Data privacy and data protection in Poland

Bird & Bird Szepietowski i wspólnicy sp. k.

Clients 'can always rely' on Bird & Bird Szepietowski i wspólnicy sp. k.'s team, which works closely with the firm's offices in London and Dusseldorf on pan-European GDPR issues, also serves as data protection officer and provides representative services. Promoted to partner in 2019, Izabela Kowalczuk-Pakuła leads the team, and is a privacy specialist, with additional expertise in adtech services, cloud computing, AI, insurance and fintech products, as well as designing data protection-compliant recruitment systems.

Practice head(s):

Izabela Kowalczuk-Pakuła


The team has a great knowledge of the data privacy and protection area. They also have good understanding of business which makes them capable of offering a business oriented solutions.

Izabela Kowalczuk-Pakuła is a great open-minded professional.

Fantastic expertise in data protection coupled with a practical approach means their advice is always readily digestible and of excellent quality.

Key clients

BBDO Warszawa / PHD Media Direction

Michael Page International (Poland)

Grupa Pracuj

Recruitment Solutions

IKEA Retail

Edipresse Polska

Stock Polska

Skanska Group

Związek Harcerstwa Polskiego

Associated British Foods plc

FS File Solutions / Kelo Corporation


Work highlights

  • Advising BBDO Warszawa and its Polish branches on data protection issues, particularly relating to digital marketing activities.
  • Advised Ikea Retail on issues relating to the launch of new digital advertisement models tailored to its customers.
  • Providing data protection officer services to Edipresse Polska.

CMS Cameron McKenna Nabarro Olswang Pośniak i Bejm sp.k.

CMS is able to assist clients with the spectrum of data protection and GDPR advisory services, as well as representation before the Data Protection Authority and the courts. The group is led by Tomasz Koryzma, who is an established technology lawyer, who focuses on data privacy issues relating to internet and e-commerce businesses, and has substantial experience in cross-border data-protection projects.

Practice head(s):

Tomasz Koryzma

Key clients

Cooper Standard

ING Aleo



B2 Holding



International Paper



Work highlights

  • Advises ING Alea on the implementation of GDPR, as well as handling day-to-day issues such as data subject requests and proceedings initiated by the Polish Data Protection Authority in relation to processing personal data,
  • Assisting Cooper Standard with a GDPR implementation project.
  • Assisting BMW’s local data protection officer with various projects, including advising on the company’s marketing campaigns, preparing privacy impact assessment documents for data processing, and advising on data breach incidents.

Kobylańska Lewoszewski Mednis

Kobylańska Lewoszewski Mednis is a privacy and data protection boutique with expertise in sectors including e-commerce, media, technology and finance. In addition to GDPR implementation, the group also has experience in GDPR litigation before the Polish Data Protection Authority. Co-founding partner Anna Kobylańska is a specialist in personal data protection, and has experience of advising on the use of new technologies to collect and process data. Fellow co-founder Marcin Lewoszewski is an expert in the provision of electronic services, database protection, gambling law, IT systems implementation and telecoms law. In August 2019, the firm benefited from the arrival of Arwid Mednis, who co-led the TMT team at PwC Legal Pawlowski Zelaznicki Sp. K and has considerable experience advising on Polish data protection legislation.

Practice head(s):

Marcin Lewoszewski; Anna Kobylańska; Arwid Mednis


For many years, Anna Kobylańska and her team have been praised on the market (in Poland and abroad) as being experts in the fields of data protection and privacy.

The highest quality of service in every respect. Excellent contact with the client, availability and readiness to work under enormous time pressure.

It provides tailor-made legal solutions that include conclusions from recent case-law. It provides a high standard legal advice adjusted to the business of the client.

Key clients

Viacom International Media Networks Europe

Maruta Wachta sp. j.

Maruta Wachta sp. j.'s data protection and GDPR practice assists an impressive list of clients, which includes multinationals in the insurance, technology, fast-moving consumer goods and media sectors. Having taken on of counsel Maciej Kawecki from the Ministry of Digitalisation, where he was director of data protection, in August 2019, the group is well placed to communicate with government and regulatory agencies. The group is particularly recommended for projects requiring a combination of GDPR, IT and e-commerce expertise, including issues related to profiling, cookies, advertising and real-time bidding. Marcin Serafin has exceptional experience coordinating GDPR implementation projects and jointly leads the department alongside Sławomir Kowalski, who was promoted to partner in January 2019, and is making a name for himself in handling privacy issues concerning the financial industry.

Practice head(s):

Marcin Serafin; Sławomir Kowalski


Sławomir Kowalski proved to be a very diligent and yet at the same time customer oriented partner.

They are not afraid to sometimes present and defend pioneering solutions. The flow of knowledge as part of daily cooperation and the availability of partners and associates is also very good.

Key clients



AmRest Group

Bank Millennium

Vienna Insurance Group


Euler Hermes




Lidl Polska

Totalizator Sportowy



WARTA (member of Talanx Group)

Żabka Polska


Osborne Clarke


Dimension Data

ABC Medica

Work highlights

  • Advising Agora Group on one of the largest GDPR outsourcing and implementation projects in the country.
  • Advised Inter Cars on the implementation of GDPR in 13 countries and in more than 40 subsidiaries.
  • Acted for Vindicat in the first-ever private sector data protection audit by the President of the Personal Data Protection Office.

Traple Konarski Podrecki & Partners

Traple Konarski Podrecki & Partners' team is dedicated to the protection of information. The group has experience in proceedings before the Polish regulatory authorities and administrative courts, as well as advising public authorities on new data protection regulations. The mainstays of the practice include compliance audits, consulting on new technology projects involving cloud computing or the use of biometric data, draft agreements for the protection of personal data and databases and strategies for the cross-border transfer of data. It is also instructed on issues including the right to be forgotten. Co-founding partner Xawery Konarski leads the team, which includes Jan Byrski, who has a variety of contentious experience, and Grzegorz Sibiga, whose expertise includes the right to access public information and the protection of personal data.

Practice head(s):

Xawery Konarski


The Polish data protection team stands out with skilful, hard-working and knowledgeable lawyers.

Xawery Konarski is a distinguished IT and data privacy expert who is praised for his business acumen, as well as visionary role and academic achievements in the field of new technologies law.

The firm’s data privacy team has assisted us in several projects, demonstrating an in-depth knowledge of the subject matter combined with practical approach.

Key clients

Polski Standard Płatności

AV System Sławomir Wolf

PKO BP Finat


The team at Dentons is noted for advising major international internet-based companies on a variety of data protection and privacy regulatory issues, often working in conjunction with the firm's other departments, including employment, competition, life sciences and M&A. The team is coordinated by managing counsel Karol Laskowski, who leads the firm's intellectual property, technology and communications department. The group also includes counsel Magdalena Bartosik, who has substantial experience leading on local and cross-border GDPR and data management compliance matters, large-scale data sharing schemes and issues related to data processing contracts.

Practice head(s):

Karol Laskowski


Very helpful team, ready to assist anytime and in any project.

Professional team with wide knowledge within its practice and other related practices. Strong business attitude.

Innovative point of view on many topics and issues. Great experience and knowledge about trends in the sector.

Key clients


ITI Neovision






BNP Paribas Bank



Work highlights

  • Advising on a global provider of payment solutions with a presence in 150+ countries on various data privacy and personal data protection matters under the GDPR, reporting directly to the global data protection officer located in the US.
  • Acted for ITI Neovision on a complex GDPR-readiness project including on the most critical privacy issues.
  • Assisting mBank with the data privacy issues regarding the agreement for implementation of the employee capital plans.

Lubasz i Wspólnicy - Kancelaria Radców Prawnych

Based in  Łódź, Lubasz i Wspólnicy - Kancelaria Radców Prawnych is focused primarily on data protection, drawing on the significant experience within the team, which includes expertise in information security, IT and new technologies. The group advises IT security administrators, represents clients before the Polish data protection authorities and in administrative court proceedings. It also handles a range of major implementation projects related to data processing and GDPR. Name partner Dominik Lubasz is a thought leader in the industry, and jointly leads the department with personal data expert Witold Chomiczewski and advertising law specialist Monika Namysłowska.

Practice head(s):

Dominik Lubasz; Witold Chomiczewski; Monika Namysłowska


The team covers the whole spectrum of legal advice required by our company. It is dynamic, speaks good English, presents good consulting skills.

Our dedicated advisor presents good knowledge and an understanding of local regulations. His availability, quality of service and understanding of the international corporate environment is different from other law consultancies I have experienced.

Dominik Lubasz is an absolute expert and authority in the field of personal data protection. Professional, open, flexible in approach to the client and to business.

Olesinski & Wspolnicy

Olesinski & Wspolnicy's data protection team is based across offices in Warsaw, Wrocław and Gliwice. In addition to assisting clients with GDPR implementation, the group advises on day-to-day data protection issues, as well as data protection audits. Jointly heading the team are Warsaw-based Justyna Korycka and Ludmiła Łuczak in Wrocław.

Practice head(s):

Justyna Korycka; Ludmiła Łuczak


They have huge knowledge and experience about law regulating business processes and conducting the implementation of new regulation within companies and capital groups.

Cooperation focused group with vast professional legal knowledge. Fit to face every challenge.

Eager to assist even in the smallest task that involves legal problems. Highly professional.

Key clients

Whirlpool Company Polska

Toys „R” Us Sklep Internetowy

ATM Grupa


Aneks Polska

Fat Lion Games

Gigaset Communications Polska

GKN Driveline Polska

JOST Polska

Nutricia Polska

Work highlights

  • Advised Rodomanager on the creation of a tool for managing processes connected to personal data protection.
  • Advised Sika Automotive Złotoryja on GDPR implementation.

WKB Wiercinski, Kwiecinski, Baehr

WKB Wiercinski, Kwiecinski, Baehr's data protection team sits within the firm's intellectual property and TMT department, and handles a variety of data protection issues for clients in the regulated industries. The group, which has a notable practice in GDPR implementation and compliance, is led by Agnieszka Wiercińska-Krużewska, who is not only an expert in data protection and data privacy, but also cybersecurity.

Practice head(s):

Agnieszka Wiercińska-Krużewska

Key clients

FremantleMedia Polska

Samsung Electronics Poland Manufacturing

Polski Bank Komórek Macierzystych

Enea Operator

Bank Gospodarstwa Krajowego

Chubb European Group

Lidl Polska


Work highlights

  • Advised FremantleMedia Polska on various data protection issues, including in relation to the production of TV programmes.
  • Advised MyBenefit (one of the largest employment benefits platforms) on matters related to the setting up an employment benefit platform.
  • Assisted Angloville with issues relating to the flow of its business client’s employees’ personal data.

DLA Piper

Led by Ewa Kurowska-Tober, the group at DLA Piper has developed a significant practice advising on GDPR implementation projects for an international client base in Poland and in relation to their operations across Europe. Other areas of expertise include data breach issues, audits and data mapping and compliance programmes and policies. The group also has experience in data security matters and often represents clients before the data protection authorities in Poland. Counsel Łukasz Czynienik is also recommended for his data protection expertise, which includes cross-border data transfers, data security policies and data processing.

Practice head(s):

Ewa Kurowska-Tober

Key clients

Levi Strauss & Co Europe

Reckitt Benckiser

Work highlights

  • Advising Levi Strauss & Co Europe on a comprehensive GDPR compliance project.
  • Acting for Reckitt Benckiser on global GDPR implementation in their group companies across EU.
  • Representing a leading global media company in a GDPR compliance project and other privacy related matters.

APLaw Artur Piechocki

APLaw Artur Piechocki specialises in providing a full service to clients in relation to data protection, including assisting with audits, the preparation of documents and data subject requests. The group has significant experience in GDPR projects involving implementation and compliance. Founding and managing partner Artur Piechocki leads the team and draws on expertise in new technologies and cybersecurity.

Practice head(s):

Artur Piechocki


The members of the team display uncompromising commitment and creativity. They have perfect understanding of business needs and they know the specifics of the industry and the market in which their company functions.

Managing partner Artur Piechocki always pays highest attention to clients’ business interests in each case and recommends solutions reaching beyond pure legal support.

It responds to the needs of the client and flexibly adapts to changes during the realization of the project. The team, efficiently and with high quality, prepares documentation and informs the client about the effects of changes. Contact is very good, lawyers answer all your questions in detail.

Key clients


Add Informatica


Ministry of Finance




Farm 51


Grupa Energia



United Internet


Work highlights

  • Advised Comcert on privacy and data protection issues.
  • Acting for Europharma on GDPR implementation and compliance.

Baker & McKenzie Krzyżowski i Wspólnicy Spółka Komandytowa

Baker & McKenzie Krzyżowski i Wspólnicy Spółka Komandytowa advises clients on GDPR regulation and local privacy laws. In particular, it has developed a niche in the intersection between GDPR and data monetisation. The group is also called upon to assist clients with day-to-day privacy matters, as well as projects involving big data. The department's client list includes major multinational data-driven companies, fintech businesses and other technology-rich enterprises. TMT expert Marek Rosinski jointly takes the lead, alongside counsel Magdalena Kogut-Czarkowska, who is a specialist in privacy and GDPR.

Practice head(s):

Marek Rosiński; Magdalena Kogut-Czarkowska


The firm has a team of specialists that combines knowledge of the specifics of the regulated market with the requirements of the new European data protection law.

They seem to have a very good understanding of the European regulation as well as the local practice in Poland and they were always in a position to understand our needs as an international group.

Very good team to assist with any data protection issues. They are client-minded, dedicated and combine legal expertise with understanding of business needs and specifics of a given sector.

Key clients

Novo Nordisk



BZK Group

MasterCard Europe

Visa Europe

Berlin Chemie

ABC Data



Chipita Poland

Work highlights

  • Advising Novo Nordisk on GDPR compliance and providing privacy support on Novo Nordisk’s daily operations in Poland and Eastern Europe. Negotiating an outsourcing agreement for certain key aspects of back-office activities.
  • Acting for Lingaro on various aspects of GDPR and e-privacy compliance.
  • Advised Wonga, a leading lending platform in the CEE region, on GDPR implementation and optimising the use of data sets, with a particular focus on data monetisation.

Kieltyka Gladkowski KG Legal

The Kraków-based team at KG Legal Kieltyka Gladkowski is praised by clients for being 'much more flexible than large firms' in relation to its main focus, which is advising on data protection and privacy issues arising from bio-IT projects. The team, jointly headed by Jakub Gładkowski and Małgorzata Kiełtyka, handles a variety of work, including GDPR implementation; data processing agreements; audits in relation to data protection officers; and assistance with data retention and destruction. The group also handles complaints made to the Data Protection Authority, data breach issues and reporting, as well as transactions involving databases.

Practice head(s):

Jakub Gładkowski; Małgorzata Kiełtyka


Very skilled and proactive team.

Małgorzata Kiełtyka and Jakub Gładkowsk are very talented in data protection in Poland. It is very reassuring to have their contact.

Strong local expertise, well-versed in international norms, strong communication, diligent in execution, good big picture and detail.

PwC Legal Żelaźnicki sp.k.

PwC Legal Żelaźnicki sp.k.'s department is led by Gerard Karp (who acts as the firm's CEE privacy leader), and advises a variety of Polish industry associations, including the Polish Banking Association, and major companies on GDPR implementation and post-implementation projects. It also provides clients with ancillary services, such as an IT tool that supports daily compliance duties, data protection risk analysis and compliance monitoring.

Practice head(s):

Gerard Karp


A specialist team with a deep understanding of the law.

Dagmara Jaskulak is very strong on the law and provides pragmatic and commercial advice.

Key clients

The Insurance Guarantee Fund

USP Pharmacia

Atrium Real Estate Management

Association of Polish Banks

Mayor of Warsaw

Lyreco Polska

DB Cargo Polska

Adama Polska



Gulermak Agir Sanayi Insaat Ve Taahhut Anonim Sirketi


Grupa OLX

Work highlights

  • Advised The Insurance Guarantee Fund on a GDPR implementation project relating to an information hub for the insurance sector in Poland.
  • Acted for the Office of Statistics on various data protection maters including GDPR implementation and local amendments to data protection law.
  • Advised the Association of Polish Banks on the preparation of a code of conduct approved by the Polish Data Protection Authority.

SSW Pragmatic Solutions

SSW Pragmatic Solutions assists clients with data protection and data processing across a range of issues, including the use of monitoring in the workplace, whistleblower hotline schemes, anti-corruption policies and outsourcing. The team also draws on the firm's strong IT focus to advise on the privacy and data protection aspects of contract models with IT vendors and suppliers and contracts. GDPR implementation is another area of expertise. The group is led by Joanna Tomaszewska, whose expertise in data processing and protection is augmented by knowledge in new technologies and electronic communication.

Practice head(s):

Joanna Tomaszewska


They are very determined to identify all options and provide the recommendation for everyone of them. In addition the recommendations are complex and do not allow for ambiguous interpretation.

The spirit of the company derives from the spirit of their members. This means that every member of the team with whom I cooperated never left any case open and worked on them till received final conclusion and unequivocal recommendation.

Joanna Tomaszewska who leads majority of our cases and always delivers top quality solution for my company.

Key clients

Servier Polska

The British School

Polski Standard Płatności

Trakcja PRKiI

Pracodawcy RP

Work highlights

  • Assisted Servier Polska with with matters pertaining to data processing within the capital group and data flows between the company and its headquarters, taking into account pharmaceutical and privacy law.
  • Advised Trakcja Prkil on GDPR implementation.
  • Advised Pracodawcy RP on GDPR implementation.