The 2026 GDPR Summer Leadership Academy Has Come to an End
This year’s edition of the GDPR Summer Leadership Academy—an educational program organised by the President of the Personal Data Protection Office and aimed primarily at students and recent graduates interested in personal data protection, privacy, cybersecurity, and new technologies—has come to an end.
On September 14, 2026, the closing session of the GDPR Leaders’ Summer Academy took place at the headquarters of the Personal Data Protection Office. It marked the culmination of a series of lectures and workshops during which participants gained practical knowledge regarding the application of personal data protection regulations. From the outset, the final meeting was planned as a summary of the program, which ran throughout the summer.
The Academy was designed for individuals who wish to develop their skills in the field of data protection and apply them in the future in both the public administration and the private sector. The participants were primarily students and recent graduates, particularly from fields such as law, public administration, international relations, and computer science.
From the Basics of the GDPR to the Challenges of New Technologies
The Academy’s program focused primarily on the practical aspects of personal data protection. Participants learned, among other things, about the duties and powers of the President of the Personal Data Protection Office (UODO), the rules for applying the GDPR, the structure of consent and the duty to inform, the role of the data protection officer, the rules for responding to data breaches, and issues related to risk analysis.
Another important part of the program addressed issues arising from the rapid development of technology—cybersecurity, artificial intelligence, online user tracking, deepfakes, spoofing, and sharenting. This broad scope of the program was intended to show participants that data protection is not a field limited solely to knowledge of regulations, but also requires an understanding of technology, organisational processes, and real threats to human rights and freedoms.
Risk cannot be completely eliminated
One of the topics discussed during the closing session of the Academy was risk analysis under the GDPR. In his presentation, Tomasz Ochocki, Vice President of the Management Board at ODO24, highlighted an important—though sometimes overlooked—principle: even the best-secured organization is unable to eliminate all risks. The purpose of the GDPR is not to guarantee absolute data inviolability. The controller’s responsibility is to take appropriate measures to mitigate risks and potential negative consequences for data subjects, as well as to respond appropriately in the event of an incident.
Importantly, a risk analysis should not be treated as a one-time document prepared for the purposes of the GDPR. It is an ongoing process that should include, among other things, the identification of assets, threats, vulnerabilities, and existing safeguards; the assessment of likelihood and impact; the selection of risk management strategies; and, subsequently, the regular monitoring and review of the measures implemented. The presentation also emphasised that the consequences of risks should be assessed primarily from the perspective of the rights and freedoms of individuals, rather than in terms of losses or the interests of the organization itself.
Knowledge Designed for Practical Application
The GDPR Leaders’ Summer Academy also provided participants with an opportunity to interact directly with experts from the UODO and professionals working in the fields of data protection, law, and information security.
The project’s format was designed not only to familiarise participants with the regulations but, above all, to help them understand how to apply them in specific situations. As the individual sessions demonstrated, modern data protection increasingly requires a combination of legal, technological, and organisational expertise.
At the conclusion of the program, Academy participants received certificates confirming their completion of the program. In accordance with the project’s objectives, outstanding participants may also have the opportunity to complete an internship or gain professional experience at the UODO.
Congratulations to all graduates of the 2026 GDPR Summer Leadership Academy, and we hope that the knowledge you have gained will serve as a foundation for your continued growth in the field of personal data protection.