The Polish Personal Data Protection Authority (UODO) conducted an awareness and consultation campaign from September 2 to 4, 2026 as part of its national tour, with stops in Kluczbork, Opole and Wrocław.

During a meeting in Kluczbork, the UODO president highlighted the increase in the number of complaints and breach notifications, as well as the need to better secure data and avoid excessive centralization in large registers. He cited as an example the cyberattack against the company MyDr, which potentially exposed the data of 19 million patients centralized in a single location. The importance of the role of the data protection officer (DPO), who must be involved in all processing activities to ensure compliance, was also recalled. UODO experts also addressed control procedures and data breach management.

In Opole, several events were held simultaneously. A meeting with public sector DPOs focused on the risks related to artificial intelligence, with UODO recommending data controllers to use its checklist of preliminary questions before any deployment. Another workshop clarified that the verification of criminal records for cybersecurity personnel, required by the national cybersecurity system law, constitutes a legal obligation under Article 6, paragraph 1, point c) of the GDPR and is permitted by Article 10 of the GDPR. Practical workshops for entrepreneurs and individual consultations for citizens also took place.

The final stop in Wrocław included a conference on balancing the right of access to public information and privacy protection. A session dedicated to cultural institutions specified that the exception provided by national law for literary or artistic activities, which exempts from certain GDPR obligations, must be interpreted strictly. It applies only to the artistic expression itself and not to other data processing activities of the institution, which remain fully subject to the regulation. Consultations for residents were also organized.