Data Processing Agreement in Poland: Template, Key Clauses and Local Law (2026)

A data processing agreement (DPA) is the contract a controller must put in place with any processor that handles personal data on its behalf. In Poland the content is set mainly by the GDPR, with the Polish Act of 10 May 2018 on Personal Data Protection and the President of the Personal Data Protection Office (UODO) adding the local layer. This guide covers the law, the mandatory clauses and a working skeleton. It is general information, not legal advice; confirm a live deal with a Polish lawyer. ## What law governs a DPA in Poland? The core requirement comes straight from Article 28 of the GDPR, which applies directly in Poland. Article 28(3) lists the terms a controller-to-processor contract must contain, and Article 28(9) requires it to be in writing, including electronic form. On top of the GDPR: - The Polish Act of 10 May 2018 on the Protection of Personal Data (Ustawa o ochronie danych osobowych) implements and supplements the GDPR in Poland, including the structure of the supervisory authority and some national procedures.

• The President of the Personal Data Protection Office (Prezes Urzedu Ochrony Danych Osobowych, the UODO) is the supervisory authority that enforces the rules and can impose corrective measures and fines. The DPA does not replace the controller's own duties; it binds the processor to act only on the controller's documented instructions. ## The mandatory Article 28(3) clauses A compliant DPA must set out, at least: - Subject matter and duration of the processing.
• Nature and purpose of the processing.
• Type of personal data and categories of data subjects.
• Obligations and rights of the controller.
• Processing only on documented instructions, including for international transfers.
• Confidentiality of persons authorised to process the data.
• Security measures under Article 32 GDPR.
• Sub-processors: only with authorisation, flowing down the same duties.
• Assistance to the controller with data subject rights and with Articles 32 to 36.
• Deletion or return of the data at the end of the services.
• Audits and inspections: making available the information needed to show compliance. ## Key clauses beyond the minimum - International transfers: identify any transfer outside the EEA and the safeguard used, usually the European Commission standard contractual clauses plus a transfer impact assessment.
• Breach notification timing: a concrete deadline for the processor to tell the controller, tighter than the controller's own 72-hour duty to the UODO.
• Sub-processor list and change notice: a current list and a notice-and-object mechanism.
• Liability and indemnity: how losses and administrative fines are shared, read with the main contract; remember liability for intentional harm cannot be excluded in advance under Article 473 of the Civil Code.
• Cooperation with the UODO: supporting the controller in any dealings with the Polish authority. ## A simple drafting skeleton 1. Parties, and their roles as controller and processor

2. Definitions aligned to the GDPR
3. Scope: subject matter, duration, nature, purpose, data types, data subjects
4. Processing only on documented instructions
5. Confidentiality of personnel
6. Security measures (Article 32)
7. Sub-processing and flow-down
8. International transfers and safeguards
9. Assistance with data subject rights and Articles 32 to 36
10. Personal data breach notification
11. Deletion or return on termination
12. Audits and information rights
13. Liability allocation
14. Governing law (Polish) and forum
15. Annexes: processing details, security measures, sub-processors ## Common mistakes - Treating the DPA as boilerplate and leaving the processing-scope annex blank.

• Allowing sub-processors without a flow-down of the same obligations.
• Ignoring international transfers or relying on an outdated safeguard instead of the current standard contractual clauses.
• Omitting a concrete breach notification deadline for the processor.
• Confusing the controller and processor roles, or mislabelling a joint-controller relationship. ## Keeping data processing agreements under control If you sign DPAs with many vendors, the hard part is tracking which sub-processors each one allows, which transfer safeguard it relies on, and when each must be refreshed. That work (drafting from a tuned template, flagging missing Article 28 terms, tracking sub-processor changes and keeping versions straight) is what an AI contract workspace can hold in one place. Adira is built for this, with per-clause risk review and plain-English clause editing; it is India-first today with other jurisdictions on its roadmap, so verify local depth before relying on it for Polish law. More at Adira. The law above stands on its own. ## Bottom line A Polish DPA is driven by Article 28 of the GDPR, supplemented by the Act of 10 May 2018 and enforced by the President of the UODO. Include every Article 28(3) term, put the contract in writing, handle international transfers with the current standard contractual clauses, annex the processing detail, and get Polish advice before signing a real deal.