Data storage in specific industries: Legal requirements and dedicated solutions

Effective and compliant data storage is a fundamental part of how modern businesses operate. In an era of digital transformation, where the amount of information collected is growing exponentially, organizations face the challenge of not only managing these resources effectively, but also ensuring their security and compliance with increasingly stringent regulations. Differences in requirements between industries further complicate the picture, forcing companies to implement dedicated solutions tailored to the specific needs of the sector.

This article provides a guide to the legal requirements and technological solutions for data storage in various business sectors. It presents both common challenges and industry-specific aspects, with a focus on the Polish legal and business context.

Shortcuts

• Introduction
• What are the basic legal requirements for data storage in various industries?
• How does RODO affect the storage of personal data in companies?
• What are the specific regulations for data storage in the medical industry?
• What technologies support secure data storage in healthcare?
• What are the best practices for personal data retention?
• What dedicated technology solutions are available to the financial industry?
• What are the data storage challenges in the e-commerce industry?
• What are the requirements for data storage in the manufacturing sector?
• How to store data in the education sector in accordance with regulations?
• How does the public administration manage citizens’ data?
• What are the key differences in data storage between industries?
• What are the legal consequences of data retention violations?
• What innovative solutions, such as blockchain, can revolutionize data storage?
• What are the benefits of using cloud computing for data storage?
• What industries are most vulnerable to penalties for data breaches?
• What are the latest trends in data storage in specific industries?

Introduction

Effective and compliant data storage is a fundamental part of how modern businesses operate. In an era of digital transformation, where the amount of information collected is growing exponentially, organizations face the challenge of not only managing these resources effectively, but also ensuring their security and compliance with increasingly stringent regulations. Differences in requirements between industries further complicate the picture, forcing companies to implement dedicated solutions tailored to the specific needs of the sector.

According to IDC’s 2022 “Global DataSphere Forecast” report, global data volume is expected to reach 175 zettabytes by 2025, a threefold increase compared to 2020. At the same time, the number of reported data protection violations is rising, highlighting the growing challenges in this area.

This article is a comprehensive guide to the legal requirements and technological solutions for data storage in various business sectors. It presents both common challenges and industry-specific aspects, with a focus on the Polish legal and business context.

📚 Read the complete guide: Backup: The 3-2-1 rule and backup best practices

What are the basic legal requirements for data storage in various industries?

The basic legal requirements for data storage in Poland stem from a number of national and international regulations that create a complex web of obligations for businesses. The fundamental piece of legislation is Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016. (RODO), which in Article 5(1)(e) establishes the principle of storage limitation, according to which personal data must be kept in a form that allows the identification of the data subject for no longer than is necessary for the purposes of processing.

At the national level, the key is the Act on Personal Data Protection of May 10, 2018. (Journal of Laws 2018 item 1000, as amended), which clarifies the implementation of RODO in the Polish legal order. In addition, industry-specific legal acts impose specific obligations, such as: Telecommunications Law of July 16, 2004 (Journal of Laws 2004 No. 171 item 1800, as amended), Law on Providing Electronic Services of July 18, 2002 (Journal of Laws 2002 No. 144 item 1204, as amended), Accounting Law of September 29, 1994 (Journal of Laws 1994 No. 121 item 591, as amended), and Law on National Cyber Security System of July 5, 2018. (Journal of Laws 2018 item 1560, as amended).

Under Article 32 of the RODO, controllers and processors are required to implement appropriate technical and organizational measures to ensure data security. This includes pseudonymization and encryption of personal data, the ability to continuously ensure the confidentiality, integrity, availability and resilience of processing systems and services, the ability to quickly restore data availability in the event of an incident, and regular testing and evaluation of the effectiveness of technical and organizational measures. Many Polish organizations do not regularly test the effectiveness of their security measures, a significant gap in terms of legal requirements.

Article 24 of the RODO introduces the principle of accountability, which requires the controller to be able to demonstrate compliance. In practice, this means the need for regular reviews and audits of data storage systems.

Basic legal requirements - summary:

• Compliance with RODO (Articles 5, 24, 32) - limitation of storage, accountability, appropriate safeguards

• National legal acts - Personal Data Protection Act and sector regulations

• Regular audits - obligation to systematically verify compliance and effectiveness of safeguards

• Documentation of processes - ability to demonstrate compliance with regulations

• Technical and organizational protection measures - tailored to the risks and nature of the processing

How does RODO affect the storage of personal data in companies?

The RODO has introduced fundamental changes in the approach to storing personal data, significantly raising requirements for organizations. Article 5(2) of the RODO introduces the principle of accountability, according to which a controller must be able to demonstrate compliance with all data processing rules. At the same time, Article 5(1)(e) establishes the principle of limited retention, which requires that data be kept no longer than necessary.

In practice, this means the need for detailed documentation, including a register of processing activities (Article 30 RODO), data security and retention policies, data protection impact assessments (Article 35 RODO) for high-risk processes, and procedures for managing consents and exercising data subjects’ rights. According to the UODO’s 2022 report, failure to comply with the principle of limited retention accounted for 24% of all financial penalties imposed on Polish organizations.

Article 5(1)(c) of the RODO introduces the principle of data minimization, which requires that only data that is adequate, relevant and limited to what is necessary for the purposes of processing be collected. In the context of storage, this means implementing mechanisms for automatic deletion or anonymization of data at the end of the retention period, procedures for regular review of stored data for necessity, systems for classifying data by category and retention periods, and tools for identifying and managing data dispersed across different systems.

The RODO grants data subjects a number of rights that directly affect information retention practices: the right of access (Article 15), the right to rectification (Article 16), the right to erasure (“right to be forgotten,” Article 17), the right to restrict processing (Article 18) and the right to data portability (Article 20). Implementing the technical capacity to realize these rights presents significant organizational and technological challenges. Implementing the right to be forgotten is particularly difficult in fragmented data environments.

Article 32 of the RODO requires the implementation of appropriate technical and organizational measures, taking into account “the state of the art, the cost of implementation and the nature, scope, context and purposes of the processing and the risk of violation of the rights or freedoms of natural persons.” These measures should include encryption and pseudonymization of personal data, mechanisms to ensure the confidentiality, integrity, availability and resilience of systems, procedures for regular testing and evaluation of the effectiveness of safeguards, and the ability to quickly restore access to data in the event of an incident. Many organizations still do not perform regular penetration testing of their data storage systems.

Impact of RODO on data storage - summary:

• Accountability principle (Article 5(2)) - need to demonstrate compliance through documentation and procedures

• Storage limitation (Article 5(1)(e)) - storage of data only for the necessary period of time

• Data minimization (Article 5(1)(c)) - collecting only necessary information

• Fulfillment of subjects “rights (Articles 15-20) - technical feasibility of fulfilling data subjects” requests

• Data security (Article 32) - technical and organizational measures appropriate to the risk

What are the specific regulations for data storage in the medical industry?

Medical data regulations

The medical industry is subject to particularly stringent data storage regulations due to the high level of sensitivity of health information. The main legal acts regulating this matter in Poland are:

• The Law on Patients “Rights and Patients” Ombudsman of November 6, 2008. (Journal of Laws 2009 No. 52 item 417, as amended) - Article 29 specifies that medical records should be kept by:

20 years for standard medical records

• 30 years for records in oncology, infectious diseases or related to the death of a patient as a result of injury or poisoning

• 10 years for X-rays stored outside medical records

• 5 years for test referrals or doctor’s orders

• Ordinance of the Minister of Health of April 6, 2020 on types, scope and models of medical records and the manner of their processing (Journal of Laws 2020, item 666, as amended) - specifies detailed requirements for the form and content of medical records

• Law on information system in health care of April 28, 2011. (Journal of Laws 2011 No. 113 item 657, as amended) - regulates the rules of operation of ICT systems in health care, including Electronic Medical Records (EMD).

In addition, in the case of conducting clinical trials, the provisions of Regulation (EU) No. 536/2014 of the European Parliament and of the Council of April 16, 2014 on clinical trials of medicinal products for human use apply, which requires the retention of trial records for at least 25 years.

Special protection for genetic data

Genetic data are subject to enhanced protection under both the RODO (Article 9) and national laws. According to Article 9(2)(h) of the RODO, the processing of genetic data is permitted for the purposes of, among others, preventive health care, medical diagnosis or the provision of health care, but provided that the data is processed by an employee subject to the obligation of professional secrecy.

In Poland, additional requirements are introduced by the Law on Laboratory Diagnostics of July 27, 2001 (Journal of Laws 2001 No. 100 item 1083, as amended), which regulates the storage of genetic material and genetic test results. Under its provisions, laboratories must ensure increased standards of security and confidentiality for such data.

Processing of genetic data requires particular attention — personal data protection in medical facilities also covers procedures for this category of data.

Electronic Medical Records (EMD).

The implementation of EDM in Poland is regulated by the Law on the Health Care Information System and implementing regulations. According to these regulations, as of January 1, 2022, medical records should be kept in electronic form, using data exchange standards defined by the e-Health Center.

Key EDM requirements include:

• Ensure the integrity and authenticity of documentation through the use of electronic signature, electronic seal or trusted profile

• Guarantee of availability of documentation for the required retention period, regardless of technological changes

• Ensure interoperability of systems in accordance with HL7 CDA or HL7 FHIR standards

• Implement mechanisms to control access to documentation in accordance with the principle of minimum privileges

Compliance challenges and audits

Medical entities must regularly conduct compliance audits for data storage. According to Article 39.1.1(a) of the Health Information System Law, administrators of health care information systems are required to periodically audit the security of those systems.

In addition, facilities processing health data are required to conduct data protection impact assessments (DPIAs) in accordance with Article 35 of the RODO, as large-scale processing of health data poses risks to the rights and freedoms of individuals.

Many medical facilities do not conduct comprehensive data security audits more than once a year, indicating a significant area for improvement.

Specifics of the medical industry - summary:

• Extended retention periods - obligation to keep medical records for 20-30 years (Article 29 of the Law on Patients’ Rights).

• Electronic Medical Records - requirements for electronic form, signature and interoperability

• Special protection of genetic data - increased security standards in accordance with Article 9 of the RODO

• Regular security audits - obligation to periodically verify health care information systems

• Access control - strict requirements for medical data authorization

What technologies support secure data storage in healthcare?

Integrated information systems in medicine

The healthcare sector is increasingly turning to advanced technology solutions to securely store and process vast amounts of sensitive data. Key solutions include:

• Hospital Information System (HIS) - comprehensive medical facility management systems that integrate administrative, clinical and diagnostic modules.

• Electronic Health Record (EHR) - systems that store a patient’s complete medical history in electronic form. Examples of Polish solutions include AMMS (Asseco), Medicus Online (Kamsoft) or CliniNET (CompuGroup Medical).

• Picture Archiving and Communication System (PACS) - systems for storing and sharing medical images.

A key aspect of these systems is Role-Based Access Control (RBAC), which restricts access to data according to the principle of minimum privileges.

Encryption technologies in health care

Protecting medical data requires advanced cryptographic solutions that ensure the confidentiality of information during both storage and transmission:

• End-to-end encryption - ensures that data can only be read by authorized parties. In the context of telemedicine, end-to-end encryption is becoming a security standard.

• Database-level encryption - Technologies such as Transparent Data Encryption (TDE) in Oracle or SQL Server systems enable automatic encryption and decryption of data without application intervention.

• Homomorphic encryption - enables analysis on encrypted data without decryption. This technology is particularly important in the context of scientific research and medical analytics.

The challenge of implementing advanced cryptographic solutions is the performance of the systems - encryption increases the load on IT infrastructure, which, given the limited budgets of medical facilities, is a significant barrier to adoption. Many Polish hospitals cite insufficient infrastructure performance as a major obstacle to implementing end-to-end encryption solutions.

Blockchain in medical records

Blockchain technology finds application in ensuring the integrity and non-repudiation of medical records. Distributed records make it possible to create immutable records of medical events, which is especially important in the context of long record retention periods.

Benefits of using blockchain in medicine:

• Guarantee of immutability of medical records

• Audibility of data access

• Ability to share data securely between facilities

• Patient control over access to their data

Implementation challenges:

• High cost of infrastructure implementation and maintenance

• Scalability problems with large amounts of data

• RODO compliance issues (right to erasure vs. immutability of blockchain)

• Lack of uniform standards

The cost of implementing a blockchain system for a medium-sized hospital is high, which is a significant barrier to adoption.

Cloud solutions dedicated to medicine

Cloud services dedicated to the medical sector are gaining popularity due to their scalability and flexibility. Key solutions available on the Polish market include:

• Microsoft Azure for Healthcare - offers compliance with international security standards (ISO 27001, HIPAA) and dedicated tools for medical data management.

• Google Cloud Healthcare API - enables storage and management of medical data in FHIR, DICOM and HL7v2 standards.

• Comarch Healthcare Cloud - a Polish cloud solution tailored to local legal and regulatory requirements.

However, the implementation of cloud solutions in health care faces barriers:

• Concerns about security and confidentiality of medical data

• Uncertainty regarding compliance with local regulations

• Limited internet connectivity in some facilities

• The cost of migrating existing systems to the cloud

Advanced cloud services for storing medical data are still used by a minority of Polish medical facilities, although many plan to migrate some of their systems to the cloud.

Technology in health care - summary:

• Integrated information systems - HIS, EHR and PACS with role-based access control

• Advanced encryption - protecting data at rest and during transmission, with performance challenges

• Blockchain - ensuring documentation immutability with high implementation costs

• Cloud solutions - scalability and flexibility with security and compliance challenges

• Cost of technology - a significant barrier to implementing advanced solutions in Polish facilities

What are the best practices for personal data retention?

Data retention policy

Effective management of personal data retention requires a comprehensive approach, starting with the development of a detailed retention policy. This document should clearly define:

• Categories of data stored - according to Article 30 of the RODO, the register of processing activities should include categories of data, which is the starting point for determining retention strategies.

• Retention periods - specific deadlines for different types of data, taking into account legal requirements and legitimate business needs.

• Review procedures - in accordance with the principle of accountability (Article 5(2) of the RODO), the organization should regularly review the timeliness of stored data.

• Deletion methods - technical procedures to ensure permanent and secure deletion of data after the retention period.

Automation of data lifecycle management

With the increasing amount of data being processed, automating retention processes is becoming essential for compliance. Key elements of automation include:

• Information lifecycle management (ILM) systems - tools that enable automatic transfer of inactive data to archives and their deletion after the retention period.

• Data classification technologies - solutions, often using artificial intelligence, that automatically categorize data by sensitivity level and retention requirements.

• Personal data detection tools - systems that scan repositories for information subject to RODO regulations.

Automation challenges:

• High cost of advanced tools

• Implementation complexity in heterogeneous IT environments

• Risk of data misclassification

• Need to regularly update automation rules

Methods of secure data deletion

Proper deletion of data requires methods to ensure that it cannot be recovered. Depending on the category of data and media, different techniques are used:

• Software overwrite - repeatedly overwriting areas of a disk containing deleted data. Standards such as DoD 5220.22-M and NIST 800-88 define standards for secure overwriting.

• Degaussing - demagnetization of magnetic media, effectively removing all data.

• Physical destruction - for media containing particularly sensitive information, such as hard drives storing medical or financial data.

• Cryptographic deletion - encrypting the data and then destroying the encryption key, making the data unrecoverable.

Many Polish organizations do not use any advanced data deletion methods, limiting themselves to standard file deletion, which does not ensure the actual removal of information from media.

Audit and documentation of the retention process

Regular retention policy compliance audits are a key component of data management. Organizations should systematically review:

• Compliance with specified deadlines - whether data is stored in accordance with accepted retention periods.

• Efficiency of deletion processes - whether procedures for permanent deletion of data are effectively implemented.

• Completeness of documentation - whether the organization is able to demonstrate compliance with the principle of accountability.

• Backup environments - whether backups are included in retention and deletion processes.

Audit results should be documented and analyzed for potential improvements.

The cost of non-compliance can be significant - according to an analysis by law firm Maruta Wachta, the average cost of legal services for proceedings before the DPA in cases involving improper data retention ranges from PLN 15,000 to 45,000, not including potential financial penalties.

Data retention strategies - summary:

• Comprehensive retention policy - clear definition of data categories and retention periods

• Process automation - implementation of information lifecycle management systems

• Secure deletion methods - using techniques that prevent data recovery

• Regular audits - systematic verification of compliance with retention policy

• Documentation of compliance - ability to demonstrate compliance with the principle of accountability

What dedicated technology solutions are available to the financial industry?

The financial sector, due to particularly high regulatory requirements and the critical importance of data security, uses advanced, dedicated technological solutions. The legal basis for these solutions includes the Anti-Money Laundering and Countering the Financing of Terrorism Act of March 1, 2018 (Journal of Laws 2018 item 723, as amended) - Article 49 (1) and (2) requires that records of transactions and financial security measures be kept for 5 years from the first day of the year following the year in which the business relationship was terminated or the occasional transaction was carried out. The Banking Law of August 29, 1997 (Journal of Laws 1997 No. 140, item 939, as amended) - Article 105a (4) specifies that institutions may process information constituting bank secrets concerning individuals after the expiration of the obligation for a period of no more than 5 years. Regulation (EU) 2014/65/EU of the European Parliament and of the Council of May 15, 2014 on Markets in Financial Instruments (MiFID II) - Article 16(7) requires records of telephone conversations and electronic correspondence related to transactions to be retained for at least 5 years. Also, the Accounting Act of September 29, 1994 (Journal of Laws 1994 No. 121, item 591, as amended) - Article 74 specifies retention periods for accounting records (5 years for most documents, 3 years for payroll records). Compliance with retention-period rules is an important element of information security in the financial sector.

Transaction data management (TDM) systems are the backbone of financial institutions’ IT infrastructure, ensuring not only the secure storage of financial operations information, but also its integrity and non-repudiation. These solutions use advanced data validation mechanisms, transaction logs and multi-layered security features that minimize the risk of unauthorized modification or loss of critical financial information. Solutions such as Oracle Financial Services Analytical Applications and SAS Anti-Money Laundering are used by Poland’s largest banks. In the area of Anti-Money Laundering and Fraud (AML/CFT), modern solutions use artificial intelligence and machine learning to analyze transaction patterns, identifying anomalies that may indicate criminal activity. Implementation challenges include the high cost of implementation and maintenance, the need to integrate with existing systems (a long implementation time), complex regulatory compliance requirements, and the need for continuous updates in response to new criminal techniques.

Compliant archiving solutions address the requirements for long-term storage of financial data. WORM (Write Once Read Many) technology ensures the immutability of archived data, required by many financial sector regulations, including the Regulation of the Minister of Development and Finance of March 6, 2017 on ICT systems for brokerage activities. Archiving with timestamping is timestamping that provides proof of data existence at a specific point in time, using trust services that comply with the eIDAS Regulation. Enterprise content management (ECM) systems are comprehensive platforms for document lifecycle management, with functionality to ensure regulatory compliance.

Tokenization of sensitive data is becoming a standard in protecting financial information, especially in the context of payment card numbers or customer identification data. It involves replacing sensitive data with irreversible tokens that retain the format of the original, but have no value to potential attackers. The benefits of this technology include reducing the scope of the environment subject to PCI DSS, minimizing the risk of a personal data breach, preserving the functionality of business systems, and complying with the principle of data minimization (Article 5(1)(c) of the RODO). Challenges associated with tokenization include the cost of implementation (PLN 300-700k for a medium-sized institution), the impact on the performance of transaction systems, and the need to modify existing applications.

Solutions for the financial sector - summary:

• Strict regulations - data retention requirements for 5 years (AML, MiFID II, accounting)

• Advanced systems - TDM and AML/CFT with high implementation costs

• Regulatory-compliant archiving - WORM and timestamping technologies (PLN 800 thousand - 1.5 million)

• Tokenization of sensitive data - protection of financial information (PLN 300-700 thousand).

• Compliance challenges - complex integration with existing systems (12-18 months of implementation)

What are the data storage challenges in the e-commerce industry?

The eCommerce industry faces unique data storage challenges due to the massive amount of information generated by commerce platforms and high expectations for system availability and performance. The scale of data is impressive - according to the 2023 eCommerce Poland report, an average-sized online store in Poland generates between 10 and 50 GB of new transactional and behavioral data per month, and large platforms even generate more than 1 TB. This data is characterized by a wide variety of types: transactional data (orders, payments), customer profiles and purchase history, behavioral data (navigation paths, time spent on pages), product feedback and reviews, and marketing and analytics data. Load volatility is also a challenge - e-commerce is characterized by large fluctuations in traffic, especially during promotional periods and holidays. During Black Friday, traffic on Polish e-commerce platforms increases many times over compared to a normal day. Solutions to these challenges include hybrid database architectures, combining traditional relational systems (SQL) with modern NoSQL solutions and real-time databases. However, it is important to keep in mind the significant cost of infrastructure - maintaining a data infrastructure is a substantial monthly expense even for a medium-sized store.

The global nature of e-commerce generates complex challenges with international data protection regulations. The mosaic of regulations includes RODO in Europe (requires consent, data minimization, right to be forgotten), CCPA/CPRA in California (right to opt-out of data sharing), LGPD in Brazil (similar to RODO, but with local distinctions), APPI in Japan (specific data transfer requirements), and POPIA in South Africa (strict consent and notice requirements). Location requirements present additional challenges - some countries (Russia, China, Vietnam) require citizens’ data to be stored on local servers, forcing the maintenance of distributed infrastructure. Different regulations also introduce different requirements for data retention periods: tax records - 5 years in Poland (Tax Ordinance), 7 years in the US (IRS); marketing data - until consent is withdrawn in the EU, 3-4 years in other regions; payment information - different requirements from PCI DSS and local regulators. The consequences of these challenges include the need to implement geographic segmentation of data (average implementation cost of PLN 250-500k), complex systems for managing consents and user preferences, the need for continuous monitoring of regulatory changes (average annual legal cost of PLN 80-150k), and the risk of financial penalties in case of non-compliance (up to 4% of global turnover in the case of RODO).

Personalizing the shopping experience is a key element of competitive advantage in e-commerce, but must be balanced with respect for privacy. Personalization requirements include detailed data on user behavior, browsing and purchase history, demographics and location, and product preferences. At the same time, there are high expectations of privacy: transparent information about the data collected (Article 13 of the DPA), control over the use of personal data, the right to object to profiling (Article 21 of the DPA), and minimization of the data processed (Article 5(1)(c) of the DPA). Solutions balancing these conflicting needs include personalization based on anonymized or pseudonymized data, edge computing - analyzing data locally on the user’s device, recommendation systems using federated learning (without central data collection), and clear privacy policies with granular control over consent. Most Polish online consumers value personalized shopping experiences, but at the same time most express concerns about the privacy of their data. This contradiction poses a key challenge for the e-commerce industry.

Ensuring business continuity and protecting against data loss is a critical challenge for an industry where even short interruptions in availability can lead to significant losses. According to a 2023 e-Izba report, an hour of unavailability of an online store costs an average of between PLN 5,000 for small stores and more than PLN 100,000 for large e-commerce platforms in Poland. Protection strategies include geographically distributed data centers (active-active or active-passive), automatic real-time data replication, multi-level backup systems (full, differential, incremental) and disaster recovery testing (on average 2-4 times per year). Challenges in this area include the cost of comprehensive DR (Disaster Recovery) solutions - 15% to 30% of total IT spending, the complexity of testing disaster scenarios, the need to maintain data integrity across distributed systems, and balancing cost and protection levels (RPO/RTO).

E-commerce challenges - summary:

• Huge data volumes - 10-50 GB per month for medium-sized stores, more than 1 TB for large platforms

• International compliance - a complex patchwork of regulations with implementation costs of 250-500K.

• Personalization-privacy balance - most consumers value personalization, while most are concerned about privacy

• Business continuity - high cost of downtime and a significant share of the IT budget spent on DR

• Variable loads - traffic growing many times over during sales peaks

What are the requirements for data storage in the manufacturing sector?

The manufacturing and industrial sector is subject to specific regulations on data retention, which stem from both general legislation and industry-specific regulations. The Act of August 30, 2002 on the conformity assessment system (Journal of Laws 2002 No. 166 item 1360, as amended) in Article 13(1) obliges manufacturers to store technical documentation and declarations of conformity for a period of 10 years from the date the product is placed on the market. Regulation (EU) 2016/425 of the European Parliament and of the Council of March 9, 2016 on personal protective equipment in Article 8 (3) requires technical documentation to be kept for a period of 10 years after the PPE is placed on the market. The General Product Safety Act of December 12, 2003 (Journal of Laws 2003 No. 229, item 2275, as amended) requires the retention of information enabling the identification of products and their origin. For the pharmaceutical industry, the Ordinance of the Minister of Health of November 9, 2015 on the requirements of Good Manufacturing Practice (Journal of Laws 2015 item 1979) requires certain documents to be kept for at least one year after the expiration date of the batch or at least five years after the release of the batch. The cost of implementing systems to ensure compliance is significant for a medium-sized manufacturing plant.

The industrial sector is seeing rapid growth in solutions for storing and analyzing data from operational systems (OT) and the Industrial Internet of Things (IIoT). Data sources and types include SCADA and DCS systems generating process data, IIoT sensors monitoring machine and process parameters, production quality monitoring systems, and industrial automation data. The scale of data generated by manufacturing plants is significant. Key challenges in this area include integrating IT and OT systems (different protocols, security standards), ensuring process data security, storing high-resolution historical data, and real-time analytics. Platforms such as Siemens MindSphere, ABB Ability, GE Predix, SAP IoT or Microsoft Azure IoT are used to manage industrial data. Implementing and maintaining a comprehensive IIoT platform involves substantial costs for a medium-sized manufacturing plant in Poland.

An important trend is the implementation of edge computing architecture, which allows pre-processing of data close to its source. Benefits of this approach include reduction of process-critical latency, reduced cost of transferring data to the cloud, increased resilience to connectivity issues, and local processing of sensitive data. Applications include predictive machine maintenance, real-time quality control, automated process optimization and occupational safety systems. Challenges of edge computing include management of distributed infrastructure, synchronization of data between edge and center, limited computing resources at the edge, and security issues of distributed systems.

A particular challenge is securing the interface between IT and OT systems, which have traditionally operated in isolation. Threats include attacks on critical infrastructure through vulnerable OT systems, the spread of malware between networks, unauthorized access to production control systems, and manipulation of process data that affects business decisions. Protection strategies include network segmentation and demilitarized zones (DMZ), industrial gateway controllers (Industrial Gateway), one-way data diodes for critical systems, and advanced anomaly detection systems. Costs and challenges in this area include comprehensive protection of the IT/OT interface, the need to involve specialists from both fields, balancing security with operational performance, and regular penetration tests and audits. Incidents at the IT/OT interface also affect Polish industrial enterprises — see OT security.

Specifics of the industrial sector - summary:

• Industry regulations - obligation to keep technical documentation for 10 years

• Huge data volumes - 2-5 TB per month from OT and IIoT systems, only 15-20% utilized

• Edge computing - implemented by some enterprises

• IT/OT security - incidents in most companies, high cost of a major incident

• Data management platforms - high implementation and maintenance costs.

How to store data in the education sector in accordance with regulations?

The education sector is subject to specific regulations regarding the storage of personal data of pupils, students and employees. The legal basis is the Law of December 14, 2016. - Education Law (Journal of Laws 2017, item 59, as amended), together with implementing regulations governing the scope of data collected and the manner of keeping educational records. The Ordinance of the Minister of National Education of August 25, 2017 on the manner in which public kindergartens, schools and institutions keep records of the course of teaching, educational and caring activities, as well as the types of such documentation (Journal of Laws 2017 item 1646) stipulates that grade sheets are kept for 50 years, lesson diaries for 5 years, and resolutions of the board of education for 50 years. Law of July 20, 2018. - Law on Higher Education and Science (Journal of Laws 2018 item 1668, as amended) - Article 347 regulates the functioning of the POL-on Integrated Information System for Higher Education and Science and the scope of data to be processed. Ordinance of the Minister of Science and Higher Education of September 27, 2018 on studies (Journal of Laws 2018, item 1861) - § 15 stipulates that records of the course of studies shall be kept for 50 years.

Educational institutions face unique data retention challenges. A key problem is long retention periods - the need to keep records for decades (up to 50 years) while technology changes. The variety of data includes personal data of students and their guardians, educational results and coursework, behavioral data from e-learning systems, data of a special nature (e.g., health information), and copyrighted educational materials. Limited IT budgets are also a significant challenge - Polish educational institutions spend significantly less on IT infrastructure and data security than similar institutions in Western Europe. Fragmentation of systems is also a problem - a lack of uniform standards and technological solutions, leading to inefficiencies and interoperability problems.

Educational institutions process special categories of personal data that require higher standards of protection. These include health information (e.g., disabilities, chronic diseases), data on ethnic and national origin, information on family and economic situation, biometric data (in access control systems), and information on religious beliefs. The legal basis for processing this data is Article 9(2)(g) of the RODO, according to which the processing of special categories of data is possible when it is necessary for reasons of important public interest. In the Polish legal system, such a basis is provided, among others, by Article 155 of the Education Law regarding information about the health of a student. Required safeguards include limiting access to sensitive data, encryption of databases and transmissions, pseudonymization in analytical processes, and special retention and deletion procedures. Only some educational institutions have implemented dedicated procedures for processing special categories of data, while the vast majority process such data in their daily operations.

Educational institutions are using dedicated data management systems. Electronic diaries, such as Librus, Vulcan, MobiReg and ProgMan, are used by the vast majority of primary and secondary schools. Universities are dominated by the University Student Service System (USOS), used by most Polish public universities. E-learning platforms - Moodle, Microsoft Teams for Education, Google Classroom, as well as knowledge and library management systems - dLibra, Alma, Koha - are gaining popularity. Technological challenges include high implementation costs, integrating different systems and ensuring data flow, training staff (often with limited digital competencies), and ensuring regulatory compliance when migrating to new systems.

Requirements for the education sector - summary:

• Long retention periods - records kept for up to 50 years (grade sheets, student records)

• Sensitive data - the vast majority of facilities process special category data, but only some have dedicated procedures

• Limited budgets - IT spending significantly lower than in Western Europe

• Widespread systems - the vast majority of schools use electronic diaries

• Irregularities - problems with storing student data in most inspected schools

How does the public administration manage citizens’ data?

Public administration is subject to specific regulations regarding the preservation of citizen records and official documents. The Act of July 14, 1983 on the national archival resource and archives (Journal of Laws 1983 No. 38, item 173, as amended) is the basic legal act regulating the rules for handling documentation in public administration. The Ordinance of the Prime Minister of January 18, 2011 on the Registry Instruction, Uniform Material File Lists and the Instruction on the Organization and Scope of Operation of Company Archives (Journal of Laws 2011 No. 14, item 67) specifies specific retention periods for individual categories of documents: category A are documents of permanent historical value, stored in perpetuity, and category B (with a number) are documents of temporary practical value, e.g. B5 means storage for 5 years. The Law of February 17, 2005 on the computerization of the activities of entities performing public tasks (Journal of Laws 2005 No. 64, item 565, as amended) regulates electronic record keeping in the administration. The Act of September 5, 2016 on trust services and electronic identification (Journal of Laws 2016 item 1579) sets out the rules for verifying identity in electronic communications.

The Electronic Document Management System is a key element of the digitization of public administration in Poland. The legal basis is Article 6(1a) of the Act on National Archive Resources and Archives, which allows records to be maintained in electronic form. Most government units and a significant share of local government units use EZD as the primary means of documenting matters. Key systems include EZD PUW (developed by the Podlaskie Voivodship Office), EZD RP (a nationwide system developed by NASK) and commercial systems (e.g. FINN, PROTON, eDokument). Challenges of implementation include high cost, migration of archived paper documents, interoperability with domain systems, and long-term storage of electronic documents.

Public administration, as the depository of critical data of citizens and the state, is subject to special security requirements. The National Cyber Security Framework and the National Cyber Security System Act of July 5, 2018. (Journal of Laws 2018 item 1560) impose specific obligations on operators of critical services, including public administration units. Required safeguards include multi-level authentication systems, advanced encryption of sensitive data, dedicated, isolated government networks, regular penetration tests and security audits, and business continuity and disaster recovery plans. Security challenges include limited IT budgets, difficulty in recruiting and retaining cyber security specialists, aging infrastructure in some entities, and a growing number of targeted attacks on government. Public administration units are the target of a significant share of advanced cyberattacks in Poland, highlighting the scale of the threat.

Administrative units must balance their obligation to provide public information with the protection of personal data. The legal bases are the Law of September 6, 2001 on Access to Public Information (Journal of Laws 2001 No. 112 item 1198), the Law of February 25, 2016 on Re-use of Public Sector Information (Journal of Laws 2016 item 352), as well as RODO and the Law on Personal Data Protection. Data sharing requirements include anonymizing or pseudonymizing personal data, verifying the legal basis for processing, and assessing the proportionality of sharing. Technical challenges include automatic identification of personal data in documents, effective anonymization while preserving information value, and managing access to data with different classifications. The vast majority of BIPs (Public Information Bulletins) contain inadequacies in the anonymization of personal data, demonstrating the difficulty of balancing transparency and privacy in practice.

Public administration - summary:

• Varied retention periods - from category B documents (several years) to category A (perpetual)

• Electronic Records Management - most government entities, significant cost reduction

• High threat of cyber attacks - a significant share of advanced attacks targeting administration

• Security challenges - limited IT budgets

• Problems with anonymization - irregularities in the vast majority of public information bulletins

What are the key differences in data storage between industries?

Requirements for data retention periods represent one of the most pronounced differences between sectors. In the medical industry, patient records must be retained for 20-30 years, requiring the implementation of solutions to ensure long-term data availability and readability, even in the face of changing technology. In contrast, the e-commerce sector can delete some transaction data after just a few years, retaining only the information required by tax or accounting regulations. Financial institutions must retain transaction records for periods specified by sector regulations (e.g., 5 years for AML records), while ensuring that they are unassailable and auditable. The table below provides a detailed comparison:

Industry	Data type	Retention period	Legal basis
Medical	Standard documentation	20 years	Article 29 of the Law on Patients’ Rights
	Oncology/infectious disease records	30 years	Article 29 (1) (4) of the Law on Patients’ Rights
	X-rays	10 years	Article 29 (1) (2) of the Law on Patients’ Rights
Financial	AML documentation	5 years	Article 49 of the Anti-Money Laundering Law
	Accounting records	5 years	Article 74 of the Accounting Law
	Call recordings (MiFID II)	5 years	Article 16(7) of MiFID II
E-commerce	Transaction data	5 years	Tax regulations
	Marketing data	To withdraw consent	Article 6(1)(a) of the RODO
	System logs	1-2 years	Internal policies
Education	Evaluation sheets	50 years	MEN Regulation on documentation
	Classroom diaries	5 years	MEN Regulation on documentation
	Student documentation	50 years	Regulation of the Ministry of Science and Higher Education on studies
Administration	Cat A documents	Perpetually	Law on Archives
	Cat B documents	By category (e.g., B5 - 5 years)	Ordinance on the Registry Instruction

The level of sensitivity and categories of data stored vary significantly between industries, which translates into different security requirements. The healthcare sector operates on particularly sensitive medical data that requires the highest level of protection, including advanced encryption, strict access control and comprehensive auditing mechanisms. The financial industry processes critical transactional data, the compromise of which could lead to direct financial losses, necessitating the implementation of multi-layered security and anomaly detection systems. The e-commerce sector, while also processing financial data, focuses more on protecting information about consumer behavior, which is a key business resource. Education collects performance and achievement data, behavioral and developmental information, and sometimes health (e.g., disability) data. Public administration operates on citizen identification data, legal status information, property information, and tax, health and court data.

The approach to the use of cloud technologies also varies significantly between industries. Healthcare shows the lowest adoption, preferring private and hybrid clouds due to concerns about medical data security and regulatory compliance. The average budget for migration is 400-900K for the average facility. The financial sector shows moderate adoption, preferring dedicated clouds that meet FSA requirements. The main barriers are stringent regulations and the need to control data, and migration budgets are high. E-commerce is leading the way in cloud adoption, preferring public global clouds due to scalability, flexibility and global availability. The average migration budget is 250-650K for the average platform. In education, most institutions use the cloud, preferring public clouds with education suites due to low cost and ease of deployment. The average budget for migration is PLN 80-250k for the average institution. Public administration has the lowest adoption after medicine, preferring government clouds and national solutions due to security requirements and data sovereignty.

Inter-industry comparison - summary:

• Retention periods - from a few years in e-commerce to 50 years in education and perpetual in government

• Data sensitivity - highest security costs in medicine and finance

• Cloud adoption - highest in e-commerce, lowest in medicine and administration

• Migration budgets - from PLN 80-250 thousand in education to PLN 1.2-3 million in the financial sector

• Preferred models - from public global clouds (e-commerce) to dedicated national clouds (administration)

What are the legal consequences of data retention violations?

Violations of data retention rules can result in severe financial penalties, which have increased significantly following the introduction of RODO and similar regulations around the world. In the European Union, maximum fines can reach 20 million euros or 4% of an organization’s global annual turnover (whichever is higher), according to Article 83 of RODO. In practice, this means that even for large corporations, potential penalties pose a serious financial risk. According to the UODO’s report for 2018-2023, the total amount of fines imposed in Poland amounted to more than 12 million zlotys, a significant part of which concerned improper data storage. Selected examples of fines in Poland include PLN 2.8 million for a telecommunications company for improperly securing customer data (2019), PLN 1.9 million for a bank for violating the principle of transparency and data minimization (2020), PLN 1.1 million for an e-commerce platform for insufficient data security measures (2021), and PLN 856,000 for an energy company for violating the principle of limited storage (2022). The amount of fines imposed depends on a number of factors: the nature, severity and duration of the breach, willfulness or negligence, actions taken to minimize the damage, previous violations and the degree of cooperation with the supervisory authority, the categories of personal data affected. According to an analysis by the law firm Maruta Wachta, the average amount of fines for data storage violations in Poland in 2021-2022 was around PLN 450,000, with an upward trend evident.

In addition to administrative penalties, civil lawsuits brought by those affected by violations are a serious risk. Article 82 of the RODO grants data subjects the right to compensation for tangible and intangible damages resulting from violations. Types of claims include compensation for tangible harm (e.g., loss of funds), compensation for intangible harm (e.g., stress, invasion of privacy), and class action lawsuits in cases of mass violations. The cost of damages includes compensation in individual cases, potentially very high costs of class actions, and additional legal fees. According to an analysis by the law firm Traple Konarski Podrecki and Partners in 2023, the total cost of a major data breach (taking into account the DPA’s penalties, damages and legal fees) could be between PLN 2-7 million for a medium-sized organization in Poland.

The reputational consequences of a data breach can be as severe as legal sanctions. Reputation restoration costs include communication and PR campaigns, remediation programs for those affected, enhanced security measures and external audits. Rebuilding full trust after a major data breach takes a long time, and some companies never regain their previous level of trust. The industries most at risk of losing trust after data breaches are banking, health care and e-commerce.

In industries subject to specific sector regulations, violations of data retention rules can lead to additional administrative sanctions. In the financial sector, these can include penalties imposed by the FSC (up to 10% of annual revenue), temporary restriction or suspension of operations, mandatory external audits (costing PLN 150-400 thousand), and increased supervision by the regulator (monthly/quarterly reports). For example, in 2022, the FSA imposed a fine of PLN 5 million on a bank for violations related to customer data security, regardless of the proceedings of the DPA. In healthcare, consequences may include fines imposed by the National Health Service (up to 2% of the contract value), exclusion from reimbursement programs, extraordinary inspections (an average of 3-5 additional inspections per year) and mandatory patient notification (costing PLN 50-100/patient). The telecommunications sector may experience fines imposed by the UKE (up to 3% of revenue), additional reporting obligations, and restrictions on frequency and numbering allocations. In the capital market, these may include sanctions from ESMA or the FSA, an obligation to publish information about the violation (current report), and an impact on ratings and access to financial instruments. Data from the Association of Polish Banks 2023 indicates that the additional costs associated with industry sanctions can increase the total cost of a data breach by up to 40-70% compared to standard DPA penalties.

Consequences of violations - summary:

• RODO penalties - up to €20 million/4% of turnover, in Poland an average of PLN 450,000 for data storage violations

• Damages - individual compensation and potentially very high class action costs

• Loss of reputation - a significant loss of trust depending on industry, long recovery time

• Industry sanctions - additional penalties that increase the cost of a violation by 40-70%

• Total cost - very high for a medium-sized organization in Poland

What innovative solutions, such as blockchain, can revolutionize data storage?

Blockchain in data integrity protection

Blockchain technology introduces a revolutionary approach to data storage, offering indisputability and transparency of records without relying on a central administrator:

• Principle of operation - blockchain creates a distributed database in which each new “block” of information contains a cryptographic hash of the previous block, creating an unalterable chain. Modification of any block would require changing all subsequent blocks in the chain, which is virtually impossible with the distributed nature of the register.
• Applications in data management:

Ensure the integrity of electronic documentation

• Verifiable data access records

• Unchangeable audit records

• Managing user consents and preferences

• Benefits to the organization:

Reduced risk of data manipulation

• Easier to demonstrate compliance with regulatory requirements

• Reduction in audit costs

• Increase stakeholder confidence

• Implementation challenges:

High cost of implementation

• Energy consumption (especially for Proof of Work mechanisms)

• Scalability problems with large data volumes

• Challenges of RODO compliance (especially the right to erasure)

Blockchain-based data integrity solutions are still rare in Polish organizations, although some are planning such deployments.

Confidential Computing (Confidential Computing)

Confidential computing is a groundbreaking approach to protecting data during processing, complementing traditional safeguards that protect data at rest and during transmission:

• Working principle - the technology uses hardware-based security enclaves (TEE - Trusted Execution Environment), such as Intel SGX, AMD SEV or ARM TrustZone, which isolate sensitive computing operations. These enclaves create an isolated environment where data is encrypted even during processing, preventing even system administrators or service providers from accessing it.
• Key applications:

Secure analysis of sensitive data in shared environments

• Protection of cryptographic keys and authentication processes

• Inter-organizational cooperation on confidential data

• Processing of regulated data (e.g., medical, financial)

• Leading solutions:

Microsoft Azure Confidential Computing

• Google Cloud Confidential VMs

• IBM Cloud Hyper Protect Services

• Fortanix Confidential Computing Platform

• Implementation costs:

Application migration: PLN 150-450k.

• Additional infrastructure costs compared to standard services
• Team training: PLN 25-60 thousand.

Decentralized data storage systems

Decentralized File Storage (DFS) systems offer an alternative to traditional centralized repositories, providing increased resilience and security:

• Principle of operation - files are split into fragments, encrypted and distributed across a network of independent nodes, eliminating a single point of failure.
• Key technologies:

IPFS (InterPlanetary File System) - a communication protocol and P2P network for distributed storage

• Filecoin - cryptocurrency incentive system for storage space providers

• Storj - distributed, encrypted cloud storage

• Sia - decentralized storage platform using blockchain

• Benefits:

Enhanced resilience to failures and DDoS attacks

• Reduction in storage costs

• Protection from censorship and central control

• Potential efficiency improvements due to geographic dispersion

• Challenges:

Variable data access latency

• Limited throughput compared to central solutions

• Problems with deletion of data (right to be forgotten)

• The complexity of managing encryption keys

Business applications are mainly focused on storing data not subject to strict time constraints, such as long-term archives, backups and multimedia assets.

AI in data management

Artificial intelligence and machine learning technologies are revolutionizing data lifecycle management, enabling automated classification, anonymization and storage optimization:

• Key AI applications:

Automatic classification of data by sensitivity and regulatory requirements

• Intelligent analysis of unstructured data to identify personal information

• Active monitoring and detection of data access anomalies

• Anticipate storage needs and optimize resources

• Automation of anonymization and pseudonymization

• Effectiveness of AI solutions:

Significant reduction in data classification time

• Increase accuracy of sensitive data identification significantly

• Reduce data management costs significantly

• Significantly speed up the process of responding to data requests

• Examples:

Microsoft Purview (formerly Azure Data Catalog)

• Google Cloud Data Catalog

• IBM Watson Knowledge Catalog

• BigID Data Intelligence Platform

• Collibra Data Intelligence Cloud

• Implementation costs: increase with the size of the organization.

The highest adoption is observed in the financial and telecommunications sectors.

Innovative technologies - summary:

• Blockchain - implemented in a small share of Polish organizations, high implementation cost

• Confidential calculations - low adoption (below the EU average), high costs a barrier

• Decentralized storage - adoption tipping point projected in 3-5 years

• AI in data management - significant reduction in classification time, used by some Polish companies

• AI implementation costs - depend on the size of the organization

What are the benefits of using cloud computing for data storage?

Cloud service models for data storage

Flexible scalability is one of the most tangible benefits of cloud computing. A variety of service models are available, tailored to an organization’s specific needs:

• Infrastructure as a Service (IaaS) - provides a virtual infrastructure on which an organization deploys and manages its own data storage systems:

Examples: Amazon EC2 + EBS, Microsoft Azure Virtual Machines + Disk Storage, Google Compute Engine + Persistent Disks.

• Benefits: maximum control and configuration flexibility

• Challenges: requires competence in infrastructure management

• Costs: a monthly fee per TB of stored data (including infrastructure)

• Platform as a Service (PaaS) - provides a platform for storing and managing data without managing infrastructure:

Examples: Amazon RDS, Azure SQL Database, Google Cloud SQL, database services like MongoDB Atlas

• Benefits: reduced administrative burden, automatic updates

• Challenges: limited control over configuration of lower layers

• Costs: a monthly fee per TB of data (higher than IaaS, but with lower personnel costs)

• Storage as a Service (STaaS) - dedicated data storage services:

Examples: Amazon S3, Azure Blob Storage, Google Cloud Storage

• Types: object-oriented, block-based, file-based

• Benefits: high scalability, simple API, optimized costs

• Challenges: integration with existing applications

• Costs: lowest for infrequently used data, higher for frequently used data

Data security in the cloud

The advanced security features offered by leading cloud providers often outstrip the capabilities of in-house IT teams, especially in smaller organizations:

• Key security mechanisms:

Data encryption at rest and during transmission

• Advanced cryptographic key management systems (KMS)

• Multi-factor authentication and role-based access control (RBAC)

• Protection against DDoS attacks

• Regular pentesting and vulnerability scanning of the infrastructure

• Physical data center security (biometric access control, 24/7 monitoring)

• Regulatory Compliance:

ISO 27001, 27017, 27018 certifications

• Compliance with SOC 1/2/3

• Industry-specific certifications (PCI DSS, HIPAA, GDPR Compliance)

• Compliance monitoring and reporting tools

• Security Challenges:

Shared responsibility model (supplier vs. customer)

• Risk of improper configuration (a common cause of breaches)

• Access control of cloud provider administrators

• Vendor lock-in and dependence on a single supplier

Data redundancy and availability

Global availability and data redundancy are other key benefits of cloud computing:

• Mechanisms for ensuring accessibility:

Multi-Region Replication - automatic replication of data between geographically distant data centers

• Zone-Redundant Storage - storing copies of data in independent availability zones within a single region

• Service Level Agreements (SLAs) - 99.9% - 99.999% availability guarantees (a few minutes to a few hours of unavailability per year)

• Automatic failover - switching to backup systems in case of failure

• Key parameters:

RTO (Recovery Time Objective) - the time it takes to restore a service after a disaster

• RPO (Recovery Point Objective) - maximum acceptable period of data loss in case of failure

• Geographic redundancy costs - a significant additional cost compared to standard storage

• Practical applications:

Critical business systems: multi-region, RPO < 5 minutes, RTO < 15 minutes

• Standard business applications: single-region/multi-zone, RPO < 1 hour, RTO < 4 hours
• Archival data: basic redundancy, RPO/RTO in days

**Cost analysis of cloud vs. on-premise solutions **

The pay-as-you-go economic model is a significant advantage of cloud solutions, but a comprehensive cost comparison requires consideration of many factors:

• Cost elements in the traditional (on-premise) model:

CAPEX: hardware infrastructure (servers, arrays, network) - amortization 3-5 years

• Data center costs (power, cooling, space)

• Software licenses

• Personnel costs of the IT team

• Upgrade and replace equipment (every 3-5 years)

• Cost elements in the cloud model:

OPEX: monthly charges for resources used

• Data transfer charges (especially outgoing)

• Cloud migration costs (one-time)

• Training and certification of the team

• Additional services (monitoring, backup, security)

• Total Cost of Ownership (TCO) analysis:

For small businesses (< 50 employees): cloud significantly cheaper

• For medium-sized companies (50-250 employees): cloud cheaper

• For large companies (> 250 employees): mixed results, from savings to higher costs

• Factors affecting profitability:

Load variability (higher benefits with variable load)

• Scale of operations (economies of scale for large on-premise deployments)

• Specific performance and regulatory requirements

• Migration costs of existing systems

Cloud computing - summary:

• Service models - IaaS (£700-1500/TB), PaaS (£900-2000/TB), STaaS (£80-450/TB)

• Adoption in Poland - most medium and large companies, with a clear increase in recent years

• Security - most organizations consider the cloud more secure than local data centers

• Geographic redundancy - implemented in only some Polish organizations

• Cost analysis - savings for small and medium-sized companies

What industries are most vulnerable to penalties for data breaches?

Health sector

The healthcare sector is at particularly high risk, processing vast amounts of sensitive personal and medical data while operating on an often outdated IT infrastructure:

• Major risk factors:

High sensitivity of medical data (Article 9 of the RODO).

• Long documentation retention periods (20-30 years)

• Distributed processing environment (hospitals, clinics, laboratories)

• Often outdated IT infrastructure (many facilities use legacy systems)

• Shortage of cyber security specialists (average of 0.7 FTEs per facility)

• Incident statistics:

A significant share of data breaches in Poland concerns the medical sector

• High average cost of a medical data breach

• Most medical facilities have experienced a security incident in recent years

• Key compliance challenges:

Integration of RODO with medical records regulations

• Management of patient consents (including e-consent)

• Secure data sharing between healthcare providers

• Control of access to IT systems (an average of 43 applications in a facility)

• Recommended actions:

Implementation of dedicated systems for medical records management (EDM)

• Rigorous staff training (most incidents are due to human error)

• Regular security audits (at least twice a year)

• Categorize data by sensitivity and specific retention requirements

According to the NIK’s 2023 report “Cyber Security in Health Care,” the average level of security maturity in Polish medical facilities is 2.1 on a 5-point scale, indicating a significant gap from the required level (min. 3.5).

Financial institutions

Financial institutions, due to the nature of the data they process and the potential consequences of data leakage, are also under special oversight by regulators:

• Sector-specific regulations:

Recommendation D of the FSC on the management of information technology and security areas of the information and communications environment

• Banking Law of August 29, 1997, Articles 9-9f (risk management system).

• EBA guidelines on ICT and security risk management (EBA/GL/2019/04)

• DORA (Digital Operational Resilience Act) regulation - new EU requirements coming into force in 2025.

• Key data categories:

Transaction data (history of operations, balances)

• Customer identification data (KYC, AML).

• Credit ratings and scoring

• Access data to electronic banking systems

• Incident statistics:

Some data breaches in Poland concern the financial sector

• Average cost of violation: much higher than the average for all industries

• Incidents in the financial sector are detected faster than in other industries

• Security maturity:

IT security spending: a clearly higher share of the IT budget than the average for other industries

• Average security maturity level: 3.8/5 (highest among all sectors)
• Dedicated security teams: an average of 8.3 FTEs in a medium-sized bank

Despite their high level of security maturity, financial institutions remain the main target of advanced cybercriminal attacks. The banking sector remains a target of data phishing attempts — see electronic banking security.

Telecommunications and Internet platforms

The telecommunications sector and online platforms process huge amounts of personal and communications data, making them a frequent target of regulators:

• Specific regulations:

Telecommunications Law (Journal of Laws 2004 No. 171 item 1800, as amended).

• Act on providing services by electronic means (Journal of Laws 2002 No. 144 item 1204, as amended).

• The e-Privacy Directive (2002/58/EC) and the forthcoming e-Privacy Regulation

• Articles 174-175 of the Telecommunications Law (data retention)

• Sensitive sector data:

Communication metadata (who, when, with whom communicated)

• Location data of users (movement history)

• Detailed behavioral and demographic profiles

• Communication content (messages, conversations)

• Violation statistics:

24% of all DPA penalties apply to the telecommunications sector (2018-2023)

• Average penalty amount: PLN 1.4 million (second highest after the financial sector)

• Most common violations: insufficient technical and organizational measures, excessive data retention period

• Characteristic challenges:

Huge data volumes (average of 5-12 TB per day for a large operator)

• Complex technology ecosystems (140+ systems on average in a large telco)

• Need to balance data retention obligations for law enforcement with privacy protection

• High expectations of service availability (99.99%) while maintaining security

Telecom operators report security incidents, some of which involve personal data.

E-commerce and retail

E-commerce and retail, due to the processing of payment data and detailed consumer profiles, are also among the high-risk industries:

• Specific regulations:

PCI DSS standard (Payment Card Industry Data Security Standard) - requirements of payment organizations

• PSD2 Directive and Delegated Regulation on strong customer authentication

• Law on Consumer Rights (Journal of Laws 2014 item 827 as amended).

• Geoblocking Regulation (2018/302) on unjustified geoblocking

• Key data categories:

Payment card data (PAN, CVV, expiration date)

• Purchase history and buying behavior

• Address and contact details of customers

• Information about preferences and interests

• Incident statistics:

Some data breaches in Poland concern the e-commerce sector

• Average cost of violation: PLN 890,000.

• The vast majority of payment card-related breaches involve small and medium-sized online stores

• Industry Challenges:

Seasonality of traffic (many-fold increases during promotional periods)

• The need for rapid integration of multiple systems (an average of 23 integrations in a medium-sized store)

• Balancing personalization with privacy

• Growing consumer expectations regarding security (for the vast majority of consumers, data security is a key factor in choosing an e-retailer)

High-risk industries - summary:

• Health care - a significant share of all breaches, high average cost, low security maturity

• Financial sector - some of the breaches, very high average cost, highest security maturity

• Telecommunications - 24% of all DPA fines, average fine of PLN 1.4 million, 423 serious incidents in 2022

• E-commerce - some of the breaches, high average cost, only some companies conduct regular audits

• Key difference - security spending as a share of the IT budget is much higher in finance than in e-commerce

What are the latest trends in data storage in specific industries?

Trends in health care

In the healthcare sector, we are seeing the rapid development of Federated Medical Data Storage Systems, which allow the secure exchange of information without a central repository:

• Medical data federation:

Based on HL7 FHIR (Fast Healthcare Interoperability Resources) standard.

• Allows access to data remaining in their original locations

• Supports standardized API with advanced authorization mechanisms

• Examples of implementations: P1 (Electronic Platform for Collection, Analysis and Sharing of Digital Resources on Medical Events), regional e-health platforms

• Genomic platforms:

Dedicated systems for storage and analysis of genetic data

• Require special security protocols and encryption

• Handle petabytes of data (a single genome is ~150GB of data)

• Examples: ABM Genomics Platform, commercial solutions like DNAnexus

• Advanced anonymization for medical research:

Synthetic medical data techniques (generation of artificial but statistically faithful records)

• Federated learning (learning models without raw data transfer)

• Differential privacy adding controlled noise to data

• Development prospects:

• Rapid medical data volume growth (mainly through imaging and device data)

• Development of regulations for secondary use of medical data

Trends in the financial sector

The financial industry is increasingly bold in exploring the potential of advanced data processing technologies while prioritizing security and regulatory compliance:

• Homomorphic processing:

Allows analysis of encrypted data without decryption

• Applications: credit risk analysis, fraud detection, customer segmentation

• Maintains data confidentiality while enabling advanced analysis

• Examples of solutions: IBM Security Homomorphic Encryption Services, Microsoft SEAL

• Challenge: high computational requirements (10-100x greater than standard processing)

• Data Mesh and Data Fabric:

Decentralized data management architectures

• Domain approach (data managed by business teams)

• Standardization of data exchange interfaces between domains

• Governance federalism with consideration of local regulations

• Implemented by some Polish financial institutions

• Consent Management platforms:

Central repositories of customer consents for data processing

• Integration with CRM and marketing systems

• Automatic enforcement of privacy preferences

• APIs that allow customers to manage their consents

• Tokenization as a standard:

Replacing sensitive data with tokens without business value

• Significant reduction in the scope of the environment subject to PCI DSS

• Implemented by the vast majority of banks and most payment institutions

• Expanding applications beyond payment data (personal data, identification documents)

Trends in e-commerce and commerce

The dominant trend in the e-commerce industry is hyper-personalization based on advanced data analytics, while respecting users’ privacy:

• Privacy-First Analytics:

Processing behavioral data locally, on the user’s device

• Mechanisms to limit the transfer of sensitive information to central servers

• Edge computing technologies and local recommendation systems

• Examples of solutions: Google Privacy Sandbox, Apple Privacy Framework, Web API-based solutions.

• Omnichannel data integration:

Unification of data from online and offline channels

• Customer Data Platforms (CDPs) as central hubs for customer data

• Identification of cross-device and cross-channel customers

• Challenges: compliance with RODO (data binding), quality of data from different sources

• Average cost of CDP implementation: 350-800K for a medium-sized retailer.

• Product Data Management (PIM):

Centralization of product information in dedicated systems

• Automation of publishing across multiple sales channels

• Digital asset management (DAM) integrated with PIM

• Implemented by many medium and large e-commerce companies

• Real-time Data Processing:

Real-time analysis of user behavior

• Dynamic customization of offerings and content

• Use of stream processing technologies (Apache Kafka, Amazon Kinesis)

• Time from event to response less than 200ms

• Implemented by many e-commerce platforms

Cross-industry trends

Some innovative approaches to data storage and management transcend individual industries to offer universal benefits:

• Data Spaces:

A concept promoted by the European Union (European Data Strategy)

• Secure data sharing environments between organizations

• Standardization of interoperability mechanisms

• Maintain owner control over shared data

• Examples: GAIA-X, International Data Spaces, Catena-X (automotive)

• Potential economic benefits for the EU: €1.3 trillion by 2027 (EC, 2022)

• Active management of data archives:

Intelligent categorization of data by access frequency

• Automatic transfer between storage layers (hot, warm, cold, archive)

• Optimize costs while maintaining availability

• Significantly reduces storage costs

• Implemented by many large Polish enterprises

• Zero-Trust Data Security:

Moving away from a security model based on a trusted internal network

• Verification of any access to data, regardless of the source

• Microsegmentation of data resources

• End-to-end encryption as standard

• Contextual access risk analysis

• Advanced robotics for data management:

Automate routine data lifecycle management tasks

• Intelligent bots for data classification and tagging

• RPA (Robotic Process Automation) in governance processes

• Significant reduction in data management labor

Latest industry trends - summary:

Zero-Trust - a new standard for data security.

Health care - medical data federation, genomic platforms

Financial sector - homomorphic processing, data mesh, tokenization (priority for the vast majority of institutions)

E-commerce - privacy-first analytics, CDP and omnichannel (significantly higher conversion)

Cross-industry trends - data spaces, active archives (significant savings)

Related Terms

Learn key terms related to this article in our cybersecurity glossary:

• Mass Storage System — A mass storage system is a technological infrastructure designed for storing,…
• Cybersecurity — Cybersecurity is a collection of techniques, processes, and practices used to…
• Cybersecurity Incident Management — Cybersecurity incident management is the process of identifying, analyzing,…
• Storage Virtualization — Storage virtualization is a technology that enables consolidation and…
• Compliance — Compliance is the process of ensuring that an organization adheres to…

---

Learn More

Explore related articles in our knowledge base:

• Integrated IBM Solutions for Data Protection and Resilience: IBM Safeguarded Copy and IBM Storage Sentinel
• Cloud or local data storage - A guide to choosing a solution
• Data storage infrastructure audit: Identify vulnerabilities, optimize performance and security
• How IBM Storage Sentinel Works: Detection, Analysis, and Data Recovery Mechanisms
• What Is Storage and How to Choose the Right Data Storage Solution?

---

Explore Our Services

Need cybersecurity support? Check out:

• Security Audits - comprehensive security assessment
• Penetration Testing - identify vulnerabilities in your infrastructure
• SOC as a Service - 24/7 security monitoring

---

Explore Our Products

Solutions mentioned in this article that can help protect your organization:

• IBM Storage Sentinel — IBM

Cybersecurity for Your Industry

Learn more about cybersecurity in your industry:

• Cybersecurity for Healthcare

---

Related topics

See also:

• NIS2 for hospitals — implementation and funding
• Security Audit Pricing Calculator