Guide to the GDPR

Edited by Maciej Gawroński · First published by Kluwer Law International B.V. in 2019 · Free online edition

Start reading

Contents

  1. Chapter 1 Basic Compliance

    Katarzyna Kloc, Maciej Gawronski, Marcin Dominiak, Michał Sztaberek, Patrycja Naklicka & Paweł Punda

    1. 1.1 The GDPR: The EU’s ‘Act’ on Personal Data Protection
    2. 1.2 Material and Territorial Scope of the GDPR
    3. 1.3 GDPR Glossary: Notes on Basic GDPR Terms, with Examples
    4. 1.4 Personal Data Processing Principles
    5. 1.5 Legal Basis for Personal Data Processing
    6. 1.6 Articles 9 and 10 GDPR: Special Categories of Data and Data on Criminal Convictions
    7. 1.7 Consent as Basis for Processing Personal Data
    8. 1.8 The Controller and Processor
    9. 1.9 Data Processing Which Does Not Require Identification
    10. 1.10 Record of Data Processing Activities
    11. 1.11 Transfer of Data to Third Countries or an International Organisation (Data Export)
    12. 1.12 Cross-Border Processing, i.e. Competence of the Lead Supervisory Authority (Article 4(16) and (23), Article 56 GDPR)
    13. 1.13 Joint Controllers
    14. 1.14 Codes of Conduct and Certification (Article 40 Onwards of the GDPR)
  2. Chapter 2 Data Subject’s Rights

    Aleksander P. Czarnowski, Katarzyna Kunda, Maciej Gawronski, Michał Kibil, Michał Sztaberek & Paweł Punda

    1. 2.1 Processing Data Subject’s Rights and Requests (Article 12 of the GDPR)
    2. 2.2 Right to Be Informed and Privacy Information Obligation (Articles 13 and 14 GDPR)
    3. 2.3 Right of Access to Data and to a Copy of Data (Article 15 GDPR)
    4. 2.4 Right to Rectification of Data (Article 16 GDPR)
    5. 2.5 The Right to Erasure (Right to Be Forgotten) (Article 17 GDPR)
    6. 2.6 Right to Restriction of Processing (Article 18 GDPR)
    7. 2.7 Obligation to Notify about Rectifying, Erasing, or Restricting of Processing of Data (Article 19 GDPR)
    8. 2.8 Right to Data Portability, i.e. How to Transfer Data from One Controller to Another (Article 20 GDPR)
    9. 2.9 The Right to Object (Article 21 GDPR)
    10. 2.10 Profiling and Automated Decision-Making (Article 22 GDPR)
  3. Chapter 3 Security

    Aleksander P. Czarnowski, Katarzyna Kloc, Katarzyna Kunda, Maciej Gawronski & Paweł Punda

    1. 3.1 Data Security in Light of the GDPR: Risk Analysis and Adequacy of Security Measures
    2. 3.2 Pseudonymisation and Encryption: Preferred Methods of Securing Personal Data?
    3. 3.3 Privacy by Design
    4. 3.4 Privacy by Default: Minimisation
    5. 3.5 Data Protection Impact Assessment
  4. Chapter 4 Data Processing

    Maciej Gawronski, Aleksander P. Czarnowski & Patrycja Naklicka

    1. 4.1 Data Entrustment and Elements of the New Data Processing Contract
    2. 4.2 New Challenges for Controller and Processor
    3. 4.3 Recommendations
  5. Chapter 5 Managing Incidents and Data Breaches

    Maciej Gawronski, Witold Chomiczewski, Zuzanna Piotrowska & Katarzyna Kloc

    1. 5.1 Notification of a Personal Data Breach to the Supervisory Authority (Article 33 GDPR)
    2. 5.2 Notifying Data Subjects About a Data Protection Breach (Article 34 GDPR)
  6. Chapter 6 Data Protection Officer (DPO)

    Michał Kibil & Maciej Gawronski

    1. 6.1 Data Protection Officer: Appointment and Status
    2. 6.2 Duties of a Data Protection Officer
  7. Chapter 7 The Regulator

    Adrianna Michałowicz & Dominik Lubasz

    1. 7.1 The Supervisory Authority: Status, Role and Obligations
    2. 7.2 Independent Status
    3. 7.3 Appointment and General Conditions for the Members of the Supervisory Authority
    4. 7.4 Competence of the Supervisory Authority
    5. 7.5 Tasks of the Supervisory Authority
    6. 7.6 Powers of the Supervisory Authority
    7. 7.7 Activity Reports
    8. 7.8 The Role of the Supervisory Authority Within the Cooperation and Consistency Mechanism
  8. Chapter 8 Legal Remedies, Liability, Administrative Sanctions

    Maciej Gawronski

    1. 8.1 Legal Remedies: Civil and Administrative Liability
    2. 8.2 Administrative Penalties for Breaches of the GDPR
    3. 8.3 Liability of a Processor

Appendices: templates

  1. Appendix I Personal Data Protection Policy

    Maciej Gawronski & Katarzyna Kunda

  2. Appendix II Data Processing Agreement
  3. Appendix III Joint Controllership Agreement

    Maciej Gawronski, Adrianna Gnatowska & Katarzyna Kunda

List of abbreviations

Foreword

The Guide to the GDPR was written in 2018 and until this day (June 2025) remains the most popular book on the GDPR in Poland, reaching a circulation of approximately 15,000 copies (including the expanded edition covering the Polish Personal Data Protection Act). The English version was published in 2019.

Since the first edition of the Guide, both the doctrine and practical application of the GDPR have developed exponentially. As a result, some of the views expressed in this book are no longer up to date. For example, the thesis that the conditions for lawful processing of special categories of personal data under Article 9(2) GDPR eliminate the need to meet the requirements of Article 6(1) GDPR has not stood the test of time. Both provisions must be applied cumulatively.

Although some of the views in the Guide have become outdated, it remains one of the best publications for truly understanding the GDPR and learning how to apply it in practice.

For these reasons, I decided to reclaim the publication rights from its original publisher, Wolters Kluwer International, and to republish the Guide, this time under open access. I would like to thank Wolters Kluwer International for publishing the first English edition and for transferring the rights to the book back to me.

Maciej Gawronski

About the editor

Maciej Gawronski is a Polish attorney-at-law, Certified International Privacy Professional-Europe of the International Association of Privacy Professionals, specializing in new technologies, dispute resolution, and regulations, and the managing partner of the Polish law firm GP Partners.

In 2021, for his contribution and special engagement in developing educational activities to spread data protection knowledge, Maciej was honored with the “Michal Serzycki” Award of the Polish Data Protection Office.

Since 2006 rankings such as Chambers Europe, Legal500, Best Lawyers, Who’s Who Legal 100 (Lexology Index), Guide to the World’s Leading Lawyers Legal Benchmarking Group, Managing Intellectual Property, Expert Guides, recognise Maciej in Data Protection, Dispute Resolution, Franchise, Intellectual Property, IT, Patent Disputes in Life Sciences, Technology, Media, Telecommunications, Trademark and Copyright Disputes.

Maciej authored two Number 1 legal bestsellers in Poland. He wrote and edited the Polish version of the Guide to the GDPR, most popular Polish legal book of 2018 and 2019 by Wolters Kluwer Poland, titled: "RODO. Przewodnik ze wzorami" (The Guide to the GDPR with Templates), recommended by the Polish Data Protection Office. Together with Piotr Biernatowski also from GP Partners, Maciej wrote and edited the most popular Polish legal book of 2022 by Wolters Kluwer Poland, titled: "Jak pisać pisma procesowe i prowadzić komunikację w sporze czyli książeczka o pisaniu pism" (How to Write Pleadings and Communicate in Disputes, or The Little Book on Drafting Pleadings), published in English as “The Little Book on Drafting Pleadings”.

Maciej served as European Commission Expert on Cloud Computing Contracts, Article 29 Working Party Expert on data transfers where he contributed ideas implemented in the GDPR (subprocessors liability, personal data portability, electronic form of data processing agreement).

Maciej’s extended bio with publications is available at https://gppartners.pl/maciej-gawronski and maciejgawronski.com.

GP Partners Gawroński, Biernatowski sp.k., headquartered in Warsaw, is a Polish business law firm specialising in technology, dispute resolution, corporate law, mergers and acquisitions, financial sector regulation, and public procurement.

GP Partners’ lawyers have been recognised by international rankings in categories such as: Data Protection, Dispute Resolution, Fintech, Franchise, Intellectual Property, IT, Media, Patent Disputes in Life Sciences, Public Procurement, Technology, Telecommunications, Trademark and Copyright Disputes, as well as Client Satisfaction.

The full list of GP Partners’ practice areas is available at: https://gppartners.pl/practiceareas.

TheCybercop - GP Partners emblem based on an illustration by Daniel Mróz for The Cyberiad by Stanisław Lem

TheBrain and TheCybercop used by GP Partners are based on illustrations by Daniel Mróz for The Cyberiad by Stanisław Lem. We would like to thank Ms. Łucja Mróz-Raynoch for licensing her father Daniel Mróz’s works to GP Partners.

A note from the editor

Dear Reader

Rember this book is from 2018/2019. If you're interested in current European data protection law, AI law, technology or intellectual property matters, or Polish business law, feel free to reach out to me at Maciej.Gawronski@gppartners.pl or connect with me on LinkedIn.

Maciej

TheBrain - illustration by Daniel Mróz for The Cyberiad by Stanisław Lem

©Łucja Mróz-Raynoch

Contributors

Witold Chomiczewski

Aleksander P. Czarnowski

Marcin Dominiak

Adrianna Gnatowska

Michał Kibil

Katarzyna Kloc

Katarzyna Kunda

Dr Dominik Lubasz

Adrianna Michałowicz

Patrycja Naklicka

Zuzanna Piotrowska

Paweł Punda

Michał Sztaberek

ISBN (web PDF): 978-83-968893-2-4 · G+P GV8 Sp. z o.o.