Third-party data breach in Poland – what should your company do under GDPR?

A third-party data breach in Poland requires a company to determine what information was exposed, secure access and assess the risk of financial fraud. If personal data under the company’s control is affected, it must also assess its own GDPR obligations. A provider’s notification does not automatically replace the customer’s responsibilities as data controller.

Does every corporate data leak trigger GDPR obligations?

No. Article 4(12) of the General Data Protection Regulation (GDPR) concerns unauthorised disclosure, access, loss or alteration of personal data.

Commercial information such as prices or contractual terms may still require protection even if it does not qualify as personal data.

Compromised accounting, invoicing or payroll systems may contain:

• login credentials and user permissions,
• invoices and transaction amounts,
• bank account numbers,
• customer and supplier information,
• employee and business contact details.

For companies conducting business in Poland, it is therefore important to distinguish commercial risks from legal obligations relating to personal data.

What should a company do after a third-party data breach?

The first step is to establish whether the breach affected the company’s account and what information may have been accessed or copied.

Businesses should retain the provider’s notification, record when it was received and, where necessary:

• change passwords and review access rights,
• terminate unfamiliar sessions,
• revoke potentially compromised integration keys,
• check whether the same credentials were reused elsewhere,
• monitor fraudulent invoices and unusual payment requests.

Requests to change bank account details should be independently verified using previously confirmed contact information.

When must a breach be reported to UODO?

Under Article 33(1) GDPR, a controller must notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach, unless a risk to individuals’ rights and freedoms is unlikely.

Where a high risk exists, affected individuals must generally also be informed without undue delay.

Even where notification is unnecessary, Article 33(5) GDPR requires the controller to document the breach, its consequences and remedial measures.

A notification submitted by the provider in its own name does not automatically fulfil the obligations of a company acting as controller.

What happened in the Fakturownia breach in 2026?

On 28 September 2026, Polish invoicing platform Fakturownia identified unauthorised access to its systems and the copying of a substantial part of its database.

All accounts were affected to different degrees. According to the company, approximately 2,250 accounts had all available data from 2022–2026 copied up to the relevant cut-off date.

Fakturownia notified the Polish Personal Data Protection Office (UODO) on 29 September 2026 and began sending individual notifications on 1 October.

Affected businesses still had to assess the information exposed through their own accounts and determine whether their own GDPR duties applied.

How can companies reduce third-party data risks?

Article 28 GDPR requires controllers to use processors providing sufficient guarantees of appropriate security.

Companies operating in Poland should therefore focus on:

• vendor security reviews,
• data processing agreements,
• effective access management,
• incident response procedures,
• business continuity planning.

Failure to comply with obligations under Articles 33 and 34 GDPR may result in fines of up to EUR 10 million or 2% of total worldwide annual turnover in the preceding financial year, whichever is higher.

Read the full article here: Third-party data breach in Poland – what should your company do under GDPR?