The President of the Personal Data Protection Office on the protection of patients' data at the conference "GDPR in Healthcare"
On 15 September 2026, the President of the Personal Data Protection Office (UODO), Mirosław Wróblewski, opened the conference "GDPR in Healthcare", organised by Szpitale Pomorskie Sp. z o.o. in cooperation with the Personal Data Protection Office.
In his speech, "Data protection in the healthcare sector – experiences and challenges", he spoke, among other things, about the importance of protecting patients' data in the context of the ongoing digitalisation of medical services.
"Digitalisation in the medical field must develop with patients' data protection in mind. This has a huge impact on their trust in the entire healthcare system," stressed Mirosław Wróblewski.
The President of the Personal Data Protection Office pointed out that health data is among the most sensitive information about a person, and its unlawful use may violate patients' privacy and dignity. He also emphasised that the development of new technologies should take personal data protection into account from the outset. This applies, among other things, to the deployment of artificial intelligence systems and to ensuring appropriately high technical requirements for entities that process medical data on a large scale.
"The issue of establishing appropriately high technical requirements for entities processing medical data – especially in bulk – on behalf of controllers is pressing today," noted the President of the Personal Data Protection Office.
Proposals on this matter were set out in a letter sent to the Minister of Digital Affairs.
Monika Krasińska, Director of the UODO's Law and New Technologies Department, also took part in the conference. During a panel discussion, she spoke about challenges related to personal data protection, patients' rights and the development of new technologies in healthcare facilities.
The aim of the event was to raise awareness and promote good practices in the area of personal data protection in the health sector.
Given the interest in, and importance of, data protection in healthcare, we remind you that the Personal Data Protection Office has drawn controllers' attention on its website to their obligations in connection with the hacker attack on the company MyDr:
https://uodo.gov.pl/pl/138/4538
The Personal Data Protection Office has also answered the most frequently asked questions received on its helpline:
https://uodo.gov.pl/pl/615/4550
Data subjects, in turn, were advised by the Personal Data Protection Office on how to proceed in the event of a personal data breach:
https://uodo.gov.pl/pl/615/4550
The processing of patients' data is particularly important. We therefore encourage you to familiarise yourself with the industry codes of conduct developed for the health sector. All approved codes of conduct, which further specify data protection rules, are available at: https://uodo.gov.pl/pl/426/1110. We particularly recommend two of them: the Code of Conduct on the Protection of Personal Data Processed in Small Medical Facilities (prepared by the Porozumienie Zielonogórskie) and the Code of Conduct for the Healthcare Sector (prepared by the Polish Hospital Federation).
Health data is extremely important, and the President of the Personal Data Protection Office pays particular attention to it. That is why this year the President of the Personal Data Protection Office:
· conducted a training session for medical professionals from the Regional Medical Chamber: https://uodo.gov.pl/pl/138/4105
· organised a two-day conference on the European Health Data Space (EHDS): https://uodo.gov.pl/pl/531/4134
· presented a position on the legal bases for sending invitations to screening tests, which is very important from the perspective of the healthcare system and prevention: https://uodo.gov.pl/pl/138/4126
· The President of the Personal Data Protection Office also took part in a debate on the premiere of the report "Map of Medical Data Sources in Poland": https://uodo.gov.pl/pl/138/4335
Health data was also the subject of one of the panels at this year's Congress on Personal Data Protection and New Technologies: https://uodo.gov.pl/pl/643/4060#n13