The president of the Polish data protection authority (UODO) emphasized during the Cyber24 conference the need to establish certification for processors handling sensitive data, in response to recent massive cyberattacks in the medical sector.

During an informal discussion with the European Data Protection Supervisor (EDPS), the UODO president explained that the high concentration of medical data with large processors creates a major vulnerability. He proposed imposing higher protection standards on these entities, notably through mandatory certification under the national cybersecurity certification system law. He also suggested that the threshold of 100,000 records, proposed by the digital minister for applying stricter restrictions, could be lowered for health data. A legal paradox was highlighted where doctors are bound by medical confidentiality, while the patient rights law allows processing to be entrusted to processors with lesser confidentiality obligations, constituting a weak link. The EDPS added that professional orders should establish sectoral standards and that the lack of regulation on collective actions for redress hinders violation prevention.

Participating in another roundtable, the UODO president noted the increase in cybersecurity incidents, with 207,000 cases recorded by national Computer Security Incident Response Teams (CSIRT) up to September 2026. Citing a study by the European Union Agency for Cybersecurity (ENISA), he indicated that incidents in 2024 caused 500 million hours of system unavailability in the EU, emphasizing that cybersecurity is a matter of national stability. He criticized the imprecise communication by some data controllers after a data breach, which generated confusion. Finally, he reiterated the need for a certification system for processors, mentioning an opportunity within a future legislative package. Other UODO experts also participated in debates on data breaches and the relationship between innovation and regulation.