Rules on termination of employment with a DPO need to be clarified

The President of the Personal Data Protection Office states the need to introduce into the Polish legal system provisions that would directly define specific measures to protect a DPO against dismissal for the performance of his/her tasks. This would implement one of the guarantees of the independence of a DPO in the provisions of the GDPR, which is the durability of a DPO’s employment basis.

Such conclusions, resulting from the ruling issued on December 16, 2025, on the request for an advisory opinion by the EFTA Court in case E-5/25 Silbernagl, were presented by the President of the Personal Data Protection Office, Mirosław Wróblewski, to the Deputy Minister of Foreign Affairs, Ignacy Niemczycki.

The Minister asked the President of the Personal Data Protection Office to analyse the effects of the judgment for Poland.

The case before the Court concerned whether Data Protection Officers could be dismissed for reasons unrelated to the performance of their tasks. Rainer Silbernagl has filed a lawsuit against the University of Liechtenstein, seeking a declaration as to whether his employment relationship as Data Protection Officer remains in force.

The polish legislation – unlike the Principality of Liechtenstein – does not provide for more precise legal provisions directly relating to the DPO, notes the President of the Personal Data Protection Office. The only regulations in this area are included in the GDPR. However, it follows from the Court’s judgment that national legislation may give concrete expression to the circumstances in which the employment relationship with the DPO may be terminated.

According to the Court, this is possible:

• without requiring just cause, provided that the termination is not due to the data protection officer performing his tasks;
• or with just cause, provided that such legislation does not undermine the achievement of the objectives of that regulation;

Clarifying provisions should be introduced into the Polish legal order, as the prohibition on dismissing and punishing DPOs contained in the GDPR (Article 38 (3) second sentence) in practice raises great doubts of interpretation. However, the more stable the employment relationship and the scope of protection of the DPO against dismissal, the greater the chance of his/her independence in performing his/her tasks, which affects the quality of the DPO’s work and serves to better achieve the objectives of the GDPR, which is to ensure a high level of protection of natural persons with regard to the processing of their personal data and to appointment of a DPO in the organisation.

DPNT.0623.13.2025