Complain to UODO in Poland: GDPR rights, how to file, what to expect
Short answer: Ask the data controller first; it must reply within a month. Then file a signed complaint with UODO on paper or electronically. Plain email is not accepted, and fines or damages cannot be requested.
If you think a company, landlord, employer or office in Poland is mishandling your personal data, the data protection authority is the Urząd Ochrony Danych Osobowych (UODO), headed by the President of UODO. This guide sets out what the official UODO pages say about when to complain, who can complain, how to file and what a complaint can and cannot achieve. The pages carry update dates from 2018 to April 2026, so details are given as of 17 October 2026. Check the UODO site before you file.
Ask the data controller first
UODO says it is important that you first ask the data controller, the organisation that holds your data, to put right the breach. The authority explains why: its power to order a controller to meet your request depends on you having made that request to the controller first.
The controller has to answer as soon as possible, and at most within one month. If that is not possible, it must tell you why it is extending the time, and the extension cannot be more than a further two months. Within the month the controller should also tell you if it will not meet your request, and why. If the controller ignores you, or the answer does not satisfy you, you can complain to UODO.
Your rights under the GDPR
UODO lists these rights, which are the starting point for a request to a controller:
* access to your data * correction of your data * deletion of your data * restriction of processing * data portability * objection * not being subject to a decision based only on automated processing
UODO notes that these rights do not apply in every situation and can be limited by Polish law. It gives an example: for marketing, it is better to send the controller an objection than to complain to UODO, because if the controller does not know you object, the President of UODO may be unable to meet the request. The controller can also settle the matter faster than an administrative procedure.
Who can file a complaint
A private person can complain when the processing concerns their own data. A complaint about someone else's data needs a power of attorney from that person. The agent can be a private person, or a non-profit organisation or association with public-interest aims in the field of protecting the rights and freedoms of data subjects. The power of attorney must meet the requirements of articles 32 to 34 of the Code of Administrative Procedure.
The pages do not set any nationality or residence condition. They speak of a person whose data are processed. They do not say whether complaints can be filed in English, so assume Polish and ask the UODO helpline if you need help.
How to file
There are two ways, according to UODO:
* On paper, delivered to the UODO office or posted to its address: ul. Stanisława Moniuszki 1A, 00-014 Warszawa. * Electronically, to the UODO e-delivery address AE:PL-67085-31860-RWFHC-35.
An electronic complaint must carry a qualified electronic signature, a trusted signature (podpis zaufany) or a personal signature (from the e-ID card), or otherwise be authenticated so that its origin and integrity can be confirmed. It must also contain your electronic address. UODO encourages use of its dedicated complaint form.
Ordinary email is not a valid route. UODO says that under the rules, an email address is not for filing complaints to the President, and a complaint sent this way is left unexamined. A complaint without your name and address is also left unexamined, because the office cannot contact you.
Attach evidence, such as your correspondence with the controller, contracts or certificates. UODO says this helps its staff assess the case.
What a complaint can achieve
After the proceedings, if there was a breach, the President of UODO can order the situation to be brought back in line with the law, by an administrative decision. You cannot ask for an administrative fine to be imposed on the controller. That decision belongs only to the President and is not made on request.
You also cannot claim damages in the UODO proceedings. UODO states that this can be decided only by a general civil court. Whatever you do with UODO, you keep the right to go to a civil court and claim compensation for financial or non-financial harm caused by a breach of data protection rules.
Contact
The UODO helpline is 606 950 000, open on working days from 10:00 to 14:00. Office hours are 8:00 to 16:00.
A short checklist
* Write to the controller using one of the GDPR rights, and keep proof of the date. * Wait for the answer, up to one month, or three months if the controller explains an extension. * Gather the evidence. * File on paper, or electronically with a valid signature. Do not use plain email. * Include your name, address and, for an electronic complaint, an electronic address.
* Photos: cover, padlock in Oulu (CC0, Wikimedia Commons); body, mailing letters (public domain, Wikimedia Commons). Illustrative.
Frequently asked questions
Can I complain to UODO by email?
No. UODO says an email address is not for filing complaints, and a complaint sent by email is left unexamined.
Must I contact the company first?
UODO says to ask the controller first, because its power to order the controller to comply depends on that request.
Can UODO fine the company because I complained?
You cannot request a fine. UODO says that decision belongs only to its President.
Can I get compensation through UODO?
No. UODO says damages can only be decided by a general civil court.
