Skip to content
Knowledge base Updated: November 1, 2026

Penetration Testing Law and Regulations - Key Legal Regulations

Learn what regulations govern penetration tests and what rights and obligations apply in Poland when performing such services.

Marcin Godula Marcin Godula

Penetration testing law and regulations are crucial for ensuring the legality and ethics of cybersecurity-related activities. This article discusses the applicable legal provisions regulating the conduct of penetration tests, including issues of consent, liability, and industry standards. Learn how to conduct tests legally to protect your organization from legal and ethical risk while effectively strengthening its information security.

Table of Contents

What are penetration tests and what is their purpose?

Penetration tests, also known as pentests, are a key element in the cybersecurity toolkit. They are controlled and ethical attempts to break into IT systems, networks or applications, carried out with the consent of the infrastructure owner. The purpose of these tests is to identify and assess potential security vulnerabilities that could be exploited by real cybercriminals.

Pentests simulate real attacks using the same techniques and tools used by hackers. This allows organizations to identify weak points in their systems before they are discovered and exploited by malicious actors. Penetration tests are not limited to technical aspects - they also include assessment of the human factor through social engineering tests, checking employee susceptibility to manipulation.

The main objectives of penetration tests are:

  • Identifying security vulnerabilities in systems and applications

  • Assessing the effectiveness of existing security mechanisms

  • Verifying the organization’s ability to detect and respond to attacks

  • Providing specific recommendations to improve security

  • Meeting regulatory requirements and industry standards

Penetration tests are carried out by qualified specialists, often called ethical hackers. Their task is to think like an attacker but act within strictly defined ethical and legal boundaries. Test results are thoroughly documented in reports that contain not only a description of found vulnerabilities, but also practical recommendations for their removal.

In an era of growing cyber threats, penetration tests are becoming an indispensable element of a comprehensive security strategy for every organization, regardless of its size or industry.

📚 Read the complete guide: Cloud Security / AWS: Public cloud security - AWS, Azure, best practices

Conducting penetration tests, despite their crucial role in ensuring cybersecurity, is subject to a number of legal regulations. This stems from the fact that these tests inherently involve attempts at unauthorized access to IT systems, which under normal circumstances would constitute a crime.

In Poland, there is no single dedicated law regulating penetration testing issues. Instead, we deal with a mosaic of provisions from various legal acts that must be considered when planning and conducting pentests.

Key significance lies in the provisions of the Penal Code, particularly Article 267, which penalizes unauthorized access to information. Conducting a penetration test without proper consent could be classified as a crime under this article.

Another important legal act is the Personal Data Protection Act, implementing on Polish grounds the provisions of the EU General Data Protection Regulation (GDPR). GDPR imposes on data controllers the obligation to ensure appropriate technical and organizational measures to protect personal data. Penetration tests can be seen as one element of fulfilling this obligation.

At the European Union level, in addition to GDPR, significant importance has:

  • NIS Directive (Network and Information Security), which obliges operators of essential services and digital service providers to implement appropriate security measures

  • eIDAS Regulation, concerning electronic identification and trust services

  • DORA Regulation (Digital Operational Resilience Act), which introduces new requirements in cybersecurity for the financial sector

Additionally, depending on the sector, specific industry regulations may apply. For example, in the financial sector, key importance lies in the recommendations of the Polish Financial Supervision Authority (KNF), including Recommendation D regarding management of information technology areas and IT environment security in banks.

It’s also worth mentioning industry standards such as PCI DSS (Payment Card Industry Data Security Standard), which although not universally binding law, are often treated as mandatory in certain sectors and may require conducting regular penetration tests.

Knowledge and compliance with all these regulations is crucial to ensuring the legality and ethics of conducted penetration tests. Violating regulations can result in serious legal consequences, including criminal and administrative liability.

In the Polish legal system, there is no single, comprehensive law regulating issues related to penetration tests. Instead, we deal with a series of provisions scattered across various legal acts that must be considered when planning and conducting pentests.

Key importance lies in the provisions of the Penal Code, particularly:

  • Art. 267 - penalizing unauthorized access to information. This provision states that whoever without authorization obtains access to information not intended for them, by opening a closed letter, connecting to a telecommunications network, or breaking through or bypassing its electronic, magnetic, computer or other special protection, is subject to a fine, restriction of liberty or imprisonment for up to 2 years.

  • Art. 268 - concerning destruction, damage, removal or alteration of a record of significant information.

  • Art. 268a - penalizing destruction, damage, removal, alteration or impeding access to computer data.

  • Art. 269 - relating to disrupting the operation of a computer system or telecommunications network.

Conducting a penetration test without proper consent could be classified as a crime under one or more of these articles.

Another important legal act is the Personal Data Protection Act of May 10, 2018, which implements on Polish grounds the provisions of the EU General Data Protection Regulation (GDPR). This act, together with GDPR, imposes on data controllers the obligation to ensure appropriate technical and organizational measures to protect personal data. Penetration tests can be seen as one element of fulfilling this obligation.

It’s also worth noting the National Cybersecurity System Act of July 5, 2018, which implements the NIS directive. This act imposes on operators of essential services and digital service providers the obligation to implement an information security management system, which may include conducting regular penetration tests.

For some sectors, there are additional, specific regulations. For example, in the financial sector, key importance lies in the recommendations of the Polish Financial Supervision Authority (KNF), including:

  • Recommendation D regarding management of information technology areas and IT environment security in banks
  • Recommendation M regarding operational risk management in banks

Both these recommendations, although not universally binding law, are treated by financial institutions as binding and may require conducting regular penetration tests.

In summary, although there is no single law regulating penetration tests in Poland, there are a number of provisions that must be considered when planning and conducting them. Key is obtaining proper consent to conduct tests and complying with rules for protecting personal data and other sensitive information.

Are penetration tests required by law?

The issue of legal requirement to conduct penetration tests in Poland is not unambiguous and requires analysis of various legal acts and industry regulations. Generally, there is no single, universally binding legal provision that explicitly requires conducting penetration tests for all entities. However, in practice, regular security testing of IT systems often becomes necessary to meet general requirements for ensuring confidentiality, integrity and availability of processed data.

The General Data Protection Regulation (GDPR), which applies in Poland as part of EU law, imposes on data controllers the obligation to implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk. Art. 32 GDPR mentions, among others, “regular testing, assessment and evaluation of the effectiveness of technical and organizational measures to ensure processing security.” Although GDPR does not explicitly mention penetration tests, in practice they are often recognized as one of the most effective methods of fulfilling this requirement.

The National Cybersecurity System Act of July 5, 2018, implementing the NIS directive, imposes on operators of essential services and digital service providers the obligation to implement an information security management system. Within this system, these entities are obliged to regularly test, measure and evaluate the effectiveness of technical and organizational measures ensuring information systems security. Penetration tests are one of the tools that can be used to meet this requirement.

In the financial sector, which is subject to special regulations, the requirement to conduct penetration tests is more explicit. The Polish Financial Supervision Authority (KNF) in its Recommendation D regarding management of information technology areas and IT environment security in banks explicitly recommends conducting regular penetration tests. Although KNF recommendations are not formally universally binding law, in practice they are treated by financial institutions as binding.

Similarly, in the case of entities processing payment card data, the PCI DSS (Payment Card Industry Data Security Standard) standard requires conducting regular penetration tests. Although PCI DSS is not law in the strict sense, compliance with it is often required by business partners and payment organizations.

It’s also worth noting that in some cases, conducting penetration tests may be required as part of public procurement procedures, especially for systems processing sensitive or critical data for state functioning.

In summary, although penetration tests are not explicitly required by law for all entities, in many cases they become de facto mandatory due to the need to meet general information security requirements. Additionally, in some sectors, such as finance, the requirement to conduct penetration tests is more explicit. In any case, regularly conducting penetration tests is recognized as good practice in cybersecurity.

Which regimes require testing, and what they expect

The phrase “regulatory requirements” hides an important detail: individual regimes differ considerably in what they demand.

RegimeWhat it requiresDoes it prescribe a test method
PCI DSSPenetration testing at defined intervals (at least once a year) and after a significant change in the CDE, plus segmentation testingYes — a penetration test explicitly
ISO/IEC 27001Management of technical vulnerabilities and evidence that controls are verifiedNo
NIS2 and the Polish National Cybersecurity System ActPolicies and procedures to assess the effectiveness of cybersecurity risk management measures; under the Polish act — a security audit of the system at least once every 3 years (Article 15(1))No
DORAA testing programme with a defined frequency: systems supporting critical functions at least once a year (Article 24(6)), and for entities designated by the competent authority also TLPT at least every 3 years (Article 26(1))For TLPT, yes; TIBER-EU is the methodological reference point
GDPRRegular testing, assessing and evaluating the effectiveness of technical and organisational measures (Article 32)No

The common denominator is that each of these regimes wants evidence of a repeatable activity, not a single report. The test schedule for specific system classes is described in how often should you run penetration tests.

What are international regulations regarding penetration tests?

On the international arena, there are a number of regulations that directly or indirectly relate to penetration testing issues. Although they don’t always explicitly require conducting pentests, they often impose obligations whose fulfillment in practice requires regular security testing of IT systems.

In the European Union context, key significance have the following regulations:

  • General Data Protection Regulation (GDPR): GDPR, in force since 2018, imposes on data controllers the obligation to implement appropriate technical and organizational measures to ensure security of personal data processing. Art. 32 GDPR requires, among others, “regular testing, measurement and evaluation of effectiveness of technical and organizational measures to ensure processing security.” Although GDPR doesn’t explicitly mention penetration tests, they are widely recognized as an effective method of fulfilling this requirement.

  • NIS2 Directive (Network and Information Security 2): NIS2, which is to be implemented by member states by October 2024, significantly expands the scope of entities covered by cybersecurity regulations. This directive emphasizes regular conducting of cybersecurity risk assessments and implementation of appropriate technical and organizational measures. Penetration tests are explicitly mentioned as one of the recommended tools for assessing effectiveness of cybersecurity measures.

  • eIDAS Regulation: The eIDAS Regulation, concerning electronic identification and trust services, imposes on trust service providers the obligation to implement appropriate technical and organizational measures to manage risks related to security of provided services. Regular security testing, including penetration tests, is one way to fulfill this obligation.

  • DORA Regulation (Digital Operational Resilience Act): DORA, which is to come into force in 2025, introduces new requirements in cybersecurity for the financial sector. It imposes on financial institutions the obligation to regularly test their ICT systems, including conducting penetration tests, to identify potential weaknesses and ensure resilience to cyber attacks.

Beyond EU regulations, significant importance also have standards and guidelines developed by international organizations, such as:

  • ISO (International Organization for Standardization) - particularly standards from the ISO/IEC 27000 series concerning information security management. The ISO/IEC 27001 standard recommends regularly conducting penetration tests as an element of information security management system.

  • NIST (National Institute of Standards and Technology) - particularly the Framework for Improving Critical Infrastructure Cybersecurity, which recommends regular security testing of systems, including conducting penetration tests.

  • OWASP (Open Web Application Security Project) - an organization developing guidelines and standards in web application security. OWASP recommends regularly conducting penetration tests as an element of the process of developing and maintaining secure applications.

It’s also worth mentioning sectoral security standards, such as:

  • PCI DSS (Payment Card Industry Data Security Standard) - payment card data security standard, which requires conducting regular penetration tests for systems processing payment card data.
  • HIPAA (Health Insurance Portability and Accountability Act) - American law regulating medical data processing, which requires conducting regular risk assessments, including penetration tests.

Although the above standards are not legally binding to the same degree as EU regulations, in practice they are often treated as mandatory in certain sectors and may be required by business partners or insurers.

In summary, although there is no single, universal international regulation concerning penetration tests, a number of regulations and standards, particularly in the European Union, impose obligations whose fulfillment in practice requires regular security testing of systems, including conducting pentests. Additionally, international standards and guidelines, although not always legally binding, establish good practices in cybersecurity that are increasingly becoming de facto mandatory in certain sectors.

Conducting penetration tests without the system owner’s consent is not only unethical but also illegal. In Poland, as in many other countries, unauthorized attempts to gain access to IT systems are treated as a crime.

According to the Polish Penal Code, particularly Article 267 § 1 and 2, unauthorized access to a computer system or breaking through its protections is punishable. The penalty for such action may include a fine, restriction of liberty, or even imprisonment for up to 2 years. It’s worth emphasizing that the act of obtaining access to a system without authorization is already punishable, even if no protections were broken through. This means that even if a pentester finds a vulnerability without actually breaking into the system, their actions may be considered illegal if they did not have proper consent.

To legally conduct penetration tests, it’s necessary to obtain explicit consent from the system owner. This consent should be:

  • Written - preferably in the form of an agreement specifying the scope of tests.

  • Detailed - precisely defining which systems can be tested and by what methods.

  • Temporal - specifying the exact period during which tests can be conducted.

It’s worth noting that even in the case of finding vulnerabilities with good intentions (e.g., desire to report a bug to the author), action without consent may be considered illegal. Therefore, many companies and organizations introduce bug bounty programs or responsible disclosure policies that define safe and legal ways to report found vulnerabilities.

In the international context, particularly in light of the NIS2 directive, which emphasizes regular security assessments of systems, it can be expected that more and more organizations will formally incorporate penetration tests into their security procedures. Nevertheless, even in such cases, tests must be conducted according to established procedures and with explicit consent of the system owner.

In summary, penetration tests always require the system owner’s consent. Conducting them without such consent can result in serious legal consequences, regardless of the intentions of the person conducting the tests. Therefore, professional pentesters always act on the basis of formal agreements and according to established rules, which ensures the legality of their actions and protects both themselves and the tested organizations.

Obtaining legal consent to conduct penetration tests is crucial to ensuring legal compliance and avoiding potential legal consequences. This process should be carefully documented and include the following steps:

  • Identifying the system owner: The first step is to determine who is the owner of the system to be tested. In the case of an organization, this may be the person responsible for IT security, IT director or another decision-maker.

  • Making contact: Next, you should contact the system owner, preferably in written form (e.g., email), explaining the purpose and scope of proposed penetration tests.

  • Presenting details: In communication with the system owner, you should clearly specify which systems are to be tested, by what methods and in what time period. It’s also worth presenting the qualifications and experience of persons who will conduct the tests.

  • Agreeing on conditions: Next, you should agree on detailed conditions for conducting tests, including procedures for handling found vulnerabilities, method of reporting results and confidentiality rules.

  • Signing an agreement: All arrangements should be formalized in the form of a written agreement. The agreement should precisely specify the scope of tests, period of their conduct, obligations of both parties and issues of liability and confidentiality.

  • Obtaining written consent: Before starting tests, you should obtain written consent from the system owner. This consent should unequivocally state that the pentester is authorized to conduct tests under specified conditions.

  • Documentation: The entire process of obtaining consent, together with all arrangements and signed documents, should be carefully documented. This documentation may prove crucial in case of any doubts or legal disputes.

It’s worth emphasizing that even in the case of internal penetration tests (conducted by organization employees), obtaining formal consent is good practice. This helps avoid misunderstandings and ensures that tests are conducted in a controlled manner and in accordance with the organization’s security policy.

In the case of tests conducted by external entities (e.g., consulting firms), the consent obtaining process may be more formal and include additional elements, such as non-disclosure agreements (NDA) or service level agreements (SLA).

In summary, obtaining legal consent to conduct penetration tests requires careful planning, communication and documentation. This process should include clear definition of test scope, agreement on conditions, signing a formal agreement and obtaining written consent. Such an approach ensures legal compliance, protects all involved parties and creates a solid foundation for effective and ethical conduct of penetration tests.

Unauthorized penetration tests, i.e., attempts to gain access to IT systems without their owner’s consent, can entail serious legal consequences. Depending on jurisdiction and circumstances, these consequences may include criminal liability, civil liability, as well as professional consequences.

  • Criminal liability: In most countries, including Poland, unauthorized access to IT systems is a crime. According to the Polish Penal Code (Article 267 § 1 and 2), obtaining unauthorized access to a system is punishable by a fine, restriction of liberty, or even imprisonment for up to 2 years. If the perpetrator acts to obtain material benefit or cause damage to another person, the penalty may be more severe - up to 3 years imprisonment (Article 267 § 3).

  • Civil liability: Regardless of criminal liability, a person conducting unauthorized penetration tests may also bear civil liability. The system owner can claim compensation for any damages caused by the tests, including costs related to restoring the system to its previous state, data loss or business interruptions.

  • Copyright infringement: In some cases, unauthorized penetration tests may also violate copyrights. This applies to situations where the pentester obtains unauthorized access to application source code or other materials protected by copyright.

  • Violation of data protection regulations: If during unauthorized tests access to personal data is obtained, this may constitute a violation of data protection regulations, such as GDPR. In such a case, in addition to criminal and civil liability, the perpetrator may also be subject to administrative penalties imposed by data protection authorities.

  • Professional consequences: For professional pentesters, conducting unauthorized tests can have serious professional consequences. Such action is contrary to professional ethics and can lead to loss of reputation, and even a ban from practicing the profession.

It’s worth noting that the legal consequences of unauthorized penetration tests can be severe even if the pentester acts in good faith (e.g., wanting to report a found vulnerability). That’s why it’s so important to always obtain formal consent before starting tests.

At the same time, many organizations and companies implement bug bounty programs or responsible disclosure policies, which enable reporting found vulnerabilities in a safe and legal way. Using these mechanisms allows avoiding potential legal consequences while contributing to improving system security.

In summary, unauthorized penetration tests can result in serious legal consequences, including criminal and civil liability. Professional pentesters should always act within the law, obtaining formal consent to conduct tests. In case of finding vulnerabilities without prior consent, the best solution is to use bug bounty programs or responsible disclosure policies, if they are available for the given system.

How does GDPR affect penetration tests?

The General Data Protection Regulation (GDPR) has a significant impact on how penetration tests are conducted, particularly in the context of systems processing personal data. GDPR introduces a number of requirements and principles that must be considered when planning and implementing penetration tests:

  • Data minimization: Under the data minimization principle, pentesters should avoid accessing real personal data during tests, unless it’s absolutely necessary. It’s recommended to use test or anonymized data.

  • Consent to process: If during penetration tests it’s necessary to process real personal data, you must ensure that there’s an appropriate legal basis for their processing. This may require obtaining additional consent from the data controller.

  • Data security: GDPR requires ensuring an appropriate level of personal data security. Pentesters must use appropriate technical and organizational measures to protect data they access during tests.

  • Confidentiality: All information obtained during tests, including potential personal data, must be treated as strictly confidential. It’s necessary to implement appropriate procedures and confidentiality agreements.

  • Breach reporting: In case of detecting an actual personal data protection breach during tests, there may be an obligation to report this fact to the supervisory authority within 72 hours. Reporting procedures should be established before starting tests.

  • Right to be forgotten: After completing tests, all personal data obtained during them should be deleted, unless there’s a justified basis for their further storage.

  • Documentation: GDPR requires maintaining documentation concerning personal data processing. Pentesters should maintain detailed documentation of their activities, especially if real personal data processing occurs during tests.

  • Data Protection Impact Assessment (DPIA): In some cases, before conducting penetration tests it may be necessary to perform a data protection impact assessment, especially if tests may involve high risk to the rights and freedoms of natural persons.

  • Cross-border data transfers: If penetration tests are conducted by an entity from a third country (outside EU/EEA), you must ensure that GDPR requirements for international data transfers are met.

  • Accountability: GDPR introduces the principle of accountability, which means organizations must be able to demonstrate compliance with regulations. This also applies to the penetration testing process.

Considering GDPR requirements in the penetration testing process requires careful planning and implementation of appropriate procedures. Key is:

  • Conducting risk analysis before starting tests

  • Establishing clear rules regarding access to personal data and their processing

  • Implementing appropriate security measures

  • Maintaining detailed documentation

  • Training pentesters in GDPR requirements

In summary, GDPR has a significant impact on how penetration tests are conducted, introducing additional requirements and restrictions. At the same time, regularly conducting penetration tests can be seen as an element of fulfilling the obligation to ensure data security arising from GDPR. Key is finding a balance between test effectiveness and privacy and personal data protection.

Data protection during penetration tests is a key aspect that must be considered from both an ethical and legal perspective. Legal requirements in this area arise mainly from GDPR and national personal data protection regulations. Here are the most important requirements:

  • Legal basis for processing: Before starting penetration tests, you must ensure that there’s an appropriate legal basis for processing personal data. This may be the data controller’s consent, realization of a legitimate interest (e.g., ensuring system security) or fulfilling a legal obligation.

  • Data minimization: Under the data minimization principle, during penetration tests you should process only data that are necessary to achieve the test purpose. It’s recommended to use test or anonymized data, and if that’s impossible - limit access to real personal data to a minimum.

  • Purpose limitation: Personal data obtained during tests may be used exclusively for the purpose of conducting tests and improving system security. Using them for any other purpose would violate the purpose limitation principle.

  • Data security: Pentesters must implement appropriate technical and organizational measures to ensure security of processed data. This includes, among others, data encryption, access control, secure storage and data transmission.

  • Confidentiality: All information obtained during tests, including potential personal data, must be treated as strictly confidential. It’s necessary to sign appropriate confidentiality agreements.

  • Storage limitation: After completing tests, all personal data obtained during them should be promptly deleted, unless there’s a justified basis for their further storage.

  • Documentation: You should maintain detailed documentation of all activities related to personal data processing during tests. This documentation should include, among others, processing purpose, scope of processed data, applied security measures.

  • Informing data subjects: In some cases, it may be necessary to inform persons whose data are processed during tests about the fact and purpose of this processing. This may be particularly important if tests include systems processing sensitive data.

  • Cross-border data transfers: If penetration tests are conducted by an entity from a third country (outside EU/EEA), you must ensure appropriate safeguards for international data transfer, in accordance with GDPR requirements.

  • Data Protection Impact Assessment (DPIA): In case of penetration tests that may involve high risk to the rights and freedoms of natural persons, it may be necessary to conduct a data protection impact assessment before starting tests.

  • Breach reporting: In case of detecting an actual personal data protection breach during tests, there may be an obligation to report this fact to the supervisory authority within 72 hours. Reporting procedures should be established before starting tests.

  • Right of access and objection: You should remember that persons whose data are processed during tests may have the right to access these data and the right to object to their processing. It’s necessary to establish procedures for handling such requests.

Meeting these requirements requires careful planning and implementation of appropriate procedures before starting penetration tests. Key is:

  • Conducting risk analysis and data protection impact assessment

  • Establishing clear rules regarding access to personal data and their processing

  • Implementing appropriate security measures

  • Training pentesters in data protection requirements

  • Regular audits and procedure reviews

In summary, data protection during penetration tests requires a comprehensive approach, considering both technical and organizational aspects of security. Compliance with these requirements not only ensures legal compliance but also builds customer trust and protects the company’s reputation conducting tests.

The issue of legal liability for damages arising during penetration tests is complex and depends on many factors, such as scope and conditions of the agreement, applied precautionary measures and applicable legal provisions. Key significance here have provisions of the civil code, and in some cases also the penal code.

  • Contractual liability: In most cases, liability for damages during penetration tests will be regulated by the agreement between the pentester and the client. This agreement should detail the scope of tests, permissible methods, procedures for handling detected vulnerabilities and issues of liability for potential damages.

  • Due diligence: The pentester is obliged to act with due diligence, according to established procedures and good industry practices. If damage resulted from negligence or gross negligence on the pentester’s part, they may bear liability on general principles.

  • Tort liability: Regardless of contractual provisions, the pentester may bear tort liability for damages caused by an unlawful act (Article 415 of the Civil Code). This applies to situations where damage resulted from unlawful, culpable action remaining in causal connection with the damage.

  • Criminal liability: In extreme cases, when the pentester’s actions fulfill the features of a crime (e.g., unauthorized system access, sabotage, industrial espionage), they may also bear criminal liability based on penal code provisions.

  • Limitation of liability: The agreement between the pentester and client may contain clauses limiting the pentester’s liability for certain types of damages (e.g., lost profits) or establishing an upper limit of financial liability. Such clauses are generally permissible, as long as they’re not contrary to the nature of the relationship, law or principles of social coexistence.

  • Insurance: Professional pentesters often use liability insurance, which can cover potential compensation claims related to their activities. Conditions and scope of such insurance should be adapted to the specifics of conducted tests.

  • Client’s liability: In some cases, liability for damages may lie with the client ordering tests. This applies to situations where damage resulted from irregularities on the client’s part, e.g., providing incorrect information, non-disclosure of important facts or not ensuring an appropriate test environment.

  • Force majeure: The pentester may be released from liability if damage resulted from force majeure circumstances, i.e., an external, unforeseeable and impossible to prevent event (e.g., terrorist attack, natural disaster).

  • Obligation to minimize damages: Both the pentester and the client have an obligation to take reasonable actions to minimize damages in case of their occurrence. This may include immediately stopping tests, notifying appropriate persons, implementing remedial measures.

  • Documentation: Detailed documentation of conducted tests, including description of applied methods, encountered problems and taken actions, may be crucial in case of a dispute concerning liability for damages.

In summary, the issue of legal liability for damages during penetration tests is complex and depends on many factors. Key significance here has careful formulation of the agreement, compliance with established procedures and acting with due diligence. In case of doubts, it’s worth consulting with a lawyer specializing in IT law and data protection.

What are the principles of civil and criminal liability in the context of penetration tests?

Penetration tests, as activities involving controlled “attacking” of IT systems, are associated with potential civil and criminal liability. The principles of this liability arise from civil and criminal law provisions, as well as contractual provisions between the pentester and the client.

Civil liability:

  • Basis of liability: The pentester may bear civil liability for damages caused during penetration tests based on provisions on contractual liability (if damage resulted from non-performance or improper performance of the agreement) or tort liability (if damage resulted from an unlawful act).

  • Prerequisites for liability: To attribute civil liability to the pentester, the following prerequisites must be met: occurrence of damage, event causing damage (non-performance/improper performance of agreement or unlawful act), causal connection between the event and damage, and pentester’s fault (in case of tort liability).

  • Scope of liability: The pentester generally is liable for damage in full amount, including both actual losses (damnum emergens) and lost profits (lucrum cessans). However, the scope of liability may be limited by contractual provisions.

  • Due diligence: The pentester is obliged to act with due diligence, according to established procedures and good industry practices. Exercising due diligence may release them from liability for damages that occurred despite taking reasonable precautionary measures.

Criminal liability:

  • Basis of liability: The pentester may bear criminal liability if their actions fulfill the features of a crime specified in the penal code or other laws. In the context of penetration tests, most important are crimes against information protection (Chapter XXXIII of the Penal Code), such as unauthorized access to a computer system (Article 267), computer sabotage (Article 269) or disrupting system operation (Article 269a).

  • Exclusion of liability: As a rule, acting with the consent of the authorized person (in this case - the client ordering tests) excludes unlawfulness of the act and thus criminal liability. However, this consent must be given by a person actually authorized and cover the specific scope of actions.

  • Intent: Most computer crimes require acting with direct intent, i.e., willingness to commit a prohibited act. A pentester acting in good faith, to improve system security, generally does not bear criminal liability.

  • Social harmfulness of the act: Even if the pentester’s actions formally fulfill the features of a crime, they may avoid criminal liability if the social harmfulness of the act is negligible (Article 1 § 2 of the Penal Code). This applies to situations where tests were conducted within the agreed scope, with due diligence and did not cause significant damage.

In summary, key to avoiding civil and criminal liability in the context of penetration tests is:

  • Obtaining unequivocal consent of the authorized entity to conduct tests

  • Precise definition of scope and conditions of tests in the agreement

  • Acting with due diligence, according to established procedures

  • Reliable documentation of conducted actions

  • Immediate response in case of irregularities

Compliance with these principles allows minimizing legal risk associated with penetration tests, although it doesn’t eliminate it completely. In case of doubts, it’s always worth consulting with a lawyer specializing in IT law and data protection.

Reporting results of penetration tests is a crucial stage of the process that is subject to certain legal requirements and industry standards. Although there is no single, universal set of regulations governing this issue, several important aspects can be distinguished:

  • Information confidentiality: Reports from penetration tests contain sensitive information about system vulnerabilities, therefore they are subject to strict protection. According to the confidentiality principle arising from GDPR and other data protection regulations, access to reports should be limited only to authorized persons.

  • Report scope: The report should contain all relevant information about conducted tests, detected vulnerabilities and recommendations, but at the same time should not disclose more information than necessary. Particular caution should be exercised regarding information that may constitute a trade secret.

  • Personal data protection: If during tests access to personal data was obtained, the report should not contain such data. Any examples or evidence confirming found vulnerabilities should be anonymized.

  • Obligation to report breaches: In case of detecting an actual personal data protection breach during tests, there may be an obligation to report this fact to the supervisory authority (UODO) within 72 hours, according to Article 33 GDPR. The test report should contain information about such events and taken actions.

  • Industry standards: Although not legally binding, standards such as OWASP Testing Guide or PTES (Penetration Testing Execution Standard) define good practices in reporting penetration test results. Compliance with these standards may be required by clients or industry regulators.

  • Sectoral requirements: In some sectors, e.g., financial or energy, there may be additional requirements for reporting penetration test results. For example, banks may be obliged to present test results to financial supervision authorities.

  • Legal liability: The report should clearly define the scope of conducted tests, applied methods and limitations. This may be significant in case of potential legal disputes concerning liability for undetected vulnerabilities.

  • Report storage: You should establish rules for storing reports, considering legal requirements (e.g., GDPR) and business needs. Reports should be stored securely, and after the established period expires - securely deleted.

  • Right of access: In some cases, persons whose data were processed during tests may have the right to access information about this processing. The report should be prepared in a way enabling realization of this right without disclosing sensitive information about systems.

  • Contractual requirements: The agreement for conducting penetration tests should specify requirements for reporting, including report format, deadline for its delivery, confidentiality rules and potential restrictions on information dissemination.

  • Information classification: In case of tests conducted for public institutions or entities processing classified information, the report may be subject to classification according to the Classified Information Protection Act.

  • Report language: In case of reports prepared for foreign or international entities, you must consider legal requirements regarding documentation language (e.g., necessity of translation into the official language of a given country).

In summary, reporting penetration test results requires considering many legal and regulatory aspects. Key is maintaining a balance between providing full and useful information and protecting sensitive data and information. A professional approach to reporting not only ensures compliance with legal requirements but also builds customer trust and strengthens the pentester’s position in the market.

In Poland, as in many other countries, there are no uniform, legally regulated requirements regarding qualifications of persons conducting penetration tests. Nevertheless, there are certain regulations and industry standards that indirectly affect requirements placed on pentesters:

  • Lack of formal legal requirements: In Polish law, there are no provisions that would explicitly specify required qualifications for pentesters. There’s also no state certification system in this field.

  • Requirements arising from GDPR: Although GDPR doesn’t refer directly to pentester qualifications, Article 32 imposes the obligation to ensure an appropriate level of personal data processing security. It can be argued that this includes using services of appropriately qualified security specialists.

  • Sectoral regulations: In some sectors, e.g., financial, there may be more detailed guidelines regarding qualifications of persons conducting security audits, including penetration tests. For example, the Polish Financial Supervision Authority (KNF) may require tests to be conducted by persons with appropriate experience and certificates.

  • Industry certificates: Although not legally required, industry certificates are often recognized as confirmation of pentester qualifications. Popular certificates include CEH (Certified Ethical Hacker), OSCP (Offensive Security Certified Professional), CREST (Council of Registered Ethical Security Testers).

  • Contractual requirements: Many organizations, especially large corporations and public institutions, specify in their procedures or agreements minimum requirements regarding pentester qualifications. They may include possession of specific certificates, professional experience or relevant education.

  • Industry standards: Organizations such as OWASP (Open Web Application Security Project) or PTES (Penetration Testing Execution Standard) develop standards and guidelines for conducting penetration tests. Although not legally binding, they’re often treated as a reference point when assessing pentester qualifications.

  • Civil liability: In the context of civil liability, the pentester may be assessed in terms of due diligence in performing their duties. Lack of appropriate qualifications could be an argument for not exercising due diligence in case of potential damages.

  • Classified information protection: In case of penetration tests of systems processing classified information, pentesters may be required to have appropriate security clearances, according to the Classified Information Protection Act.

  • EU regulations: Although not referring directly to pentester qualifications, regulations such as NIS2 (Network and Information Security Directive 2) emphasize the need to ensure appropriate competencies in cybersecurity.

  • Industry self-regulation: In Poland, there are industry organizations bringing together cybersecurity specialists, working on standards and good practices in penetration testing. Although their guidelines don’t have legal force, they may influence the shaping of market standards.

In summary, although there are no uniform, legally regulated requirements regarding pentester qualifications in Poland, in practice their competencies are verified through a combination of industry certificates, professional experience and compliance with recognized standards. Organizations using pentester services should carefully verify their qualifications, considering the specifics of tested systems and applicable sectoral regulations. As cybersecurity regulations develop, more formalized requirements regarding qualifications of persons conducting penetration tests can be expected in the future.

Social engineering tests constitute an important element of comprehensive penetration tests, however they’re associated with a number of legal and ethical challenges. Unlike traditional technical tests, social engineering tests often include direct interactions with organization employees, which may lead to violation of their privacy or employment rights.

From a legal point of view, key significance has obtaining appropriate consent to conduct social engineering tests. This consent should come from persons authorized to represent the organization, usually top management or the board. It’s important that the scope of this consent be precisely defined and cover all planned activities within social engineering tests.

One of the main legal challenges associated with social engineering tests is personal data protection. According to GDPR, processing employee personal data within social engineering tests requires an appropriate legal basis. Most often this will be the legitimate interest of the data controller (Article 6 paragraph 1 letter f GDPR), which in this case is improving organization security. Nevertheless, it’s necessary to conduct a balancing test to ensure that the rights and freedoms of persons whose data concern don’t outweigh the controller’s interest.

Another important legal aspect is the issue of confidentiality of information obtained during social engineering tests. Pentesters may gain access to sensitive business information or employees’ personal information. Therefore, it’s necessary to include appropriate confidentiality clauses in the test conduct agreement, as well as implement procedures for secure storage and deletion of collected data after completing tests.

Social engineering tests may also raise doubts from the employment law perspective. Employees subjected to tests may feel manipulated or deceived, which may lead to deterioration of workplace atmosphere or even employee claims. To minimize this risk, it’s recommended that the organization conducting tests have a clearly defined policy regarding social engineering tests, and employees be generally informed about the possibility of conducting such tests (without providing specific dates or methods).

It’s also worth noting potential legal consequences in case social engineering tests exceed the agreed scope or lead to unintended damages. For example, if as a result of a test there’s a leak of real personal data or confidential business information, the organization conducting the test may bear legal liability for such a breach.

In the international context, conducting social engineering tests may be additionally complicated due to differences in employment law and data protection regulations in different countries. Organizations operating on an international scale must be particularly careful and ensure that their approach to social engineering tests complies with local regulations in all jurisdictions where they operate.

In summary, conducting social engineering tests within pentests requires careful planning and consideration of a number of legal aspects. Key is obtaining appropriate consent, personal data protection, maintaining information confidentiality and respecting employment rights. Organizations deciding to conduct such tests should cooperate with legal experts to ensure full compliance with applicable regulations and minimize potential legal risk.

Is the financial sector subject to additional regulations regarding penetration tests?

The financial sector, due to its crucial role in the economy and sensitivity of processed data, is subject to particularly rigorous regulations in IT security, including penetration tests. In Poland and the European Union, there are a number of regulations and guidelines that directly or indirectly refer to penetration testing issues in financial institutions.

The Polish Financial Supervision Authority (KNF) plays a key role in regulating IT security issues in the financial sector in Poland. KNF has issued a number of recommendations that refer to penetration tests. Particularly important is Recommendation D, concerning management of information technology areas and IT environment security in banks. This recommendation explicitly requires banks to conduct regular penetration tests as an element of operational risk management.

Moreover, KNF Recommendation M, concerning operational risk management in banks, also indirectly refers to penetration testing issues, indicating the need for regular assessment and testing of IT systems for security.

At the European Union level, key significance has the NIS2 Directive (Network and Information Security 2), which is to be implemented by member states by October 2024. This directive covers financial institutions in its scope and imposes on them the obligation to implement appropriate technical and organizational measures to manage cybersecurity risk. Although NIS2 doesn’t explicitly mention penetration tests, in practice they’re recognized as an important element of fulfilling the directive’s requirements.

Another important legal act is the DORA Regulation (Digital Operational Resilience Act), which will come into force in 2025. DORA introduces detailed requirements regarding cybersecurity for the financial sector, including the obligation to conduct regular operational resilience tests, which may include penetration tests.

It’s also worth mentioning the PCI DSS (Payment Card Industry Data Security Standard) standard, which although not formally a legal act, is widely used in the financial sector. PCI DSS requires conducting regular penetration tests for systems processing payment card data.

The European Central Bank (ECB) has also issued cybersecurity guidelines for financial institutions, which emphasize the importance of regular penetration tests. ECB promotes the TIBER-EU (Threat Intelligence-based Ethical Red Teaming) framework, which defines standards for conducting advanced penetration tests in the financial sector.

Financial institutions must also consider general personal data protection regulations, particularly GDPR. Although GDPR doesn’t refer directly to penetration tests, it imposes on financial institutions the obligation to ensure an appropriate level of security for processed personal data, which in practice often requires conducting regular security tests.

In summary, the financial sector is subject to much more rigorous and detailed regulations regarding penetration tests than most other sectors of the economy. Financial institutions must not only comply with general cybersecurity regulations but also meet additional requirements imposed by sectoral regulators. Regularly conducting penetration tests has become a de facto standard in the financial sector, and their scope and frequency are often strictly defined by regulations and industry guidelines. Therefore, financial institutions must place particular emphasis on planning and implementing penetration tests, ensuring their compliance with numerous regulatory requirements.

Penetration tests in cloud environments are associated with a number of specific legal challenges, arising from the nature of cloud services and relationships between the cloud service provider (CSP), client and pentester. Key significance here have principles of security responsibility in the shared responsibility model, which is commonly used by cloud service providers.

In the shared responsibility model, the CSP is responsible for the security of the cloud infrastructure itself (security of the cloud), while the client is responsible for the security of their data and applications operating in the cloud (security in the cloud). In the context of penetration tests, this means that the scope and conditions of tests must be precisely agreed between all involved parties, considering the division of responsibilities.

Key significance here has the cloud service provider’s policy regarding penetration tests. Many large CSPs, such as Amazon Web Services (AWS), Microsoft Azure or Google Cloud Platform (GCP), have detailed rules regulating conducting penetration tests in their environments. These rules specify, among others, permissible testing methods, required notifications and consents, as well as restrictions aimed at protecting cloud infrastructure and other clients.

For example, AWS requires clients wanting to conduct penetration tests in their cloud environment to submit an application in advance and obtain formal consent. This consent is granted for a specific scope of tests and duration. AWS also reserves the right to monitor tests and intervene if tests threaten the stability or security of cloud services.

Similar rules apply to other large CSPs. Microsoft Azure requires notification of planned penetration tests and reserves the right to suspend client account in case of rule violations. Google Cloud Platform also requires prior notification and obtaining consent for tests.

In addition to rules specific to a given CSP, penetration tests in the cloud are also subject to general regulations concerning cybersecurity and data protection. In the European Union, key significance here have GDPR and the NIS2 directive, which impose on organizations the obligation to ensure an appropriate level of security for processed data, regardless of whether they’re processed locally or in the cloud.

In the case of penetration tests in the cloud, ensuring personal data protection is particularly important. Pentesters must follow the data minimization and purpose limitation principles, and also ensure security and confidentiality of all data obtained during tests.

Another important aspect is the issue of cross-border data transfer. In case of using services from CSPs outside EU/EEA, organizations must ensure that data transfer to a third country occurs in accordance with GDPR requirements, e.g., based on standard contractual clauses or adequacy decisions.

In summary, conducting penetration tests in cloud environments requires careful planning and consideration of a number of specific legal aspects. Key significance here has knowledge and compliance with cloud service provider’s rules regarding penetration tests, as well as ensuring compliance with general regulations concerning cybersecurity and data protection. Organizations planning penetration tests in the cloud should closely cooperate with the CSP and legal experts to ensure that tests are conducted in a legal, ethical manner and in accordance with industry best practices.

What are the regulations for penetration tests in critical infrastructure?

Critical infrastructure, including systems and resources crucial for state and society functioning, such as energy, transport, healthcare or financial systems, is subject to particularly rigorous regulations in cybersecurity, including penetration tests. This stems from potentially serious consequences that could result from security breach of such systems.

In Poland, the key legal act regulating cybersecurity issues of critical infrastructure is the National Cybersecurity System Act of July 5, 2018. This act implements on Polish legal grounds the EU NIS (Network and Information Security) directive. According to the act, operators of essential services (including critical infrastructure operators) are obliged to implement appropriate technical and organizational measures to manage cybersecurity risk. These measures should be proportional to identified risk and include, among others, regular testing, audits and monitoring of systems for security.

Although the act doesn’t explicitly mention penetration tests, in practice they’re recognized as one of the key elements of fulfilling statutory obligations. Penetration tests allow identification of potential weaknesses and system vulnerabilities before they’re exploited by real attackers.

The act also imposes on operators of essential services the obligation to report cybersecurity incidents to appropriate CSIRT (Computer Security Incident Response Team) of national level. In case of detecting serious vulnerabilities or security breaches during penetration tests, critical infrastructure operators must immediately notify appropriate authorities.

At the European Union level, key significance has the NIS2 directive, which is to replace the current NIS directive. NIS2 expands the scope of entities covered by cybersecurity regulations, including critical infrastructure operators, and introduces more rigorous requirements regarding risk management and incident reporting.

Additionally, some sectors of critical infrastructure may be subject to additional, specific regulations. For example, the energy sector is subject to provisions of the Energy Law and implementing regulations, which impose additional obligations in cybersecurity.

Conducting penetration tests in critical infrastructure is also associated with a number of practical and ethical challenges. Due to the critical importance of such systems, tests must be conducted with utmost care and caution to avoid any disruptions in operation of services crucial for society.

Moreover, due to sensitivity of information concerning critical infrastructure, penetration tests in this area often are subject to strict confidentiality requirements. Pentesters may be required to obtain appropriate security clearances and comply with rigorous procedures for handling sensitive information.

In summary, conducting penetration tests in critical infrastructure is subject to particularly rigorous legal regulations, arising from the crucial importance of such systems for state and society security. Critical infrastructure operators are obliged to regularly test and monitor their systems for security, and penetration tests are recognized as a key element of fulfilling these obligations. At the same time, conducting tests in critical infrastructure requires utmost care, caution and maintaining confidentiality to ensure that tests don’t disrupt operation of essential services and don’t violate security of sensitive information.

What are the sanctions for violating penetration testing regulations?

Violating provisions concerning penetration tests can entail various sanctions, both criminal and administrative. It’s worth emphasizing that these sanctions may concern not only pentesters but also organizations ordering tests if they didn’t exercise due diligence in their planning and supervision.

In the context of criminal liability, key significance have penal code provisions concerning crimes against information protection. Article 267 of the Penal Code penalizes unauthorized access to information, including to a computer system. This type of act is punishable by a fine, restriction of liberty or imprisonment for up to 2 years. In case the perpetrator acts to obtain material benefit or cause damage to another person, the penalty may increase to 3 years imprisonment.

Moreover, Article 268a of the Penal Code provides for imprisonment for up to 3 years for destruction, damage, removal or alteration of computer data of particular importance for country defense, communication security, functioning of government administration, another state authority or institution or local government. This is particularly important in the context of penetration tests conducted in critical infrastructure.

In case of violating personal data protection regulations, including GDPR, severe administrative sanctions are possible. According to Article 83 GDPR, for violating personal data protection provisions, administrative fines may be imposed up to 20 million euros or up to 4% of the company’s total annual worldwide turnover from the previous fiscal year, depending on which amount is higher.

It’s worth noting that these sanctions may be imposed not only for direct security breach of data but also for lack of appropriate procedures and security measures, including for not conducting regular security tests of systems processing personal data.

In the financial sector, violating cybersecurity provisions, including requirements for penetration tests, may result in sanctions imposed by the Polish Financial Supervision Authority (KNF). They may include financial penalties, and in extreme cases even revocation of license to conduct business.

In case of violating provisions of the National Cybersecurity System Act, which regulates among others issues of critical infrastructure security, financial penalties imposed by the competent minister are possible. The amount of these penalties can reach up to 1,000,000 PLN.

In addition to legal sanctions, violating provisions concerning penetration tests can lead to serious reputational consequences. Loss of customer and business partner trust can have long-term negative effects for the organization.

It’s also worth mentioning potential civil liability. In case damages occur as a result of improperly conducted penetration tests, the injured party can claim compensation through civil proceedings.

In summary, sanctions for violating provisions concerning penetration tests can be very severe and include both financial penalties and imprisonment in case of the most serious violations. Therefore, it’s so important that penetration tests be conducted with utmost care, in accordance with applicable regulations and industry best practices. Key significance here has appropriate test planning, obtaining necessary consents, compliance with ethical principles and personal data protection. Organizations ordering penetration tests should also ensure appropriate liability insurance, which can help cover potential damages resulting from improperly conducted tests.

Industry standards, although not formally legal acts, have a significant impact on the practice of conducting penetration tests and are often treated as mandatory in certain sectors. One of the best-known and most influential standards is PCI DSS (Payment Card Industry Data Security Standard), but there are many other standards that also shape penetration testing requirements.

PCI DSS is a data security standard for the payment card industry, developed by the Payment Card Industry Security Standards Council. This standard requires conducting regular penetration tests for systems processing payment card data. According to PCI DSS requirements, penetration tests should be conducted at least once a year and after each significant change in infrastructure or applications.

PCI DSS details the scope and methodology of penetration tests, requiring among others testing both from external perspective (from the Internet) and internal (from the organization’s internal network). The standard also requires tests to be conducted by qualified specialists, independent of the tested organization.

Another important standard is ISO/IEC 27001, which specifies requirements for information security management systems. Although ISO 27001 doesn’t explicitly require conducting penetration tests, in practice they’re often used as an element of assessing effectiveness of security controls required by the standard.

NIST (National Institute of Standards and Technology) Cybersecurity Framework is another influential standard, which although not legally binding, is widely used in many sectors. This framework recommends regularly conducting penetration tests as an element of the process of identifying and managing cybersecurity risk.

In the financial sector, in addition to PCI DSS, important significance have standards such as SWIFT Customer Security Programme (CSP) for institutions using the SWIFT network, or TIBER-EU (Threat Intelligence-based Ethical Red Teaming) promoted by the European Central Bank. Both these standards require conducting advanced penetration tests.

It’s also worth mentioning industry standards developed by organizations such as OWASP (Open Web Application Security Project). OWASP Testing Guide, although not a formal standard, is widely recognized in the industry as a collection of best practices in web application security testing.

The impact of these industry standards on legal requirements for penetration tests is multidimensional:

  • These standards often become de facto requirements in certain sectors, even if they’re not formally legally binding. For example, companies processing payment card data must meet PCI DSS requirements to be able to cooperate with large payment organizations.

  • Regulators and supervisory authorities often refer to these standards in their guidelines and recommendations. For example, the Polish Financial Supervision Authority (KNF) may expect banks to comply with standards such as PCI DSS or SWIFT CSP.

  • In case of legal disputes or security incidents, compliance with recognized industry standards can be an argument for exercising due diligence by the organization.

  • These standards often precede legal regulations and shape future regulatory requirements. Many solutions initially introduced by industry standards are later incorporated into legal provisions.

  • In the international context, compliance with global industry standards may be a condition for conducting business in certain sectors or markets.

In summary, although industry standards such as PCI DSS are not formally legal acts, they have a significant impact on the practice of conducting penetration tests and often shape legal requirements in this area. Organizations planning penetration tests should consider not only applicable legal provisions but also appropriate industry standards, which may impose additional or more detailed requirements regarding scope, frequency and methodology of tests.

Entering into contracts for conducting penetration tests requires consideration of a number of legal issues to ensure that tests will be conducted in a legal, ethical manner and in accordance with both parties’ expectations. Below are presented best legal practices worth considering when entering into such contracts.

  • Precise definition of test scope: The agreement should clearly and in detail specify the scope of penetration tests, including systems and applications to be tested, permissible testing methods, as well as any restrictions or exclusions. Precise definition of scope allows avoiding misunderstandings and ensures that tests will be conducted in accordance with client expectations.

  • Obtaining formal consent: The agreement should contain the client’s formal consent to conduct penetration tests. This consent should be given by persons authorized to represent the organization and make decisions in IT security.

  • Confidentiality clauses: Due to the sensitivity of information that may be disclosed during penetration tests, the agreement should contain confidentiality clauses. These clauses should oblige pentesters to treat all obtained information as confidential and prohibit their disclosure to third parties without explicit client consent.

  • Personal data protection: If during penetration tests personal data processing may occur, the agreement should contain clauses regarding protection of such data in accordance with GDPR requirements and other applicable regulations. This may include obligation to process data exclusively within the scope and purpose necessary to conduct tests, implement appropriate security measures and delete data after completing tests.

  • Reporting procedures: The agreement should specify procedures for reporting penetration test results, including report format, deadline for its delivery and persons authorized to receive the report. It’s also worth specifying procedures for reporting critical vulnerabilities that may require immediate response.

  • Limitation of liability: The agreement should contain clauses limiting the pentester’s liability for potential damages arising from penetration tests, as long as tests were conducted in accordance with established procedures and with due diligence. At the same time, the agreement may provide for pentester’s liability in case of gross negligence or intentional action to client’s detriment.

  • Insurance: It’s worth considering including in the agreement a requirement for the pentester to have appropriate liability insurance, which would cover potential damages resulting from penetration tests.

  • Applicable law and jurisdiction: In case of international contracts, it’s important to specify the law applicable to the agreement and jurisdiction in which potential disputes will be resolved. This allows avoiding legal uncertainty in case of conflict.

  • Intellectual property clauses: The agreement should regulate intellectual property issues, including rights to penetration test reports and any tools or scripts developed during tests.

  • Dispute resolution procedures: It’s worth including in the agreement clauses concerning procedures for resolving potential disputes, such as mediation or arbitration. This can help avoid costly and time-consuming court proceedings.

  • Compliance with industry regulations: If the client operates in a regulated industry (e.g., financial, healthcare), the agreement should consider specific regulatory requirements regarding penetration tests, such as PCI DSS, HIPAA or KNF requirements.

  • Conflict of interest clauses: The agreement may contain clauses obliging the pentester to disclose potential conflicts of interest, e.g., if the pentester previously provided services to client’s competitors.

  • Test results acceptance procedures: It’s worth specifying in the agreement procedures for client acceptance of penetration test results, including acceptance criteria and deadlines for reporting potential objections.

  • Further cooperation clauses: The agreement may contain provisions regarding further cooperation after completing tests, e.g., support in implementing recommendations resulting from tests or conducting retests after implementing remedial measures.

  • Audit and right to control: In some cases, especially when tests concern critical systems or processing sensitive data, the client may reserve in the agreement the right to audit or control the penetration testing process.

In summary, entering into contracts for penetration tests requires careful consideration of many legal aspects to ensure that tests will be conducted in a legal, ethical manner and in accordance with both parties’ expectations. Key is precise definition of test scope, obtaining formal consent, ensuring confidentiality and data protection, as well as clear definition of reporting procedures and parties’ liabilities. It’s worth using help of a lawyer specializing in IT law and data protection when developing and negotiating such contracts.

The document that makes the engagement lawful

Everything in this article converges on one artefact: the written authorisation. It names the systems that may be attacked, the person entitled to give that permission, the window in which testing may happen, and the handling rules for any personal data the tester encounters. Without it the same activity that is a service becomes an offence, regardless of intent.

Treating that document as the first deliverable rather than an attachment is deliberate — it is how the scope of penetration testing is fixed before any tool is opened.

Learn key terms related to this article in our cybersecurity glossary:

Learn More

Explore related articles in our knowledge base:

Explore Our Services

Need cybersecurity support? Check out:

Frequently asked questions

Is penetration testing legal and under what conditions?

Penetration testing is legal when conducted with explicit written authorization from the owner of the systems being tested. Without authorization, the same activities constitute unauthorized access to computer systems, which is a criminal offense in Poland under the Penal Code and in most other countries under similar cybercrime legislation. Always obtain a signed scope-of-work and authorization document before any testing begins.

What legal documents are required before conducting a penetration test?

Before testing, both parties should sign a penetration testing agreement that clearly defines the scope of authorized testing, the timeframe, the rules of engagement, liability limitations, how discovered data will be handled, confidentiality obligations, and emergency contact procedures. For cloud environments, cloud provider permission may also be required in addition to client authorization.

How do regulations such as GDPR affect penetration testing?

GDPR requires that any personal data encountered during a penetration test be handled in line with data protection principles. Testers must minimize collection of personal data, treat any discovered personal information as strictly confidential, not retain it beyond what is necessary for the engagement, and the testing agreement should address how personal data will be processed in compliance with GDPR requirements.

What regulations require penetration testing as a mandatory control?

Several regulations and standards mandate regular penetration testing including PCI DSS (required annually and after significant changes), the NIS2 Directive (implicitly through risk management requirements), ISO 27001 (through its risk assessment and security testing controls), and DORA for financial sector entities. Organizations subject to these frameworks must maintain evidence of regular testing for compliance audits.

Tags:

Penetration Testing Cybersecurity Compliance Network Cloud

Share:

Talk to an expert

Have questions about this topic? Get in touch with our specialist.

Sales Representative
Grzegorz Gnych

Grzegorz Gnych

Sales Representative

+48 664 003 003grzegorz.gnych@nflo.pl
Response within 24 hours
Free consultation
Individual approach

Providing your phone number will speed up contact.

Want to Reduce IT Risk and Costs?

Book a free consultation - we respond within 24h

Response in 24h Free quote No obligations
Book a Call +48 22 487 86 36

Or download free guide:

E-book: Digital Resilience Strategy 2026