Third-party data breach in Poland – what should your company do under GDPR?
Following a third-party data breach in Poland, companies should secure access, assess financial risks and check their GDPR obligations.
A third-party data breach may expose company accounts, invoices, customer and supplier details, payment information or login credentials.
A cyberattack on a service provider does not release a company acting as a data controller from assessing its own GDPR obligations.
Under GDPR, a personal data breach must be reported, where feasible, within 72 hours of awareness, unless a risk to individuals is unlikely.
If a personal data breach is likely to result in a high risk to individuals’ rights and freedoms, they must generally be notified without undue delay.
In September 2026, Fakturownia reported a breach affecting all accounts, with approximately 2,250 accounts having all available data copied.
Establish the scope of compromised data
Identifying exposed invoices, accounts and payment details helps assess the potential impact on business operations.
Protect financial transactions against fraud
Unusual requests to change bank account details should be verified independently using previously confirmed contact information.
Distinguish commercial information from personal data
Not every corporate data leak requires notification to the Polish Personal Data Protection Office (UODO); the personal data involved and the level of risk determine the obligation.
Document the incident and the response
Retaining provider notifications and records of actions taken helps establish how the breach was handled.
When business information is exposed through an external provider’s systems, the affected company should establish which data has been compromised, secure access credentials and assess the potential for financial fraud. If the incident also involves personal data for which the company is the controller, its GDPR obligations must be assessed. Notification to the competent supervisory authority is required without undue delay and, where feasible, within 72 hours of becoming aware of the breach, unless a risk to individuals’ rights and freedoms is unlikely.
A company may first learn about a data breach through a notification from its invoicing platform, accounting software provider, payroll application or cloud service provider. Even if the attack did not affect the company’s own IT infrastructure, exposed invoices, business partner details, bank account numbers or employee information may require action. It is essential to distinguish between protecting commercially sensitive information and meeting legal obligations concerning personal data.
In this article:
Corporate data leaks vs. personal data breaches under GDPR
Not every corporate data leak constitutes a personal data breach. Article 4(12) of the GDPR covers, among other things, unauthorised disclosure of or access to personal data, as well as its loss or alteration. Information about a company’s pricing and commercial terms may require business protection even where it does not qualify as personal data.
Information stored by a third-party provider should therefore be divided into corporate information and data that identifies or makes it possible to identify natural persons. This distinction determines whether, in addition to protecting its business operations, the company must carry out a GDPR risk assessment.
Examples of information that may be stored in a compromised system include:
- User login credentials and access permissions;
- Invoices, transaction amounts and bank account numbers;
- Customer and supplier details, including information about sole traders;
- Contact details of individuals representing business partners;
- Employee information held in HR and payroll systems.
A breach involving exclusively commercial information does not necessarily trigger personal data breach notification requirements. However, it may still create risks of fraud or disclosure of confidential contractual terms. If the compromised dataset contains information relating to identifiable individuals, the company must also assess the potential impact on those individuals.
Who is responsible for a data breach: the service provider or the company?
If a company acts as a data controller, an incident affecting its service provider does not remove its GDPR obligations. A provider processing personal data on the company’s behalf must notify the controller without undue delay after becoming aware of a breach. The same provider may act as a controller for its own users’ personal data and as a processor for business partner information entered into the system by its customers.
Does a service provider’s GDPR breach notification fulfil the company’s obligations?
No. A notification submitted by a provider in its own capacity does not automatically replace the data controller’s notification obligations. The company must independently assess any breach involving personal data for which it is responsible. A controller may authorise another organisation to submit a notification on its behalf, but remains accountable for complying with the GDPR.
What should a company do if its data is compromised through a third-party provider?
After receiving information about a cyberattack affecting a service provider, a company should simultaneously protect its financial interests, establish the scope of the breach and determine whether it has obligations as a personal data controller. The following steps apply to businesses using the compromised system rather than to the platform operator.
Data breach response · Poland
Responding to a third-party data breach in Poland – step by step
After a cyberattack affecting a service provider, a company should protect its financial interests, establish the scope of the breach and assess its responsibilities as a personal data controller under GDPR.
01
Review the breach notification and establish its scope
Check which data may have been compromised. Request clarification from the provider if needed and record when the notification was received.
02
Secure accounts and system integrations
Depending on the incident, consider changing passwords, reviewing access permissions and revoking potentially compromised integration keys.
03
Review invoices and strengthen payment security
If commercial data was exposed, monitor suspicious invoices and payment requests. Verify unusual bank account changes using trusted contact details.
04
Assess personal data exposure and GDPR obligations
Assess risks to affected individuals and determine whether notification to the Polish Personal Data Protection Office (UODO) or affected individuals is required.
05
Document the incident and the response
Keep records of the incident and actions taken. Under Art. 33(5) GDPR, personal data breaches must be documented even if notification is not required.
Source: GDPR Art. 33; getsix® — “Third-party data breach in Poland – what should your company do under GDPR?”. UODO is Poland’s data protection authority.
1. Review the breach notification and establish its scope
Retain the notification and check whether it relates to your company’s account and what information may have been accessed or copied, including invoices, login credentials, business partner details or payment information. If the scope remains unclear, request the information needed to assess the incident from the provider. Record the date and time when the company received the notification.
2. Secure accounts and system integrations
Depending on the circumstances, consider changing passwords, reviewing active users and their permissions, terminating unfamiliar sessions and revoking potentially compromised integration keys. Check whether the same login credentials have been used in other systems.
3. Review invoices and strengthen payment security
If commercial documents or business partner information has been exposed, the finance team should closely monitor unusual payment requests, fraudulent invoices and instructions to change bank account details. Such requests should be verified through an independent communication channel using previously confirmed contact information.
4. Assess personal data exposure and GDPR obligations
Determine whether the breach involves personal data for which the company is the controller and assess the risks to affected individuals. This assessment determines whether notification to UODO or communication with affected individuals is required. Where notification is necessary, the company should not wait solely for the provider’s final technical investigation report.
5. Document the incident and the response
Retain correspondence with the provider, findings concerning the compromised data, decisions on security measures and records of payment verification. If a personal data breach has occurred, Article 33(5) of the GDPR requires the controller to document its circumstances, consequences and remedial actions, even where notification to the supervisory authority is not required.
When must a company report a third-party data breach to UODO in Poland?
Under Article 33(1) of the GDPR, a data controller must notify the competent supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to individuals’ rights and freedoms.
The notification period begins when the controller has a reasonable degree of certainty that a breach has occurred. This may follow notification from the provider or arise earlier if the company already has sufficiently reliable information.
If the 72-hour period has already passed, a required notification must still be submitted without undue delay, together with an explanation of the reasons for the delay. Where complete information is not yet available, Article 33 of the GDPR allows details to be provided in phases.
Reporting obligations · Poland · GDPR
Data breach reporting obligations in Poland
Under GDPR, a controller’s notification obligations depend on the risk a personal data breach poses to individuals’ rights and freedoms. In Poland, reportable breaches are notified to the Polish Personal Data Protection Office (UODO).
Assessment of the breach
Report to UODO
Notify the individuals
Risk is unlikely
Not required
Not required
Risk is present, but not high
Required
Generally not required
High risk to rights or freedoms
Required
Generally required *
* Subject to the exceptions provided for under GDPR.
Under Art. 33(5) GDPR, controllers must document personal data breaches, including their circumstances, consequences and remedial actions, even when notification to UODO is not required.
The 72-hour rule
Reportable personal data breaches must be notified without undue delay and, where feasible, within 72 hours of becoming aware of the breach. If notification is late, the reasons for the delay must be explained. Missing information may be provided in stages.
Up to €10M
Or 2% of total worldwide annual turnover in the preceding financial year, whichever is higher.
Maximum administrative fine for breaches of obligations under Arts. 33 and 34 GDPR, among others.
Source: GDPR Art. 33, 34 and 83(4); getsix — “Data leak in a company”. UODO is Poland’s data protection authority.
Fakturownia data breach in 2026 – consequences for businesses in Poland
On 28 September 2026, Fakturownia identified a security breach in which an unauthorised person accessed its systems and copied a substantial portion of its database. The incident affected all accounts, although the scope of the information obtained varied. Compromised information included user details, customer and supplier data, and information relating to invoices and payments.
According to the company, approximately 2,250 accounts had all available data from 2022–2026 copied, up to the relevant cut-off date for each account. Fakturownia reported the breach to UODO on 29 September 2026 and began sending individual notifications on 1 October.
For businesses using the invoicing platform, the priorities are to establish whether documents and information from their accounts were exposed, secure access and monitor the risk of fraudulent invoices or payment instructions. If the incident involved personal data for which the business acts as controller, it must also assess its GDPR obligations.
Financial and operational risks of a third-party data breach
A data breach affecting a service provider can create consequences beyond GDPR compliance, including financial fraud, exposure of confidential information and disruption to business operations.
Invoice and payment fraud
Access to business partner details, transaction histories or bank account numbers can help criminals prepare convincing fraudulent invoices and payment demands. Following the exposure of financial information, unusual requests to change bank account details should be independently verified using previously confirmed contact information.
Exposure of employee personal data
HR and payroll systems may contain salary information, residential addresses, Polish national identification numbers (PESEL) and bank account details. Exposure of this information increases the risk of fraud and privacy violations.
Loss of confidential information and business disruption
Financial documents may reveal purchase prices, order values and contractual terms, potentially weakening a company’s negotiating position.
The unavailability of accounting and payroll systems can also make it difficult to meet financial reporting deadlines and process employee salaries on time.
Practical example: data exposed through an accounting platform
A company uses cloud-based accounting software and receives a notification from its provider that certain documents from its account may have been copied. The system contains invoices, payment amounts, business partner details, including information about sole traders, and contact details of employees at other companies.
The company investigates which information may have been exposed, secures account access and alerts its finance team to potential attempts to substitute bank account numbers. Separately, it assesses whether personal data for which it acts as controller has been compromised and whether notification to the supervisory authority or affected individuals is required.
This example illustrates the need for a two-track response: protecting the company’s financial transactions and confidential information while meeting any GDPR obligations arising from the breach. Although the cyberattack occurred at the service provider, its consequences may directly affect the business using the system.
Failure to comply with obligations under Articles 33 and 34 of the GDPR, among others, may result in administrative fines of up to EUR 10 million or, in the case of an undertaking, up to 2% of its total worldwide annual turnover in the preceding financial year, whichever is higher.
How can companies in Poland reduce data security risks associated with external providers?
Article 28 of the GDPR requires controllers to engage processors that provide sufficient guarantees of appropriate security measures. Both the initial selection of a service provider and ongoing cooperation are important.
In practice, particular attention should be given to:
- Vendor due diligence – reviewing security measures, data retention policies and the use of subcontractors or subprocessors.
- Data processing agreements – defining how personal data is processed, how incidents are reported and how the parties cooperate following a breach.
- Access management – restricting access according to employees’ responsibilities and applying appropriate authentication methods.
- Incident response procedures – assigning responsibility for breach assessments, provider communications, UODO notifications and documentation.
- Business continuity – preparing alternative arrangements for critical processes if systems become unavailable.
A data processing agreement alone does not guarantee security. Effective implementation of the agreed procedures is equally important.
At getsix®, client data security is an important part of our accounting services in Poland and HR and payroll services. Our Information Security Management System meets the requirements of ISO/IEC 27001:2022, while our Quality Management System is certified to ISO 9001. These frameworks support the confidentiality, integrity and availability of information entrusted to us.
Third-party data breaches – key takeaways for businesses in Poland
A company whose information may have been compromised through an external system should first establish the scope of the exposed data, secure accounts and integrations, and assess the risk of invoice and payment fraud. Personal data for which the company acts as controller requires a separate assessment.
A notification submitted by the service provider does not automatically fulfil the customer’s own obligations. Equally, the exposure of corporate information does not mean that every affected company must notify UODO. The deciding factors are the scope of the personal data breach and the associated risk assessment.
For companies using accounting software, invoicing platforms and HR and payroll systems, information security should form part of financial and operational risk management. getsix® supports businesses operating in Poland with the organisation of their accounting and payroll processes, taking into account the requirements of the Polish business environment. Contact us.
This article was written by the getsix® Editorial Teamgetsix® provides accounting, tax advisory, HR and payroll, and business consulting services, supporting companies operating in Poland. The getsix® Editorial Team prepares practical information that makes Polish accounting, tax, and HR and payroll matters easier to understand.
If you have any questions regarding this topic or if you are in need for any additional information – please do not hesitate to contact us:
CUSTOMER RELATIONSHIPS DEPARTMENT
ELŻBIETA
NARON-GROCHALSKA
Head of Customer Relationships
Department / Senior Manager
getsix® Group
***
