The Supreme Administrative Court of Poland confirmed the position of the data protection authority (UODO) that the safeguards provided by Polish banking law regarding data processing after the extinction of a financial obligation apply not only to consumers but also to natural persons engaged in professional activity.

Facts and context

The Polish data protection authority (UODO) published a communication regarding a ruling of the Supreme Administrative Court dated 2 September 2026 (ref. III OSK 252/24) confirming its position against the bank PKO BP S.A. and the Credit Information Bureau (BIK).

The case originated from appeals filed by the two entities against a decision of the UODO concerning the interpretation of the term "natural person" in Polish banking law, which conditions the processing of client data after the end of their contractual relationship.

Reasons for the decision

The Court's reasoning, which validates that of the UODO, is based on the interpretation of the scope of application of national provisions specific to the banking sector.

• Interpretation of the scope of banking law: The Court upheld the UODO's reasoning that the provisions of articles 105a, paragraphs 2 and 3, of the Polish banking law apply to all natural persons, including those engaged in professional activity, and not only to consumers. The banking sector had until now considered that these rules, which govern data processing after the extinction of an obligation (either based on consent or without consent in case of default of more than 60 days and after a prior 30-day notification), did not concern entrepreneurs. The Court found this restrictive interpretation incorrect, thus extending the legal safeguards, such as the possibility to process a debtor's data for up to 5 years without their consent under strict conditions, to all natural persons regardless of their status as consumer or professional.

Decision of the authority

Consequently, the Supreme Administrative Court dismissed the cassation appeals filed by PKO BP S.A. and the Credit Information Bureau, thereby validating the UODO's decision.

Lessons

This decision confirms that:

• The notion of "natural person" protected by personal data law is broad and includes individuals acting in a professional context, such as sole proprietors.
• National provisions serving as the legal basis for data processing must be interpreted in light of the general principles of data protection, without unduly restricting their scope.
• The legal distinction between a "consumer" and a "professional", relevant in other areas of law, should not lead to depriving a natural person of the specific safeguards provided by legislation regarding the processing of their personal data.