Poland's data protection authority, UODO, imposed over PLN 64 million (roughly EUR 15 million) in GDPR fines during 2025, its record enforcement year, according to CMS's GDPR Enforcement Tracker Report 2026. That total is more than four and a half times the PLN 13.9 million UODO issued in 2024, and it came from three individual fines that each set a new national record on their own. Poland's surge stands out against its neighbors: Hungary's fines fell by roughly three-quarters over the same period, and the Czech Republic issued barely a tenth of Poland's total.
How much did Poland fine companies under GDPR in 2025?
PLN 64 million is UODO's confirmed 2025 total, per CMS's GDPR Enforcement Tracker Report 2026, published 21 May 2026. That figure, equal to roughly EUR 15 million at current exchange rates, marks the highest annual total UODO has recorded since GDPR took effect in Poland in May 2018, and CMS's own report describes 2025 as a record year for Polish enforcement outright.
Figure 1: Poland's data protection authority issued a record PLN 64 million in GDPR fines during 2025. Source: CMS GDPR Enforcement Tracker Report 2026, Poland chapter.
Three fines drove nearly all of that total on their own, which means Poland's 2025 record was not a broad wave of smaller enforcement actions but a handful of large, individually reported cases against well-known companies.
Which companies received Poland's largest GDPR fines in 2025?
UODO's three largest 2025 fines, each a new national record on its own, targeted very different violations. Poczta Polska, the Polish state postal operator, received the largest at PLN 27 million (roughly EUR 6.3 million) for unlawfully collecting voter data. Bank ING was fined PLN 18.4 million (about EUR 4.3 million) over excessive scanning of customers' identity documents. McDonald's Polska paid PLN 16.9 million (roughly EUR 4 million) for inadequate monitoring of a data processor it worked with. All three decisions remain under appeal or are not yet legally final, per CMS's report, so the enforced amounts could still change.
Figure 2: Poland's three largest confirmed GDPR fines of 2025, all still under appeal or not yet final. Source: CMS GDPR Enforcement Tracker Report 2026, Poland chapter.
Together, these three cases account for more than PLN 62 million of Poland's PLN 64 million-plus total for the year, which is why a single enforcement wave against three companies defines the entire 2025 record rather than a broad pattern of smaller cases.
How has Poland's GDPR enforcement grown since 2018?
Poland's enforcement history was mostly modest until 2025. UODO issued PLN 3.2 million in fines in 2019, its first full year of GDPR enforcement, and the annual total stayed in the low single-digit millions most years after that. 2022 briefly climbed to PLN 7.9 million before falling back to just PLN 1.2 million in 2023, the quietest year on record, then rising again to PLN 13.9 million in 2024.
Even against that up-and-down history, 2025's total stands apart. It is more than four and a half times 2024's figure and more than eight times Poland's previous single-year peak in 2022, a sharper one-year jump than any other year in UODO's enforcement record so far. The pattern shows enforcement building gradually for years before a small number of large cases reset the scale entirely, rather than a smooth annual increase.
Figure 3: Poland's annual confirmed GDPR fine totals, 2019 through 2025. Source: CMS GDPR Enforcement Tracker Report 2026, Poland chapter.
How does Poland compare to the Czech Republic and Hungary in fine value?
Poland's roughly EUR 15 million in confirmed 2025 GDPR fines dwarfs its neighbors. The Czech Republic's data protection authority, UOOU, issued approximately EUR 600,000 in 2025 fines, and Hungary's NAIH imposed roughly EUR 250,000, per CMS's country-level chapters in the same 2026 report. Combined, the three countries' 2025 GDPR fine value totals roughly EUR 15.9 million, and Poland alone accounts for an estimated 95% of that combined figure, based on PrivacyTerms.io's calculation from CMS's published country totals.
Figure 4: Poland's share of the combined 2025 GDPR fine value across Poland, the Czech Republic, and Hungary. Source: PrivacyTerms.io calculation from CMS GDPR Enforcement Tracker Report 2026 country chapters.
That concentration is a reminder that Eastern European GDPR enforcement is not uniform from one country to the next: one country having an unusually active year can outweigh several smaller neighbors' totals combined.
Did every Eastern European country's GDPR fines rise in 2025?
No. Poland's fines rose sharply in 2025, but Hungary's fell just as sharply in the opposite direction. NAIH's total dropped from EUR 947,493 in 2024 to roughly EUR 250,000 in 2025, a decline of about 74%, even as its largest single fine on record, a EUR 653,000 penalty against a bank for unlawfully using AI to analyze customers' emotional state during phone calls, was issued in that same window. Poland and Hungary moved in opposite directions under the same law over the same twelve months.
Figure 5: Poland's 2025 GDPR fines rose sharply while Hungary's fell over the same twelve months. Source: CMS GDPR Enforcement Tracker Report 2026, Poland and Hungary chapters.
A one-year swing this size in either direction shows how much a single regulator's caseload timing, rather than a change in the underlying law, can move a country's year-over-year enforcement total.
Which Eastern European countries file the most GDPR fines?
Fine value is only part of the picture. By number of published cases, Spain still leads the entire EU for the seventh consecutive year, with 1,048 recorded fines, followed by Italy in 2nd place and then Romania in 3rd, according to CMS's GDPR Enforcement Tracker Report 2026 executive summary. Poland ranks 4th. CMS's report places Romania and Poland in the same count band, roughly 106 to 490 published fines each, without breaking out each country's exact total further, though it confirms that Italy, Romania, and Poland's combined case counts still fall short of Spain's 1,048 alone. See our breakdown of GDPR fines by country for how Ireland and Spain compare on the EU-wide numbers this ranking is drawn from.
That gap between value and count matters here too. Poland ranks 4th by case count, yet its 2025 fine value alone dwarfs most of the countries ranked above it, the same value-versus-volume split seen across the wider EU; see our overview of total EU-wide GDPR fines for how that split plays out at the continental level.
How does Poland's 2025 enforcement compare to its neighbors?
| Country | 2025 GDPR fines | Change vs 2024 | EU fine-count rank |
|---|---|---|---|
| Poland | PLN 64M+ (approx. EUR 15M) | up more than 360% | 4th |
| Czech Republic | approx. EUR 600,000 | no comparable 2024 total published | outside top 4 |
| Hungary | approx. EUR 250,000 | down roughly 74% | outside top 4 |
Source: CMS GDPR Enforcement Tracker Report 2026, country chapters for Poland, the Czech Republic, and Hungary.
Poland's PLN 64 million-plus total is not just Eastern Europe's largest for 2025, it is more than 17 times the Czech Republic's and Hungary's 2025 totals combined.
The Bottom Line
Poland's PLN 64 million-plus GDPR total for 2025 is the standout Eastern European enforcement story of the year, but it rests on just three large fines rather than a broad wave of smaller cases, and all three remain under appeal. Hungary's steep decline over the same period is a reminder that a single country's year-over-year swing, in either direction, often says more about which specific cases closed in a given twelve months than about a shift in enforcement policy. For any business operating in Poland, Hungary, the Czech Republic, or elsewhere in the EU, the underlying GDPR obligations do not change based on which country's regulator happens to be active that year. A privacy policy generator built for GDPR keeps consent and legal-basis disclosures current regardless of which national authority reviews them next.
Frequently Asked Questions
How much did Poland fine companies under GDPR in 2025? Poland's data protection authority, UODO, imposed over PLN 64 million (roughly EUR 15 million) in GDPR fines in 2025, its record year and more than 4.5 times the PLN 13.9 million issued in 2024, according to CMS's GDPR Enforcement Tracker Report 2026.
What was the largest GDPR fine issued in Poland? The largest of Poland's three record 2025 fines was PLN 27 million (roughly EUR 6.3 million) against Poczta Polska for unlawful voter data collection, followed by Bank ING's PLN 18.4 million fine and McDonald's Polska's PLN 16.9 million fine, per CMS's 2026 report. All three decisions remain under appeal or are not yet final.
How does Poland's GDPR enforcement compare to Hungary and the Czech Republic? Poland's roughly EUR 15 million in 2025 GDPR fines is far larger than Hungary's approximately EUR 250,000 and the Czech Republic's approximately EUR 600,000 combined, giving Poland an estimated 95% share of the three countries' combined 2025 fine value, based on PrivacyTerms.io's calculation of CMS's published totals.
Which Eastern European country files the most GDPR fines? Romania files the most among Eastern European countries, ranking 3rd in the EU by published fine count behind Spain and Italy, with Poland close behind in 4th, according to CMS's GDPR Enforcement Tracker Report 2026 executive summary, though the report does not disclose each country's exact case count beyond a combined range.
Where the Numbers Come From
- CMS Law. (2026). "GDPR Enforcement Tracker Report 2026, Poland." Published 21 May 2026. PLN 64 million-plus in 2025 fines (record year), PLN 13.9 million in 2024, and the Poczta Polska, Bank ING, and McDonald's Polska fines.
- CMS Law. (2026). "GDPR Enforcement Tracker Report 2026, Hungary." Published 21 May 2026. EUR 250,000 in 2025 fines, EUR 947,493 in 2024, and the EUR 653,000 Budapest Bank fine.
- CMS Law. (2026). "GDPR Enforcement Tracker Report 2026, Czech Republic." Published 21 May 2026. Approximately EUR 600,000 in 2025 fines, roughly EUR 16 million cumulative since 2018, and the EUR 13.9 million Avast Software fine.
- CMS Law. (2026). "GDPR Enforcement Tracker Report 2026, Executive Summary." Spain's 1,048 fines and the Spain, Italy, Romania, Poland fine-count ranking, cutoff 1 March 2026.
Note: All figures verified as of October 2026. The EUR conversions in this post follow the approximate figures CMS's own country chapters publish alongside each PLN and HUF total rather than an independent exchange-rate calculation, and the 95% Poland enforcement share and the count-band ranges for Romania and Poland are PrivacyTerms.io's own calculations from CMS's published country totals. Enforcement totals are refreshed at least twice a year as CMS publishes new country chapters.
