The Polish Data Protection Authority (UODO) has issued observations on a draft amendment to the Education Act, considering the proposal regarding digital school registers to be imprecise and incomplete.

The president of the UODO sent his remarks to the Chancellery of the Polish Parliament concerning a bill mainly aimed at guaranteeing the free provision of digital school registers for students and their parents. The authority considers the draft to be partial, particularly in terms of data protection, and that it perpetuates the current model where commercial entities provide these systems. According to the UODO, the introduction of such solutions should have been preceded by a regulatory impact analysis and a privacy impact assessment to ensure compliance with data processing principles. The authority recalls that education laws must base processing on the dual grounds of legal obligation and the performance of a task carried out in the public interest.

The UODO also emphasizes that cybersecurity issues related to the nationwide processing of data contained in these registers are not sufficiently taken into account. To ensure adequate security against cyber threats, the authority recommends adopting specific IT security standards for the systems and establishing a certification system for platforms, guaranteed by public entities. It is also suggested to impose on processors an obligation to obtain this certification and to entrust the competent minister with managing a public database of certified entities (ref. DPNT.401.429.2026).