Is the data protection officer liable for a personal data breach?

Why this question arises at all

When a personal data breach occurs, the DPO is usually the most visible person in the organisation. The DPO’s name and contact details go into the notification that the controller submits to the President of UODO, unless the organisation indicates another contact point (Article 33(3)(b) GDPR).

The question also comes back in cybersecurity, because the Polish Act on the National Cybersecurity System (KSC) makes the head of an essential or important entity responsible for the entity’s performance of the cybersecurity obligations set out in the Act (Article 8c(1)). The GDPR has no counterpart to such a provision. The construction of the KSC Act is covered in What is the head of an essential or important entity personally responsible for?.

What has to be established before you assign liability

Who is liable for a breach towards the authority and data subjects

The GDPR places breach-related obligations primarily on the controller. The controller implements appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with the Regulation (Article 24(1)). It is responsible for compliance with the principles relating to processing and must be able to demonstrate that compliance (Article 5(2)). After becoming aware of a breach it notifies the supervisory authority without undue delay and where feasible not later than 72 hours, unless the breach is unlikely to result in a risk (Article 33(1)). It documents any personal data breaches (Article 33(5)). Where the breach is likely to result in a high risk, the controller communicates the breach to data subjects without undue delay (Article 34(1)). The processor notifies the breach to the controller (Article 33(2)).

A person who has suffered damage as a result of an infringement of the Regulation has the right to receive compensation from the controller or processor (Article 82(1)). A processor is liable for damage only where it has not complied with obligations of the GDPR specifically directed to processors or where it has acted outside or contrary to lawful instructions of the controller (Article 82(2)).

The administrative fine under Article 83(4)(a) concerns the obligations of the controller and the processor listed in that provision, including the obligations under Articles 25 to 39. This covers notification and communication under Articles 33 and 34 and the obligations relating to the DPO under Articles 37 and 38. An infringement of the principle of integrity and confidentiality in Article 5(1)(f) is subject to a fine under Article 83(5)(a). No paragraph of Article 83 names the DPO as a party on whom a fine is imposed.

The Article 29 Working Party guidelines on data protection officers (WP 243) set out a general rule. The DPO is not personally responsible for non-compliance with data protection requirements. It is the controller or the processor who is required to ensure and to be able to demonstrate that processing is performed in accordance with the GDPR.

The supervisory authority enforces the obligations relating to the DPO against the controller or processor, as the case of a bailiff who was the DPO in their own office shows. The case came to light when UODO verified a breach notification that the bailiff had submitted to the President of UODO. The President of UODO fined the bailiff as controller for failing to ensure the DPO’s independence and for not notifying the authority of the DPO’s designation.

What the DPO does in a breach

The DPO has no controller obligations in a breach but has their own tasks. The controller and the processor ensure that the DPO is involved properly and in a timely manner in all issues which relate to the protection of personal data (Article 38(1)). According to the WP 243 guidelines, the DPO must be promptly consulted once a data breach or another incident has occurred. The European Data Protection Board (EDPB) recommends that the DPO is promptly informed about a breach and is involved throughout the breach management and notification process.

The DPO’s tasks are set out in Article 39(1). In a breach the most relevant are informing and advising the controller (point (a)) and monitoring compliance (point (b)). Cooperation with the supervisory authority (point (d)) and acting as its contact point (point (e)) are added to these. The DPO performs the tasks with due regard to the risk associated with processing operations (Article 39(2)). According to the UODO guide, the DPO also gives guidance on remedying breaches, notifying them and communicating them to data subjects. The DPO may also pass additional information on the breach to the authority and to data subjects.

What the DPO does not do for the controller

According to the WP 243 guidelines, the DPO’s autonomy does not mean that the DPO has decision-making powers extending beyond their tasks under Article 39. The decision whether to notify a breach and whether to communicate it to data subjects belongs to the controller (Article 33(1) and Article 34(1)).

The UODO guide goes further. According to the guide, the DPO may not perform tasks for which only the controller or processor is responsible. The guide lists five activities that the DPO should not perform.

1. Notifying breaches to the President of UODO on behalf of the controller, and signing and sending such notifications.
2. Communicating breaches to data subjects on behalf of the controller.
3. Documenting breaches on behalf of the controller, in particular where this would involve determining the purposes and means of processing or deciding on remedial action.
4. Making commitments regarding the security of processing on behalf of the controller or processor.
5. Acting under a power of attorney in personal data protection matters.

The guide justifies this by the need to avoid a conflict of interests and to ensure independence. It also warns that a breach of the rules on the DPO’s position may lead to sanctions by the President of UODO, including administrative fines. The obligations under Article 38(1) to (3) and (6) that secure this position rest with the controller and the processor.

The EDPB Guidelines 9/2022 allow the DPO to be additionally tasked with maintaining breach records. In my assessment the DPO may keep the register technically if the controller decides on the content of each entry, the risk assessment and the remedial action. The UODO guide, however, makes no exception for technical record-keeping. It is therefore safer to entrust the register to a person on the controller’s side. If the register stays with the DPO, it is worth having the content of each entry approved on the controller’s side.

A DPO who takes over the decision and the signature does not take over the obligation under Article 33. The obligation rests with the controller, that is the party that determines the purposes and means of processing (Article 4(7)). When signing, the DPO acts on behalf of the controller. A controller that allows this may infringe the requirements of independence and absence of a conflict of interests under Article 38(3) and (6). In my assessment the takeover may also extend the DPO’s liability towards the organisation when a contract or an instruction makes the notification part of the DPO’s tasks.

When DPO liability arises

The DPO is not liable for the controller having decided differently from the advice it received. The DPO is liable for the way they performed their own tasks.

Article 38(3) GDPR provides that the DPO shall not be dismissed or penalised by the controller or the processor for performing their tasks. According to the WP 243 guidelines, penalties are prohibited only where they are imposed as a result of the DPO carrying out their tasks. According to the guidelines, the DPO cannot be dismissed for advising a data protection impact assessment when the controller disagrees with that advice.

UODO adds that the provision should be read as referring to objectively proper performance of the tasks. According to the authority, it is not meant to protect a DPO who does not perform their tasks properly.

DPO liability may concern neglect of the DPO’s own task, including advice given without due diligence. One example is a DPO who received information about a breach and did not pass it on to the decision-makers for several days. Another example is disclosure of information covered by secrecy or confidentiality that the DPO is obliged to keep (Article 38(5) GDPR and for an employee also Article 100 § 2(4) and (5) of the Polish Labour Code). Even then the GDPR does not name the DPO among the addressees of fines and compensation. Towards the President of UODO the controller is responsible for timely notification, and according to the EDPB it must ensure that it becomes aware of breaches in a timely manner (Guidelines 9/2022, paragraph 32).

The DPO may be a staff member of the controller or processor or fulfil the tasks on the basis of a service contract (Article 37(6)). The liability regime depends on whether the DPO is an employee. This is decided by the actual manner in which the work is performed and not by the name of the contract (Article 22 § 1¹ of the Labour Code).

DPO liability under an employment contract

An employee who through their own fault causes damage to the employer by failing to perform or improperly performing their employee duties bears material liability (Article 114 of the Labour Code). The Code limits this liability in several places.

1. The employer must prove the circumstances justifying the employee’s liability and the amount of the damage (Article 116).
2. The employee is liable within the limits of the actual loss and only for the normal consequences of their act or omission (Article 115).
3. The employee is not liable to the extent that the employer or another person contributed to the damage or its increase (Article 117 § 1). The employee also does not bear the risk related to the employer’s activity and in particular is not liable for damage resulting from acting within the limits of acceptable risk (Article 117 § 2).
4. Compensation may not exceed three months’ remuneration as at the day the damage was caused (Article 119). A clause in the employment contract raising this cap is invalid (Article 18 § 2). A settlement or the labour court may reduce the compensation (Article 121). An employee who caused the damage intentionally redresses it in full without the cap of Article 119 (Article 122).

The employer’s claim becomes time-barred one year after the day on which the employer learned of the damage caused by the employee but no later than three years after the damage was caused (Article 291 § 2). Where the damage was caused intentionally, the limitation periods of the Civil Code apply (Article 291 § 3).

Damage caused by an employee to a third party in the performance of employee duties is redressed solely by the employer (Article 120 § 1). A data subject affected by the breach therefore cannot claim compensation from such a DPO for damage caused in the performance of their duties. This also applies to an employee of a firm acting as DPO or of another company in the group. The employer is then liable for damage caused through the fault of the employee in performing the entrusted activity (Article 430 of the Polish Civil Code). Towards the employer that has redressed the damage, the employee is liable under the rules of material liability (Article 120 § 2).

In the event of a serious breach of basic employee duties the employer may also terminate the contract without notice within one month of learning of that circumstance (Article 52 § 1(1) and § 2 of the Labour Code). According to the Court of Justice of the EU, Article 38(3) GDPR protects the DPO against any decision terminating their duties, placing them at a disadvantage or constituting a penalty. Such a decision may be the termination of the employment relationship, and the protection also covers a DPO under a service contract (judgment in C-534/20, paragraphs 21 to 24). The prohibition applies only where the reason for the decision is the performance of the DPO’s tasks.

DPO liability under a service contract

Contracts for the provision of services that are not governed by other provisions are subject to the rules on mandate applied accordingly (Article 750 of the Civil Code). A DPO on a civil-law contract or a firm acting as DPO is liable for non-performance or improper performance of the contract under the general rules.

1. The debtor redresses damage resulting from non-performance or improper performance of an obligation unless it results from circumstances for which the debtor is not responsible (Article 471).
2. Unless a specific provision or the contract provides otherwise, the debtor is liable for failing to exercise due diligence (Article 472). In business activity, due diligence is assessed taking into account its professional character (Article 355 § 2).
3. Liability covers only the normal consequences of an act or omission (Article 361 § 1). Contribution by the injured party reduces the compensation (Article 362).
4. The service provider is as a rule liable as for its own acts for persons assisting it in performing the contract and for persons to whom it entrusts the performance (Article 474).

The DPO is as a rule liable for lack of due diligence, while the controller is responsible for the compliance of processing (Article 472 of the Civil Code and Article 24(1) GDPR). A breach at the controller does not in itself prove improper performance of the contract by the DPO.

The Civil Code sets no upper limit for this liability similar to Article 119 of the Labour Code. Unless a statutory provision or a contractual clause provides otherwise, compensation covers the losses suffered and the profits lost (Article 361 § 2).

Within the limits of freedom of contract (Article 353¹ of the Civil Code) the parties may limit the service provider’s liability, for example to a specific amount. A clause that the debtor will not be liable for damage caused intentionally is invalid (Article 473 § 2).

The contract may also provide for contractual penalties. The penalty is due regardless of the amount of the damage, and compensation exceeding it is available only where the contract so provides (Article 484 § 1). The other clauses of that contract, including the line between a service metric and a prohibited instruction, are covered in What should a contract with an external data protection officer contain?.

Towards the injured person a DPO on a civil-law contract is liable under the general rules for damage caused through their own fault (Article 415 of the Civil Code). Where personal rights are infringed, the provisions on their protection also apply (Article 24 § 1 and Article 448). Both regimes concern the DPO’s own act, for example disclosure of data, and not a breach on the controller’s side.

Can the controller recover a UODO fine from the DPO?

The provisions do not expressly settle whether the controller may claim back from the DPO a fine it has paid. In my assessment such a claim has a narrow scope. A fine under Article 83 sanctions the controller’s obligation, and its amount depends among other things on the intentional or negligent character of the infringement and on the controller’s degree of responsibility (Article 83(2)(b) and (d)).

The controller would have to prove that the fine is a normal consequence of the DPO’s neglect (Article 361 § 1 of the Civil Code and Article 115 of the Labour Code). Under an employment contract it would also have to prove the DPO’s fault (Articles 114 and 116 of the Labour Code). A DPO on a civil-law contract is released by proving circumstances for which they are not responsible (Article 471 of the Civil Code). Contribution by the controller itself would reduce the compensation (Article 362 of the Civil Code and Article 117 § 1 of the Labour Code). Such contribution may consist in not following the DPO’s recommendation or in failing to provide resources (Article 38(2) GDPR).

A wider scope of such a claim is supported by the fact that a fine paid is an actual loss of the organisation. If the DPO was at fault, for example by withholding information about the breach, a link between a fine for late notification and the DPO’s neglect may be provable. Where the DPO warned against the breach, the fine results from the controller’s decision and is hard to link to any neglect by the DPO. A claim to recover such a fine could also infringe the prohibition of penalising the DPO for performing their tasks under Article 38(3), because according to WP 243 penalties may be direct or indirect. According to the guidelines, penalties may also consist in absence of promotion or denial of benefits that other employees receive. They add that the penalties do not have to be carried out, as a mere threat is sufficient when it is used to penalise the DPO on grounds related to their DPO activities.

A civil-law contract may admittedly extend the service provider’s liability (Article 473 § 1 of the Civil Code). In my assessment a clause requiring reimbursement of any UODO fine regardless of the DPO’s fault is nevertheless risky, because it would also cover a fine for a decision taken contrary to the DPO’s recommendation (Article 38(3) GDPR).

Criminal liability of the DPO

The Polish Act on the Protection of Personal Data provides for offences that anyone can commit. A penalty applies to anyone who processes personal data where processing is not permitted or where they are not authorised to process it (Article 107(1)). A penalty also applies to anyone who frustrates or obstructs an inspector in carrying out an inspection of compliance with data protection law (Article 108(1)). These provisions also apply to the DPO but only to their own act and not to a breach in the organisation.

The Polish Criminal Code also penalises anyone who, contrary to statutory provisions or an obligation they have assumed, discloses or uses information learned among other things in connection with their function or work (Article 266 § 1). Prosecution takes place at the request of the injured party (Article 266 § 3). The offences under Articles 107 and 108 of the Act and under Article 266 of the Criminal Code can be committed only intentionally, because the provisions do not provide for an unintentional form (Article 8 of the Criminal Code).

A DPO who is an employee of the government administration, another state body or local government is a public official unless they perform only service activities (Article 115 § 13(4)). A public official is liable when they exceed their powers or fail to perform their duties and act to the detriment of the public or a private interest (Article 231 § 1). When they act unintentionally, they are liable if they cause substantial damage (Article 231 § 3). A public official who discloses among other things information obtained in connection with official activities to an unauthorised person is liable more severely where the disclosure may expose a legally protected interest to harm (Article 266 § 2). This offence is prosecuted ex officio, as Article 266 § 3 requires a request only for the offence under § 1. Anyone is also liable for aiding, for example when they facilitate an act by another person with advice or information, intending that the act be committed (Article 18 § 3).

Who is liable for what in a breach

The GDPR applies from 25 May 2018 (Article 99(2)).

Liability	Who and towards whom	Legal basis	Exceptions and limitations
Breach notification, communication to data subjects, documentation — from becoming aware of the breach	controller towards the President of UODO and data subjects; the DPO advises and acts as contact point	Article 33(1) and (5) and Article 34 GDPR	no notification where the breach is unlikely to result in a risk; exceptions in Article 34(3)
Administrative fine — from the infringement of the obligation	controller or processor towards the President of UODO	Article 83(4)(a) and (5)(a) GDPR and Articles 101 and 102 of the Polish Act on the Protection of Personal Data	separate rules for public finance sector units, research institutes and the National Bank of Poland (Article 102 of the Act)
Compensation under the GDPR — from the damage	controller or processor towards the person who suffered damage	Article 82 GDPR	processor only in the cases in Article 82(2); exemption where they prove they are not in any way responsible for the event (Article 82(3))
DPO liability under an employment contract — from the damage	DPO towards the employer	Articles 114 to 122 of the Labour Code	fault; actual loss and the cap of three months’ remuneration except for intentional damage; contribution by the employer or another person; reduction by settlement or court; damage to a third party redressed solely by the employer
DPO liability under a service contract — from the damage	DPO or the firm acting as DPO towards the client	Article 750 and Articles 471 to 474 of the Civil Code and the contract	due diligence; normal consequences; contribution; no statutory cap and the contract may limit liability except for intentional damage (Article 473 § 2)
Tort liability — from the damage	the DPO on a civil-law contract and the DPO’s employer (also for the employee’s fault) towards the person who suffered damage	Articles 415 and 430 and Article 24 § 1 and Article 448 of the Civil Code	fault under Articles 415 and 430; an employee is not liable towards the injured person for damage caused in performing their duties (Article 120 § 1 of the Labour Code)
Criminal liability — from the commission of the act	any perpetrator including the DPO towards the state	Articles 107 and 108 of the Polish Act on the Protection of Personal Data and Articles 18, 231 and 266 of the Criminal Code	own act including aiding (Article 18 § 3); intent except under Article 231 § 3 (Article 8); the perpetrator under Article 231 and Article 266 § 2 is a public official; the offence under Article 266 § 1 is prosecuted on request

Conclusions and next steps

The WP 243 guidelines give two practices that help document the division of roles. The opinion of the DPO must always be given due weight, and in case of disagreement the guidelines recommend as good practice documenting the reasons for not following the DPO’s advice. If the controller makes decisions that are incompatible with the GDPR and the DPO’s advice, the DPO should be given the possibility to make their dissenting opinion clear to the highest management level and to those making the decisions.

Steps for the board and the controller.

1. Set out in the breach handling procedure who decides on notification and communication and who signs them. Give the signatory and their deputy a power of attorney and access to the notification form before the first breach.
2. Check whether the DPO notifies breaches, communicates them to data subjects or documents breaches on behalf of the controller or under a power of attorney. If so, move notification and communication to a person acting on behalf of the controller who is not the DPO. If the breach register stays with the DPO, approve the entries on the controller’s side.
3. Introduce a breach assessment form with the date and time of becoming aware of the breach and of informing the DPO. Provide separate fields for the DPO’s position, the controller’s decision and the reason for departing from the recommendation, each with a date and time.
4. Check whether the President of UODO holds a current notification of the DPO’s designation (Article 10(1) and (5) of the Polish Act on the Protection of Personal Data). Where several companies in a group designate the DPO, each of them notifies.
5. Consider designating a person to replace the DPO during their absence, taking into account the criteria in Article 37(5) and (6) GDPR. That person’s designation is notified to the President of UODO, and their details are made available like the DPO’s details (Article 11a of the Act).
6. Check the scope of the service and the response time in the civil-law contract with the DPO. Also check the deputy arrangements, the liability cap, contractual penalties and any clause on reimbursing UODO fines. If the service provider holds civil liability insurance, check the policy exclusions.

Steps for the DPO.

1. Give your position on a breach in writing or in a system that records the date and time.
2. Keep a record of your positions and recommendations and of what happened to them. Add your requests for resources and the responses to them.
3. Check your scope of duties and your contract to make sure no clause transfers the controller’s decisions to you.
4. When the board asks or instructs you to sign a notification, reply in writing and name the person who signs it on behalf of the controller under the procedure. Refer to Article 38(6) GDPR and to the UODO guide, under which the DPO should not sign notifications on behalf of the controller.

Related materials

• What information should the board expect from the DPO? — the DPO’s report and the tasks that the role does not cover.
• What should a contract with an external data protection officer contain? — the framework of cooperation, service metrics and termination of the contract.
• Does every data breach need to be reported? — the risk assessment that the controller decides on.
• What is the head of an essential or important entity personally responsible for? — the personal responsibility of the head of the entity under the KSC Act.

Sources

• Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), consolidated version — Article 4(7), Article 5, Article 24(1), Article 33, Article 34, Article 37, Article 38, Article 39, Article 82, Article 83 and Article 99(2) — eur-lex.europa.eu.
• Act of 10 May 2018 on the Protection of Personal Data, consolidated text as at 18 August 2026 — Articles 10, 11a, 101, 102, 107 and 108 (in Polish) — isap.sejm.gov.pl.
• Act of 26 June 1974 — Labour Code, consolidated text (Journal of Laws 2026, item 1245) — Article 18 § 2, Article 22 § 1¹, Article 52 § 1(1) and § 2, Article 100 § 2(4) and (5), Articles 114 to 122 and Article 291 § 2 and § 3 (in Polish) — isap.sejm.gov.pl.
• Act of 23 April 1964 — Civil Code, consolidated text (Journal of Laws 2026, item 795) — Article 24 § 1, Article 353¹, Article 355 § 2, Articles 361 and 362, Article 415, Article 430, Article 448, Articles 471 to 474, Article 484 § 1 and Article 750 (in Polish) — isap.sejm.gov.pl.
• Act of 6 June 1997 — Criminal Code, consolidated text as at 28 July 2026 (Journal of Laws 2025, item 383, as amended) — Article 8, Article 18 § 3, Article 115 § 13(4), Article 231 § 1 and § 3 and Article 266 § 1 to § 3 (in Polish) — isap.sejm.gov.pl.
• Act of 5 July 2018 on the National Cybersecurity System, consolidated text as at 18 August 2026 — Article 8c(1) (in Polish) — isap.sejm.gov.pl.
• Personal Data Protection Office (UODO), Guide on personal data breaches, version of 20 February 2025 — section 3.6 (in Polish) — uodo.gov.pl; Personal Data Protection Office (UODO), What guarantees of independence are granted to the DPO under the GDPR? (in Polish) — uodo.gov.pl; Personal Data Protection Office (UODO), Fine for failing to ensure the independence of the data protection officer, communication of 31 August 2026 on decision DKN.5131.24.2025 (in Polish) — uodo.gov.pl.
• Article 29 Data Protection Working Party, Guidelines on Data Protection Officers (‘DPOs’) (WP 243 rev.01) — sections 3.1, 3.3, 3.4 and 4.1 and question 12 — ec.europa.eu.
• European Data Protection Board, Guidelines 9/2022 on personal data breach notification under GDPR, version 2.0 adopted 28 March 2023 — paragraphs 32, 132 and 133 — edpb.europa.eu.
• Judgment of the Court of Justice of 22 June 2022, C-534/20 Leistritz — paragraphs 21 to 24 — eur-lex.europa.eu.