Administrative fine imposed for failure to comply with a decision of the President of Personal Data Protection Office

Failure to comply with an obligation imposed by a decision of the President of the Personal Data Protection Office may result in the initiation of enforcement proceedings and the imposition of an administrative fine. In the case of one controller, the fine amounted to PLN 29 112.

In 2025, the President of the Personal Data Protection Office, Mirosław Wróblewski, ordered the controller, Costalea, a company based in Warsaw, to fulfil its obligation to provide information to the complainant. The decision was sent to the company's registered office address as recorded in the National Court Register. Following two unsuccessful attempts to deliver the correspondence, during which delivery notices were left, it was returned to the Personal Data Protection Office.

The controller's failure to respond prompted the supervisory authority to verify whether the obligation imposed by its decision had been fulfilled. Accordingly, the controller was requested to provide explanations and evidence demonstrating compliance with the decision of the President of the Personal Data Protection Office The controller's failure to respond prompted the supervisory authority to verify whether the obligation imposed by its decision had been fulfilled. Accordingly, the controller was requested to provide explanations and evidence demonstrating compliance with the decision of the President of the Personal Data Protection Office, which required the controller to fulfil its obligation to provide information to the complainant.

As the controller failed to respond to any attempts to obtain confirmation that the decision had been complied with, and the complainant stated that the controller had not fulfilled its obligation to provide her with information, the President of the Personal Data Protection Office concluded that the controller had failed to comply with the decision. The President of the Personal Data Protection Office therefore issued a formal reminder to the controller – a document required before administrative enforcement proceedings can be initiated, which also gives the person subject to the obligation a final opportunity to comply voluntarily. This correspondence also remained unanswered by the controller.

Irrespective of the possibility of applying enforcement measures against a person or entity that fails to comply with an administrative decision under the Act on Enforcement Proceedings in Administration, the President of the Personal Data Protection Office may also impose an administrative fine on such a person or entity pursuant to the GDPR.

Failure to comply with a decision issued by a supervisory authority constitutes an infringement of the GDPR and is subject to an administrative fine of up to EUR 20 million or, in the case of an undertaking, up to 4% of its total worldwide annual turnover of the preceding financial year, whichever is higher.

In the present case, the President of the Personal Data Protection Office exercised his power to impose an administrative fine on the controller for failing to fulfil the obligation imposed on it. In determining the amount of the fine, the President of the Personal Data Protection Office took into account the controller's financial results for the most recent financial year, with a view to ensuring that the fine was proportionate to the seriousness of the infringement, dissuasive in preventing future infringements and effective, primarily by encouraging the controller to fulfil the obligation imposed by the President of the Personal Data Protection Office decision.

In the opinion of the President of the Personal Data Protection Office, the financial impact of the fine would emphasise the unlawfulness of the controller's conduct, which demonstrated a deliberate and intentional unwillingness to fulfil the obligation imposed by the administrative decision.

It should also be emphasised that payment of the fine will not release the controller from its obligation to comply with the decision. The President of the Personal Data Protection Office will continue to take steps to ensure that the controller fulfils its obligation to provide information to the complainant, as imposed by the supervisory authority's decision.

Decision in Poland: DKE.561.3.2026