The Polish data protection authority (UODO), in collaboration with the Supreme Chamber of Physicians, organized training for medical facility directors on the practical issues of data protection, in a context of increasing cyberattacks targeting the health sector.

This initiative takes place in a context where the Cybersecurity Incident Response Team of the Ministry of Health (CSIRT CeZ) detected 1,379 incidents in the health sector before the end of September 2026. Following significant data breaches, notably at MyDr and Medyc, the president of the UODO initiated inspections within the responsible companies and announced additional audits in the sector until the end of 2026. He emphasized that "the honeymoon with the GDPR is over," stressing the need to take data protection seriously to maintain patient trust.

During the training, UODO experts addressed the importance of risk analysis and the role of data protection officers. Frequently reported types of violations, such as unauthorized disclosure, phishing or ransomware attacks, and risks related to the use of unsupported software, were examined. An analysis of complaints received, from both patients and employees and concerning violations of the principles of Chapter II of the GDPR or the rights of data subjects under Chapter III, was also presented.