RODO, or Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data, is an EU piece of legislation that has unified and tightened data protection regulations across all member states. Its main purpose is to give individuals more control over their own data and to impose a series of specific obligations and rules for organizations that process that data to follow. The RODO is based on fundamental principles such as legality, reliability, transparency, data minimization and accountability.
Failure to comply with RODO is one of the biggest financial risks that modern companies can face. The regulation introduced two thresholds for administrative fines that can be imposed by supervisory authorities, such as Poland’s President of the Office for Personal Data Protection (OPAP). The lower threshold is a penalty of up to €10 million or 2% of the company’s total annual worldwide turnover from the previous year (whichever is higher). The higher, much more severe threshold is a penalty of up to €20 million or 4% of total annual worldwide turnover.
The amount of the penalty depends on a number of factors, such as the nature, severity and duration of the violation, the number of people affected, the intentional or unintentional nature of the action, and the degree of cooperation with the supervisory authority. Penalties of this magnitude can be devastating even for large companies, and for smaller companies can mean the end of business. This financial risk makes investing in proper RODO implementation not a cost, but a form of strategic insurance that protects a company from potentially catastrophic consequences.
Shortcuts
- What are the most common data protection mistakes made by Polish companies?
- Does RODO apply to every company that has a website or employs staff?
- What technical security measures (e.g., encryption, backup) are necessary to protect data?
- What information obligations to customers and employees does RODO impose on the company?
- How does proper implementation of RODO build trust and competitive advantage?
- RODO as a competitive advantage
- How to conduct an RODO compliance audit and identify potential security gaps?
- What data protection documentation is mandatory and how to properly prepare it?
- What is the role of the Data Protection Officer (DPO) and when does your company need to appoint one?
- How to deal with a data breach to minimize its impact?
- What are the key elements of a data processing entrustment agreement with subcontractors?
- How can nFlo’s cyber security and IT infrastructure portfolio support your company in achieving full compliance with RODO?
What are the most common data protection mistakes made by Polish companies?
An analysis of the decisions and communications of the Polish Data Protection Authority (DPA) identifies a number of recurring errors and omissions that lead to violations and penalties. Understanding these pitfalls is the first step to avoiding them in your own organization.
One of the most common problems is processing data without a valid legal basis or failing to comply with information obligations. Companies often collect data “as a backup,” without a clear purpose, or fail to transparently inform people what data they will process, for what purpose and for how long. A high-profile example was the fines imposed for processing data from the PESEL database without a legal basis when organizing so-called “envelope elections.” Another mistake is insufficient data security, which leads to data leakage, often as a result of simple human mistakes.
A very common mistake, leading to real breaches, is improper email communication. Sending serial mailings to multiple recipients with addresses placed in the “To” or “DW” field instead of the “UDW” (hidden for message) field leads to mutual disclosure of their data. It is equally common to send messages with sensitive data to the wrong addressee as a result of a typo or an incorrect autocomplete selection.
Other common failings found by the DPA include a lack of adequate technical and organizational measures to protect data (e.g., lack of encryption, weak passwords), lack of formal procedures (e.g., for breach reporting or document destruction), and failure to cooperate with the supervisory authority during inspections. Incomplete maintenance of the Register of Processing Activities or omission of key processes, such as customer data profiling, from the risk analysis are also common mistakes.
📚 Read the complete guide: IAM / Zero Trust: Identity and access management - from the basics to Zero Trust
Does RODO apply to every company that has a website or employs staff?
Yes, in practice, RODO applies to almost every company operating in the European Union, regardless of its size or industry. The key criterion is not the scale of operations, but the fact that personal data is being processed. According to the RODO definition, personal data is any information about an identified or identifiable natural person. This includes not only such obvious data as first name, last name or PESEL number, but also email address, phone number, IP address or location data.
If a company hires employees, it automatically becomes the controller of their personal data. It must process their data for HR and payroll purposes, which is subject to strict regulations of the RODO and the Labor Code. This means having appropriate procedures, safeguards and fulfilling information obligations to employees.
If a company has a website, it is also almost certainly processing personal data. Just having a contact form where customers leave their email address is a data processing operation. If a site uses cookies for analytics or marketing purposes (which most sites do), it is also processing data (such as online identifiers or IP addresses), which requires obtaining appropriate consent and informing users. Running an online store, sending a newsletter or even simple analysis of site traffic - all of these activities involve the processing of personal data and fall under the RODO regime.
What technical security measures (e.g., encryption, backup) are necessary to protect data?
Article 32 of the RODO requires data controllers to implement “appropriate technical and organizational measures to ensure a degree of security appropriate to the risk.” The regulation deliberately does not list a closed catalog of specific technologies, leaving the selection of measures to the controller. However, it does list examples of measures that form the core of a modern approach to technically securing data.
One of the most important and explicitly mentioned measures is encryption of personal data. Encryption should be used in two scenarios: at rest, i.e. on the disks of servers, laptops and portable media, and in transit, i.e. when transferring data over the network. Disk encryption (using BitLocker, for example) protects data in case of physical theft of hardware. Transmission encryption (using TLS/SSL protocols) is absolutely essential for all websites and applications to protect data from eavesdropping on the network.
Another key element is ensuring the business continuity and resilience of systems, which in practice means regular backups and testing (backups). A company must be able to quickly restore data from backup in the event of a hardware failure or ransomware attack to ensure availability. It is important that backups are stored in a secure, isolated location and are also encrypted.
Other necessary technical measures include strong access control based on the principle of least privilege and multi-factor authentication (MFA), regular testing and evaluation of security effectiveness (e.g. through penetration testing ), as well as implementation of mechanisms to protect against malware and ensure network security (next-generation firewalls, EDR systems). The selection of specific technologies must always be preceded by a risk analysis.
What information obligations to customers and employees does RODO impose on the company?
One of the fundamental principles of the RODO is transparency in data processing. This means that every company, as a data controller, has a legal obligation to inform the people whose data it collects about all aspects of the process in a clear, understandable and easily accessible way. This obligation must be fulfilled at the time of data acquisition.
The main tool for implementing this obligation is the so-called information clause. It must be presented to every person whose data is collected - whether it is an employee during recruitment and employment, a customer filling out a form on a website, or a contractor signing a contract. This clause, in accordance with Articles 13 and 14 of the RODO, must contain a number of mandatory elements, including the identity and contact details of the data controller, the contact details of the Data Protection Officer (if appointed), as well as the purposes and legal basis of data processing.
In addition, the company must inform about the recipients of the data (i.e. to whom the data may be transferred, e.g. accounting firm, hosting provider), the intention to transfer the data to a third country (outside the EU), and the period for which the data will be kept. It is also crucial to inform about the person’s rights, such as the right to access, rectify, erase (“right to be forgotten”), limit processing, object, and the right to data portability and lodge a complaint with the supervisory authority (the DPA). Failure to fulfill or erroneously fulfill the information obligation is one of the most common violations found by supervisory authorities.
How does proper implementation of RODO build trust and competitive advantage?
While many companies see RODO mainly as a costly obligation and a source of risk, conscious and proper implementation of its principles can become a powerful tool for building trust and a real competitive advantage. In today’s world, where consumers are increasingly aware of the value of their privacy, a transparent and responsible approach to data is becoming a key differentiator in the market.
A company that openly communicates how it cares about its customers’ data, implements safeguards that are visible to them (e.g., MFA) and reliably exercises their rights (e.g., to delete data), builds an image of a trustworthy and professional partner. This attitude is particularly important in B2B relationships, where large corporations conduct detailed security and RODO compliance audits when selecting suppliers and subcontractors. Demonstrating a mature approach to data protection can be a decisive factor in winning lucrative contracts.
Moreover, the process of implementing RODO forces an organization to organize and inventory its processes and data. This often leads to identifying inefficiencies, eliminating redundant (and costly to maintain) data sets and optimizing workflows. A better understanding of your own data allows you to use it more wisely, such as to better personalize your offerings, which directly translates into business results.
Finally, in the event of an unavoidable security incident, a company that can demonstrate that it has implemented appropriate measures and acted with due diligence is in a much better negotiating position with the supervisory authority and can expect a lighter penalty. Investing in RODO is therefore not only protecting against losses, but also building a solid foundation for stable and sustainable growth.
RODO as a competitive advantage
-
Building Customer Trust: A transparent and responsible approach to data attracts informed consumers and builds loyalty.
-
Requirement in Business-to-Business (B2B): RODO compliance is often a prerequisite for participating in tenders and engaging with large partners.
-
Internal Optimization: the RODO implementation process organizes processes, eliminates redundant data and improves overall operational efficiency.
-
Better Risk Management: In the event of a violation, demonstrating due diligence can significantly reduce potential financial penalties.
-
Conclusion: RODO is not just a cost, but an investment in the reputation, security and stable development of the company.
How to conduct an RODO compliance audit and identify potential security gaps?
An RODO compliance audit is a systematic and documented process that aims to verify that a company’s processing of personal data complies with the requirements of the regulation. It is a key tool to objectively assess the facts, identify gaps and non-compliance, and plan corrective actions before they lead to a breach and penalty.
The audit process usually begins with an inventory and mapping of data processing processes. The auditor, in cooperation with representatives of various company departments, identifies all the places and processes where personal data is processed - from recruitment to customer service to marketing. For each process, an entry is created in the Register of Processing Activities (if required), which describes, among other things, the categories of data processed, the purposes and legal basis for processing, and the security measures used.
The auditor then proceeds to a compliance analysis (Gap Analysis). He compares the actual state of affairs with the requirements of the RODO, verifying such elements as the correctness of information clauses and consents, the existence and completeness of the required documentation, the realization of the rights of data subjects, or the content of processing entrustment agreements. In parallel, an analysis of technical and organizational safeguards is carried out. The auditor assesses whether the implemented measures, such as access control, encryption or backup procedures, are adequate to the identified risks.
The result of an audit is a detailed report that lists all identified nonconformities and security gaps, along with an assessment of their risk level. Most importantly, a good audit report also includes specific and practical recommendations for corrective actions the company should take to achieve full compliance. Conducting such audits on a regular basis (e.g., once a year or after significant changes in the company) is a key element of the accountability principle and proof of due diligence.
What data protection documentation is mandatory and how to properly prepare it?
The RODO places great emphasis on the principle of accountability, which means that every company must be able to demonstrate that it is processing data in compliance with the regulations. A key element of this accountability is having and maintaining adequate data protection documentation. While its scope depends on the size and specifics of the company, certain documents are fundamental for most organizations.
The most important and in many cases mandatory document is the Register of Data Processing Activities (RCPD). This is an internal inventory that describes in detail all company processes that use personal data. For each activity, it should specify, among other things, its purpose and legal basis, categories of data processed, recipients of the data, information on transfers outside the EU and the planned date of deletion of the data. For contract processors (processors), the equivalent is the Register of Categories of Processing Activities.
Another key set of documents are internal policies and procedures. The most important of these is the Data Protection Policy, which is an overarching document describing general rules, roles and responsibilities within the company. It should be accompanied by more detailed procedures, such as a procedure for handling the rights of data subjects, a procedure for managing data breaches, a clean desk and screen policy, or a procedure for granting and revoking authorizations.
The company must also have sample documents for implementing the RODO obligations, such as information clauses for customers and employees, sample consents for data processing (if applicable) and a sample data processing entrustment agreement. All documentation should be “live” - regularly reviewed and updated to reflect the actual status of processes and applicable regulations.
What is the role of the Data Protection Officer (DPO) and when does your company need to appoint one?
A Data Protection Officer (DPO), in English nomenclature Data Protection Officer (DPO), is a person appointed within an organization to act as an independent expert and point of contact for all matters related to data protection. His main task is to inform, advise and monitor compliance with RODO regulations internally. The DPO acts as an intermediary between the data controller, employees, data subjects and the supervisory authority (DPA).
The DPO’s key tasks include advising management and staff on their obligations under the RODO, monitoring compliance by participating in audits and analysis, as well as training staff and building awareness in the area of data protection. The DPO is also the main point of contact for individuals who wish to exercise their rights (e.g., the right to erasure), and for the DPA in the event of an audit or breach report. Importantly, the DPO must be independent in his or her functions and report directly to top management.
The appointment of a DPO is mandatory in three cases specified in the RODO. First, when the processing is carried out by a public authority or entity. Second, when the main activity of the controller or processor consists of processing operations that, due to their nature, scope or purposes, require regular and systematic monitoring of individuals on a large scale. Third, when the main activity involves large-scale processing of special categories of personal data (so-called sensitive data, e.g., health data, ethnicity) and data on criminal convictions. Even if a company does not meet these criteria, it can voluntarily appoint an IOD, which is considered good practice and proof of care for data protection. The function of the DPO can be performed as part of an employment relationship or under a service contract (outsourcing).
How to deal with a data breach to minimize its impact?
A data breach, such as a leak, loss or unauthorized access to data, can happen to any company, even the best-secured. The key to minimizing its negative impact - both financial and reputational - is a rapid, coordinated and procedurally compliant response. Having a pre-prepared and rehearsed incident response plan is absolutely key here.
The first step after detecting a potential breach is to analyze and contain it immediately. The security team must take action as soon as possible to contain the situation, such as isolating infected systems from the network, blocking unauthorized access or recovering lost data from backup. In parallel, an analysis must be conducted to determine what happened, what data was affected by the breach and the potential risk to the rights and freedoms of data subjects.
If a risk assessment reveals that a breach may cause a risk to individuals, the company is required to report it to the supervisory authority (DPA) without undue delay, no later than 72 hours after the breach is discovered. The notification must include, among other things, a description of the nature of the breach, its likely consequences and the measures taken to remedy the situation. If the risk to individuals is high, the controller is also required to inform the data subjects themselves of the breach, so that they can take appropriate precautions (e.g., change passwords, reserve ID cards).
The final, extremely important step is to learn lessons (lessons learned). Once the situation has been brought under control, the causes of the incident must be thoroughly analyzed and additional technical or organizational measures must be implemented to prevent future recurrences. The entire process, from detection to corrective action, must be documented in detail, providing evidence of due diligence in the event of an audit.
What are the key elements of a data processing entrustment agreement with subcontractors?
In today’s business world, it is very rare for a company to process all the data itself. It often uses third-party entities (subcontractors), such as accounting firms, marketing companies, hosting providers or SaaS software providers. If such a subcontractor (referred to as a “processor” or “processor” in the terminology of the RODO) has access to personal data of which our company is the controller as part of the service provided, the RODO requires us to enter into a special data processing entrustment agreement with it.
An entrustment agreement is a formal document that governs the terms and conditions under which a processor can process data on behalf of a controller. Its purpose is to ensure that the subcontractor will apply at least the same high level of data protection required of the controller. The absence of such an agreement or its defective content is a serious violation of the RODO, for which the controller is liable.
Article 28 of the RODO specifies precisely what elements must be included in such an agreement. It must clearly define the subject matter, duration, nature and purpose of the processing, as well as the type of personal data and categories of data subjects. Crucial is the processor’s obligation to process data only on the documented instructions of the controller. The agreement must also impose an obligation on the processor to implement appropriate technical and organizational measures, to maintain confidentiality, and to assist the controller in fulfilling its obligations (e.g., in responding to requests from individuals or reporting violations).
An extremely important element of the contract is the regulation of further entrustment (sub-processors) - the processor cannot hire another sub-processor without the prior consent of the controller. The agreement must also provide the administrator with the right to audit and inspect the processor, and oblige the processor to delete or return the data upon termination of services. Careful preparation and negotiation of entrustment agreements is a key element of risk management in supplier relationships.
How can nFlo’s cyber security and IT infrastructure portfolio support your company in achieving full compliance with RODO?
Achieving and maintaining compliance with RODO is a process in which a solid technological foundation and a mature cybersecurity strategy play a key role. At nFlo, we fully understand that legal requirements must be translated into concrete, working solutions in the IT infrastructure. Our comprehensive portfolio of services is designed to support organizations in building the secure and resilient environment needed to effectively protect personal data.
Our support begins with audit and consulting services. We help conduct a detailed risk analysis and assess the adequacy of existing technical safeguards. We verify the configuration of networks, access control systems, encryption mechanisms and backup procedures, identifying gaps that may be in violation of the requirements of Article 32 of the RODO. The result of our work is a roadmap with specific technical and organizational recommendations to help you strengthen your security posture.
Based on the audit results, our engineering team helps implement and manage key security technologies. We design and implement secure network architecture, deploy advanced firewalls (NGFW), endpoint protection (EDR) systems and strong authentication (MFA) mechanisms. Our IT infrastructure management services ensure that your systems are always up-to-date, monitored and properly secured, which is key to the principle of data integrity and confidentiality.
Finally, we help companies prepare for the worst. Our penetration testing verifies the real-world resilience of your systems to attacks, and our incident response planning and business continuity plan development services ensure that, in the event of a breach, you’ll be able to respond quickly and effectively, minimizing damage. When you choose nFlo, you get a partner with the unique combination of legal and organizational expertise and deep technical knowledge necessary to ensure real, not just paper, compliance with RODO.
Related Terms
Learn key terms related to this article in our cybersecurity glossary:
- Backup — Backup, also known as a backup copy or safety copy, is the process of creating…
- Network Security — Network security is a set of practices, technologies, and strategies aimed at…
- Cybersecurity — Cybersecurity is a collection of techniques, processes, and practices used to…
- Cybersecurity Incident Management — Cybersecurity incident management is the process of identifying, analyzing,…
- GDPR (General Data Protection Regulation) — GDPR (General Data Protection Regulation) is a comprehensive European Union…
Learn More
Explore related articles in our knowledge base:
- What is RODO? A complete guide to data protection for business
- Dell EMC Data Protection Suite – Recipe for Secure Data
- What is Compliance and how to ensure legal compliance in a company?
- What is GDPR? A complete guide to data protection for companies operating in the European Union
- What is GDPR and how to implement data protection?
Explore Our Services
Need cybersecurity support? Check out:
- Security Audits - comprehensive security assessment
- Penetration Testing - identify vulnerabilities in your infrastructure
- SOC as a Service - 24/7 security monitoring
Frequently asked questions
What is RODO and how does it differ from GDPR?
RODO is the Polish name for GDPR—Regulation (EU) 2016/679 on the protection of personal data. They are the same regulation; RODO stands for Rozporządzenie Ogólne o Ochronie Danych and applies identically across all EU member states.
What are the maximum fines for RODO violations in Poland?
The higher penalty tier reaches up to €20 million or 4% of total annual global turnover, whichever is greater. Less severe violations carry fines of up to €10 million or 2% of turnover. The Polish supervisory authority (UODO) has issued multi-million zloty fines against Polish companies.
What technical measures must a company implement under RODO?
Companies must implement measures proportional to risk, which typically include pseudonymization and encryption of personal data, access controls ensuring only authorized personnel can reach specific data, regular testing of security systems, and procedures for detecting and reporting data breaches within 72 hours.
What should a company do immediately after discovering a personal data breach?
The company must assess the risk to affected individuals and notify the supervisory authority (UODO in Poland) within 72 hours of becoming aware of the breach. If the breach poses a high risk to individuals, those individuals must also be notified without undue delay. A breach response plan prepared in advance is critical to meeting these deadlines.
