implementation projects and compliance matters. The team is led by Bartosz Marcinkowski, who has an academic background in data protection law and a strong client roster of Polish and international corporates. Based in Wrocław, Michał Kluska advises businesses on the design and implementation of online sales channels and represents clients in contentious data protection matters.

Kieltyka Gladkowski KG Legal

'Internationally-mindedKieltyka Gladkowski KG Legal specialises in advising its life sciences and biotechnology clients on the spectrum of their data protection requirements. In 2020, the group was particularly active in data protection issues arising from the Covid-19 pandemic. The practice is jointly led by co-founding partners in Kraków Małgorzata Kiełtyka and Jakub Gładkowski, whom one client praises as 'true professionals, exceptionally organised, constantly seeking out new learning opportunities and professional growth'.

Practice head(s):

Małgorzata Kiełtyka; Kazimierz Jakub Gładkowski


The team is very dedicated and proactive. They are always available to help with a friendly attitude.’

They are always available to help with a friendly attitude.’

They are an internationally-minded firm and very updated with innovations and new technology.’

I enjoy working with them since they work in a highly professional way and they understand how to humanise this.’

This practice is fluent in English, cost effective and perform quick turnarounds.’

Quick, efficient and of course good lawyers. It´s rare with firms so on their toes.

Jakub and Malgorzata are very good working people and they have strengths in a lot of different fields.’

Małgorzata Kiełtyka is quick and efficient and on top of that good business understanding.

Małgorzata Kiełtyka and Jakub Gładkowski are true professionals, exceptionally organised, constantly seeking out new learning opportunities and professional growth. They are very determined to fulfil any task, complete support and devotion to all our needs as a client.

Work highlights

  • Advised a client on its data mining processes and analytical processes, based on the EU and national data and database protection law.
  • Assisted an international cloud data storage provider in handling all legal aspects of cross-border data transfer, data storage in the cloud, including legal relations with the client’s subcontractors of data lakes.
  • Assisted a telemedicine platform with the risks related to the processing of data concerning health, including biometric data and the processing of data by AI mechanisms.

Konieczny, Wierzbicki Kancelaria Radców Prawnych sp.p.

Kraków-based TMT boutique Konieczny, Wierzbicki Kancelaria Radców Prawnych sp.p. has an 'inquisitive and meticulous' data protection and compliance team that takes an 'agile approach' to projects across the healthcare, IT, security, gambling and environmental sectors. The practice group is led by the 'calm, composed and professionalMichał Czuryło, who has substantial experience in data compliance audits and advising on the fallout of security incidents and data breaches. Attorney-at-law Barbara Miziołek is another name to note and has recent experience advising on issues arising from the Covid-19 pandemic.

Practice head(s):

Michał Czuryło

Other key lawyers:

Barbara Miziołek


The firm’s specialization in the practice of data protection and new technologies allows them to provide comprehensive services to entities from the high-tech sector.’

Extremely high level of professionalism and customer focus.’

They use an agile methodology, which is a very modern approach for law firms. The team can analyse complex contracts with great accuracy and speed. For me, that means they are real professionals.’

The law firm exhibited exceptional diligence in the implementation of the data protection project under Polish law, although the deadline was very tight. Their attorneys are inquisitive and meticulous in implementing new regulations in the field of personal data protection law for business operations.’

In its activities, it is guided by an agile approach, which guarantees a quick response to changing conditions. The team combines various competences: both legal and technical knowledge, which is particularly important in the IT sector. The solutions proposed by the law firm are effective and always in line with expectations.’

Michał Czuryło has extensive experience in implementing solutions in the field of personal data protection, especially in the area of new technologies. Thanks to Michał we were able to dynamically implement new data protection laws in our company. Calmness and composure, as well as professionalism, are his main strengths.’

Key clients

Ailleron S.A.

Miquido Sp. z o.o. Sp. k.

Airly Sp. z o.o.

ABB Asea Brown Boveri Ltd

Saventic Health Sp. z o.o.

AB INBEV Poland Sp. z o.o.

Novomatic Technologies Poland S.A.

Leonarto Alfa S.A.

Findair Sp. z o.o.

Hitachi ABB Power Grids Ltd.

iooo sp. z o. o.


Grape Up Sp. z o.o.

Zurich Insurance Company LTD

FarmaProm Polska Spółka z o.o. Sp.k

Work highlights

  • Analysed all data processing processes in the Hitachi Power Grids group of companies in connection with the transformations that took place in the group
  • Developed a set of data protection rules for Miquido that will allow it to conduct a marketing campaign in several European countries
  • Advised Airly on the preparation and negotiation of a cooperation agreement between the supplier (a company from Poland) and a distributor (an entity form Indonesia) in the field of equipment and software delivery, as well as specialised services related to air quality monitoring and processing of data collected that way.

PwC Legal Zelaznicki sp.k.

At PwC Legal Żelaźnicki sp.k., the team draws on experience in GDPR implementation projects for multinationals operating in Poland, to advise on data protection audits and compliance. Gerard Karp heads the department and developed the firm's IT solutions including the data protection officer tool, the legitimate interest analysis tool, and software that assesses GDPR implementation maturity. Senior associate Marian Giersz is a data protection and telecoms law expert who has experience advising on large-scale multijurisdictional GDPR projects.

Practice head(s):

Gerard Karp

Other key lawyers:

Marian Giersz; Konrad Dobrowolski

Key clients

Polski Koncern Naftowy ORLEN S.A.

The Insurance Guarantee Fund

Oknoplast sp. z o.o.

Benefit Systems

Millennium Bank

Lyreco Polska

USP Pharmacia sp. z o.o.

Adama Agricultural Solutions Ltd.

Adama sp. z o.o.



Work highlights

  • Advised Orlen Polska on a GDPR project arising from its acquisitions of petrol stations in Poland, Germany and Czechia.
  • Advised Millennium Bank on its GDPR maturity assessment project conducting analysis and providing recommendations in relation to its compliance.
  • Advised Samsung Electronics Polska on persoanl data protection and e-commerce matters on a day-to-day basis; successfully represented the client during an investigation into personal data breaches initiated by the Polish supervision authority.

SSW Pragmatic Solutions

The data privacy practice at SSW Pragmatic Solutions sits within the firm's intellectual property department. The group advises on the use of data in the HR and employment context, handles GDPR audits and acts in administrative proceedings before the Polish data protection authorities. Joanna Tomaszewska heads the group, often advising Polish and foreign corporates on issues arising from data processing. Of counsel Marek Wędrychowski is a regulatory expert with experience in data privacy and digital transformation projects, and privacy matters relating to the financial services sector.

Practice head(s):

Joanna Tomaszewska

Other key lawyers:

Jakub Jędrzejewski; Marek Wędrychowski; Aleksandra Cisoń-Kurdziel; Paweł Wyrębek


‘The knowledge of the content and quality of the services provided remains at a good level.’

Wardynski & Partners

Wardynski & Partners' team of 'high-class pros'  is composed of experts in employment and regulatory law and new technologies, with a focus on the application of data protection law in a human resources context; a capability boosted by the arrival of Karolina Romanowska, who joined from Deloitte Legal, Ostrowski, Gizicki i Wspólnicy sp.k. in January 2020. The group handles data subject requests, new marketing activities and internal data protection policies. It also has experience in relation to data processing incidents, including representing clients before the data protection supervisory authority. Co-leading the team are Krzysztof Wojdyło and Katarzyna Żukowska, both of whom often participate in corporate due diligence projects.

Practice head(s):

Krzysztof Wojdyło; Katarzyna Żukowska

Other key lawyers:

Karolina Romanowska; Rafał Kuchta


They offer a one-stop-shop of services related to matters combining data privacy and employment which is very helpful.

Lawyers at Wardynski & Partners are high-class pros: in the sense of communication, confidentiality, representing the client’s interest.’

Business oriented team. helping us to find solutions for data protection issues which are normally quite rigid and hard to implement in practice.’

The team is highly responsive and client-oriented, with in-depth knowledge of the data protection practice on the market, which guarantees an excellent service level. Team members are trustworthy and professional, but also friendly. They communicate legal matters in a manner that they become clear for non-legal persons. We have always gotten outstanding assistance in every project we have done together.’

Billing is a well organised and transparent process.’

Katarzyna Żukowska is very responsive and delivers tailor-made advice on any data privacy and data protection law issues we need help with. She combines expert knowledge from both – data privacy and employment field.’

Key clients

adidas Poland sp. z o. o.

Allfunds Bank, S.A.U.

Brown Brothers Harriman & Co.

KK Wind Solutions Polska sp. z o.o.

Orsted Polska Sp. z o.o.

Work highlights

  • Advised Sailing Group on the data protection aspects of its acquisition of Tesco Group’s business in Poland.

WKB Wiercinski, Kwiecinski, Baehr

WKB Wiercinski, Kwiecinski, Baehr's data protection team is embedded in the firm's intellectual property and TMT department, allowing it to provide a full service to the firm's clients in relation to data protection issues. The group is coordinated by Agnieszka Wiercińska-Krużewska, who has experience in data protection-related litigation and in GDPR implementation and compliance projects; she is also an expert in cybersecurity. Senior associate Karolina Miksa is another lawyer with GDPR implementation experience.

Practice head(s):

Agnieszka Wiercińska-Krużewska

Other key lawyers:

Karolina Miksa


‘Considering the number of experts on many different law areas I can trust that every piece of advice provided by WKB includes the specifics of insurance and healthcare providers regulations.’

‘Outstanding legal advice – business focused, creative, agile and to the point.’

‘Agnieszka Wiercińska-Krużewska has a business friendly approach and astonishing knowledge of the media industry and market combined with an open and dynamic attitude making her a go-to partner for any fast-paced industry.’

‘Karolina Miksa is a trustworthy and thorough counsel providing mindful and extremely practical advice.’

Key clients

Polski Bank Komórek Macierzystych S.A. (Polish Stem Cell Bank)

Chubb European Group Limited

MyBenefit sp. z o.o.

Samsung Electronics Poland Manufacturing

FremantleMedia Polska

Lidl Polska


SuperDrob Group

PremiumRosa (Kofola Group)

Accolade Group

Work highlights

  • Advised on many issues of Chubb European Group’s business – recently on a cyber-threat policy and introduction of travel insurance website in Poland.
  • Conducted a comprehensive audit of Premium Rosa’s operations and prepared GDPR-compliant policies.
  • Providing comprehensive legal support to Polski Bank Komórek Macierzystych for processing of various sensitive data, among others recently advising on documentation in relation to a new service for Covid-19 testing.