The Polish Data Protection Authority (UODO) has reminded the criteria determining the obligation for a controller to notify a personal data breach.

Following recent incidents of unauthorized access to subcontractors' databases and billing systems, the authority specifies that the obligation to notify a breach, pursuant to Article 33, paragraph 1 of the GDPR, depends on a case-by-case risk assessment. Notification is generally not required if the breach concerns only data of individual entrepreneurs already publicly accessible in official registers, such as the Central Register of Economic Activities (CEIDG). However, it becomes mandatory if the breach may pose a risk to rights and freedoms, notably through the disclosure of sensitive information such as the national identification number (PESEL), details about purchases revealing health data, or financial information, which could lead to fraud or identity theft. If the risk is high, communication to the data subjects is also required under Article 34 of the GDPR. The authority emphasizes that even in the absence of notification, the controller must document the incident and its decision in its internal breach register.