{"id":6088,"date":"2026-10-30T18:49:48","date_gmt":"2026-10-30T17:49:48","guid":{"rendered":"https:\/\/www.lablogic.pl\/?p=6088"},"modified":"2026-10-30T19:46:36","modified_gmt":"2026-10-30T18:46:36","slug":"nis2-criminal-record-check","status":"publish","type":"post","link":"https:\/\/www.lablogic.pl\/en\/nis2-criminal-record-check\/","title":{"rendered":"Who must be checked in the National Criminal Register for NIS2, and when?"},"content":{"rendered":"\n<p class=\"ll-art-meta wp-block-paragraph\"><a href=\"https:\/\/www.lablogic.pl\/en\/michal-rutkowski\/\"><strong>Micha\u0142 Rutkowski<\/strong><\/a> \u2022 for HR, security and compliance \u2022 published October 30, 2026 \u2022 15 min read<\/p>\n\n\n\n<div class=\"wp-block-columns ll-art-shell is-layout-flex wp-container-core-columns-is-layout-7387b849 wp-block-columns-is-layout-flex\">\n<div class=\"wp-block-column ll-art-rail is-layout-flow wp-block-column-is-layout-flow\">\n<div class=\"wp-block-group ll-art-railinner is-layout-constrained wp-block-group-is-layout-constrained\">\n\n\n\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-column ll-art-main is-layout-flow wp-block-column-is-layout-flow\">\n<div class=\"wp-block-group ll-art-answer is-layout-constrained wp-block-group-is-layout-constrained\">\n<h2 id=\"krotka-odpowiedz\" class=\"wp-block-heading\">Short answer<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The criminal record check under Article 8f of the Polish Act on the National Cybersecurity System (KSC) covers persons who perform tasks under Article 8 (information security management system) or Article 11 (among other things incident handling and reporting) in an essential or important entity. In practice this means among others the security team, administrators who implement and maintain security measures, persons handling incidents and the owner of the risk assessment process. Before starting these tasks, including when moving to them from another role, the person presents information from the National Criminal Register (KRK) on the absence of convictions for offences against the protection of information.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The head of the entity admits the person to the tasks after receiving the information. A valid security clearance at the \u2018confidential\u2019 level or higher also meets the requirement. A person finally convicted of an offence against the protection of information may not perform these tasks until the conviction is expunged. According to the Minister of Digital Affairs the check covers current and future staff performing these tasks, that is employees and persons under civil-law contracts concluded directly with the entity, but not the staff of suppliers. The wording of Article 8f does not contain this limitation. The entity calls on the person to present the information again where it has a justified suspicion of a conviction for an offence against the protection of information, and according to the Minister not periodically. An entity that met the criteria on 3 April 2026 adapts to Article 8f by 3 April 2027 at the latest. An entity that meets the criteria later has 12 months from meeting them or from service of the decision on its recognition.<\/p>\n<\/div>\n\n\n\n<h2 id=\"dlaczego-pytanie\" class=\"wp-block-heading\">Why this question arises at all<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The criminal record check brings together the work of the security department, HR and the data protection officer.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The KSC Act does not list the positions covered by the check. Without a common procedure one organisation can easily narrow the circle of persons checked, while another collects data for which it has no legal basis.<\/p>\n\n\n\n<h2 id=\"co-ustalic\" class=\"wp-block-heading\">What has to be established before introducing the check<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Who the criminal record check covers<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The criminal record check covers a person who is to perform tasks under Article 8 or Article 11 (Article 8f(1)). With the criterion of implementing, maintaining and carrying out the measures of the system and of incident handling, the circle of persons usually covers the following roles.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>The person in charge of information security and the security team.<\/li>\n\n\n\n<li>System and network administrators who implement and maintain security measures in systems affecting the provision of the service.<\/li>\n\n\n\n<li>The identity and privileged access management team.<\/li>\n\n\n\n<li>The incident monitoring and handling team together with on-call staff.<\/li>\n\n\n\n<li>Persons who classify incidents and submit reports to the CSIRT.<\/li>\n\n\n\n<li>Administrators and owners of systems on the escalation list who remove the effects of incidents and vulnerabilities.<\/li>\n\n\n\n<li>The owner of the risk assessment process and the business continuity plan coordinator.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The system under Article 8 concerns the information system used in the processes affecting the provision of the service and covers among others risk assessment and technical and organisational measures, as well as incident management (Article 8(1)(1)\u2013(5)). Article 11 covers among others the handling and classification of an incident, reports to the CSIRT, cooperation with it and the removal of vulnerabilities indicated by the authority (Article 11(1)). Incident handling includes among others its detection, recording, analysis and limiting its effects (Article 2(10)).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In my assessment the deciding factor is whether the person implements, maintains or carries out a measure of the system or an act of incident handling. On this reading merely following policies and cyber hygiene rules is not the performance of tasks under Article 8. Against this it can be pointed out that Article 8(1)(2)(j) lists cyber hygiene rules among the measures of the system.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The intermediate zone is the most difficult. HR is usually responsible for human resources security and the purchasing department for the supply chain (Article 8(1)(2)(d) and (e)). The same applies to programmers and testers (point (b)), physical security (point (c)), persons delivering training (point (i)) and asset management (point (m)). Covering these roles is supported by the fact that the Act lists these areas as elements of the system. Against it is the fact that Article 8f provides a basis for processing data on convictions only of persons who perform the tasks. In the intermediate zone I recommend checking a person who designs, implements or maintains a given measure or decides on it at a level lower than the board. This also applies to first-line support if it records events as incidents or assigns them a category or priority (Article 2(10)). A person who is merely subject to a given measure or passes a report on without assessing it can be left out. It is worth recording the criterion and the list of omitted roles with reasons in the procedure.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In the banking and financial market infrastructure sector Article 8f applies accordingly (Article 8i(2)). Only Article 8(1)(1) and Article 8(1)(2)(j) apply there, and of Article 11(1) only points (5) and (6) (Article 8i(1)). The circle of persons therefore has to be established separately in that sector. A public entity applies Article 8f if it uses an information system to perform a public task (Article 16d).<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Employee, contractor, B2B or supplier staff?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The KSC Act does not make the obligation depend on the form of employment. According to the Minister the intention of the drafters was to cover persons in a direct relationship with the entity, that is employees and persons under civil-law contracts concluded directly with the entity, if they perform tasks under Article 8 or 11 (Q&amp;A 3.48). According to the Minister the obligation does not cover employees or associates of service providers, including the staff of contractors and subcontractors. The Minister&#8217;s position is not binding, and the wording of Article 8f does not contain a condition of a direct relationship.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In my assessment the prohibition in Article 8f(4) also covers a supplier&#8217;s employee, because it concerns every person performing the tasks. Given the Minister&#8217;s position a request for information from the register about a supplier&#8217;s people can however easily be challenged as processing of data under Article 10 GDPR without a legal basis. The entity therefore limits the risk that a convicted employee of a supplier performs the tasks through supply chain and access control measures (Article 8(1)(2)(e) and (n)). The Minister also points to contractual provisions in this respect (Q&amp;A 3.48). A managed security service provider that is at least a small enterprise is itself an essential entity (Article 5(1)(3)). According to the Minister it is subject to the Act even if it serves only its own group (Q&amp;A 1.21 and 3.34). Such a provider applies Article 8f to persons performing its own tasks under Article 8 or 11. According to the Minister merely providing staff is not a managed security service if the firm does not process data related to the client&#8217;s information security management system (Q&amp;A 1.37).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The answer to Q&amp;A 3.48 does not separately mention a person who performs the tasks personally under a contract concluded through their own business. In my assessment that person is a party to a civil-law contract with the entity and not part of a supplier&#8217;s staff. Against this it can be pointed out that in another answer the Minister lists a contract with an entrepreneur alongside a civil-law contract (Q&amp;A 2.60).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In a group of companies Article 8f is applied separately by each company that is an essential or important entity to persons performing its own tasks (Article 8f(1)). A group company providing services to other companies is a separate entity in relation to them. That is why the Minister considers that a company providing managed security services to the group is subject to the Act (Q&amp;A 3.34). For the staff of a group company providing services I recommend the measures that the Minister indicates for the staff of suppliers (Q&amp;A 3.48).<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Does a board member also present information from the National Criminal Register?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The KSC Act does not say who checks the head of the entity itself. A board member may however personally perform operational tasks under Article 8 or 11, for example lead incident handling. In my assessment that member should then present the information like any other person, and the admission may be recorded by the other board members. Against this is the fact that the KSC Act does not provide for the admission of the head of the entity.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Which offences count and what the result means<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The information must confirm the absence of convictions for offences against the protection of information (Article 8f(1)). Chapter XXXIII of the Criminal Code bears this title, and the Minister lists eight offences from it (Q&amp;A 3.10).<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Disclosure of classified information (Article 265).<\/li>\n\n\n\n<li>Disclosure of official information (Article 266).<\/li>\n\n\n\n<li>Unlawful obtaining of information (Article 267).<\/li>\n\n\n\n<li>Destruction of information (Article 268).<\/li>\n\n\n\n<li>Destruction of data in systems (Article 268a).<\/li>\n\n\n\n<li>Computer sabotage (Article 269).<\/li>\n\n\n\n<li>Disruption of networks and systems (Article 269a).<\/li>\n\n\n\n<li>Unlawful use of programs and data (Article 269b).<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">A conviction for an offence from another chapter, for example computer fraud (Article 287), does not affect the result of the check under Article 8f. An entry on conditional discontinuance of proceedings or on pre-trial detention is not a conviction (Article 1(2)(2) and (9) of the Act on the National Criminal Register). A judgment with a conditionally suspended sentence is however a conviction. Such a conviction is in principle expunged one year after the end of the probation period (Article 76 \u00a7 1 of the Criminal Code).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The prohibition in Article 8f(4) applies until the conviction is expunged, because an expunged conviction is deemed never to have occurred (Article 106 of the Criminal Code). The Criminal Code treats as a conviction in principle also a final judgment of a criminal court of another EU Member State, and the law of the State of conviction decides on its expungement (Article 114a \u00a7 1 and 2 of the Criminal Code). Article 8f(4) does not specify the State of the court, so it is safer to apply the prohibition also to such a judgment. However, the register collects foreign convictions only of Polish citizens (Article 1(2)(4) of the Act on the National Criminal Register). Information issued at the request of a citizen of another EU Member State also covers data from the criminal record of the State of that person&#8217;s nationality (Article 20(1d) of the Act on the National Criminal Register). A person who is or was a citizen of another EU Member State or who resides or resided in its territory may also request a query to the register of that State (Article 7(1a)). Outside these cases the information will not show foreign convictions of a foreign national.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What to do on refusal or conviction<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Without information confirming the absence of convictions or a valid security clearance the head of the entity does not admit the person to the tasks (Article 8f(1) and (3)). A refusal to present the information is not protected by Article 22\u00b9\u1d43 \u00a7 2 of the Labour Code, because that provision concerns the lack of consent and consent may not cover data under Article 10 GDPR (\u00a7 1). It is worth obtaining the information from a candidate before concluding the contract, because a negative result does not terminate the contract by itself (Article 30 \u00a7 1 of the Labour Code).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">An employee finally convicted of an offence against the protection of information immediately stops performing tasks under Article 8 or 11 (Article 8f(4)). The employer may assign the employee other work for up to 3 months in a calendar year without giving notice of a change in the terms. This requires a justified need of the employer, work corresponding to the employee&#8217;s qualifications and retention of the remuneration (Article 42 \u00a7 4 of the Labour Code). A permanent change requires notice of a change in the terms (Article 42 \u00a7 1\u20133) or an agreement of the parties. Termination without notice under Article 52 \u00a7 1(2) requires an offence committed during the term of the contract that makes further employment in the current position impossible. The offence must be obvious or established by a final judgment. The employer has one month from learning of this circumstance and seeks the opinion of the company trade union organisation representing the employee (Article 52 \u00a7 2 and 3). For a civil-law contract the consequences depend on its terms.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">A security clearance instead of information from the register<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The requirements of Article 8f(1) and (2) are deemed met if the person holds a valid security clearance authorising access to classified information at the \u2018confidential\u2019 level or higher (Article 8f(3)). It is therefore worth obtaining information from the register from the person before the clearance expires.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">When to present the register information and what the deadline is<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The criminal record check precedes the start of the tasks, including when the person moves to them from another role (Article 8f(1)). The practical checkpoint is the assignment of the person to tasks under Article 8 or 11 or the actual entrustment of those tasks to the person. It is worth preceding the granting of access with the check if the access will be used to implement, maintain or carry out measures or to handle incidents. It is worth flagging permissions for these tasks in the identity management system and granting them only after admission.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Entities that met the criteria for recognition as an essential or important entity on the day the amendment entered into force perform the obligations under Chapter 3 of the Act within 12 months (Article 33(1) of the amending act). That chapter includes Article 8f. The amendment entered into force on 3 April 2026 (Article 49), so the deadline expires on 3 April 2027. An entity that meets the criteria later has 12 months from the day of meeting them (Article 16(1)). An entity recognised by a decision counts this period from its service (Article 7l(7) and Article 7m(6)).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The KSC Act links the obligation to present the information with the start of the tasks and has no transitional provision for persons who already performed them earlier. In my assessment after the adaptation deadline the entity should have information from the register or the details of a valid security clearance for those persons as well. This is supported by the prohibition in Article 8f(4), which applies to every person performing the tasks. Without the information the entity cannot check whether the person is subject to the prohibition. The Minister also includes current staff in the check (Q&amp;A 3.29). Against this one can point to the wording of paragraph 1, which refers to the moment of starting the tasks.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The Minister considers it legitimate to collect data on the absence of convictions during the adaptation period from persons who will also perform the tasks after it ends, including in ongoing recruitment (Q&amp;A 3.28). During recruitment the information from the candidate selected for the tasks is enough, because data from the others are not necessary for the purpose of the check (Article 5(1)(c) GDPR). The KSC Act does not specify how long before admission the information may be issued, so it is worth setting the maximum interval in the procedure.<\/p>\n\n\n\n<figure class=\"wp-block-table ll-art-table\"><table><thead><tr><th>Situation<\/th><th>What to do<\/th><th>Basis<\/th><th>Exceptions and limits<\/th><\/tr><\/thead><tbody><tr><td>The person is to start tasks under Article 8 or 11, including after moving from another role<\/td><td>obtain information confirming the absence of convictions before the tasks start and admit the person after receiving it; it is worth recording the admission<\/td><td>Article 8f(1)<\/td><td>a valid security clearance is sufficient (Article 8f(3)); adaptation deadline \u2014 Article 33(1) of the amending act, Article 16(1), Article 7l(7) and Article 7m(6)<\/td><\/tr><tr><td>The person already performs tasks under Article 8 or 11<\/td><td>obtain the information before the adaptation deadline expires<\/td><td>Article 8f(1) and (4); Q&amp;A 3.29; assessment<\/td><td>a valid security clearance is sufficient (Article 8f(3)); the Act has no transitional provision for these persons<\/td><\/tr><tr><td>Justified suspicion of a conviction for an offence against the protection of information<\/td><td>call on the person to present the information again<\/td><td>Article 8f(2)<\/td><td>a valid security clearance is sufficient (Article 8f(3)); according to the Minister not periodically, and an anonymous tip alone may not be enough (Q&amp;A 3.10)<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">Does the check have to be repeated?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The entity calls on the person to present the information again if it forms a justified suspicion that the person has been convicted of an offence against the protection of information (Article 8f(2)). According to the Minister the suspicion must be substantiated to some extent, and an anonymous tip or a whistleblower report alone may not be enough. The Minister does not consider periodic calls justified (Q&amp;A 3.10).<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">How to obtain a criminal record certificate from the KRK<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">In practice people speak of a criminal record certificate. The Act on the National Criminal Register calls this document information about a person and treats it as a certificate within the meaning of the Code of Administrative Procedure (Article 23). For an essential or important entity two routes are practical.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The first is the person&#8217;s application for information about themselves (Article 7(1)). The information contains data within the scope covered by the application (Article 20(1)(2)). Without a specified scope it covers all records about the person (Article 19(3)), that is also convictions to which Article 8f does not apply. It is therefore worth asking the person to specify the scope in the application as convictions for offences under Articles 265\u2013269b of the Criminal Code.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The second route is a query by the entity itself. Since 3 April 2026 the register provides it with information to the extent necessary to check the absence of convictions of a person performing tasks under Article 8 and Article 11 of the KSC Act (Article 6(1)(10c)). The query may therefore concern only such a person. A fee is charged for issuing the information, also from an entity making a query under point 10c (Article 24(1)). The Register&#8217;s Information Office does not send the entity&#8217;s queries to the registers of other EU Member States (Article 4(1)(5)).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In my assessment information obtained on the entity&#8217;s query also allows the head of the entity to admit the person, because point 10c was added by the amendment that introduced Article 8f precisely for checking persons performing tasks under Articles 8 and 11 (Article 1(17) and Article 10 of the amending act). Against this is the wording of Article 8f(1), which refers to information presented by the person. The Minister also writes that the person must present a criminal record certificate (Q&amp;A 3.10). It is therefore safer to treat the entity&#8217;s query as a supplement, for example when a person called on under Article 8f(2) does not present the information.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Who admits the person and who is responsible<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The head of the entity admits the person to the tasks (Article 8f(1)). The head of the entity is the head of the unit within the meaning of the Accounting Act, and in a public finance sector unit its head within the meaning of the Public Finance Act (Article 2(8a)). According to the Minister the head of the entity may entrust the checking of the absence of convictions to another person, who does not thereby become the head of the entity (Q&amp;A 4.7). The head of the entity is responsible even where the obligations have been entrusted to another person with that person&#8217;s consent (Article 8c(3)).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Evidence of performance of the obligation may be an admission record drawn up for each person. The record identifies the person and the person&#8217;s tasks under Article 8 or 11 as well as the date of issue of the register information or the details of the security clearance. It also contains the result within the scope of Chapter XXXIII and the date of admission. The record is signed by the head of the entity or by the person to whom the head has entrusted admission with that person&#8217;s consent (Article 8c(3)).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The head of the entity may be subject to a financial penalty for failing to perform the obligation under Article 8f(1) or (2) if the duration, scope or nature of the infringement justifies it (Article 73a(1)(5)). The penalty is also possible for a one-off omission (Article 73a(2)). This penalty may be imposed for the first time after 3 April 2028 (Article 35 of the amending act).<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">The criminal record check and the GDPR<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Personal data relating to criminal convictions and offences may be processed on the basis of Article 6(1) GDPR only under the control of official authority or when the processing is authorised by Union or Member State law providing for appropriate safeguards (Article 10 GDPR). The legal basis in this case is the legal obligation under Article 8f (Article 6(1)(c) GDPR), and Article 8f is at the same time the national provision authorising this processing (Article 10 GDPR). This applies to an employee, a selected candidate and a person under a civil-law contract. The employer requires these data under Article 22\u00b9 \u00a7 4 of the Labour Code, because they are necessary to fulfil an obligation under a provision of law. For a query by the entity Article 6(1)(10c) of the Act on the National Criminal Register is also a provision within the meaning of Article 10 GDPR.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The consent of a candidate or employee may not be the basis for processing data under Article 10 GDPR (Article 22\u00b9\u1d43 \u00a7 1 of the Labour Code). In describing human resources security the Minister writes about candidates&#8217; consent to verification (Q&amp;A 3.3), but for data on convictions consent does not replace a provision of law.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The Minister indicates that information on the absence of convictions is kept in the personnel records or in the documentation related to the contract and must be properly protected (Q&amp;A 3.10). In the personnel records the information is in principle kept for the period of employment and 10 years from the end of the calendar year in which the employment relationship ended (Article 94(9b) of the Labour Code). For a person under a civil-law contract and a candidate not hired the entity sets the storage period itself, no longer than is necessary for the purposes of the processing (Article 5(1)(e) GDPR). If the information shows other convictions or other records, keeping them is not necessary for the purpose of Article 8f (Article 5(1)(c) GDPR). A record of the date of issue of the information, the result within the scope of Chapter XXXIII and the date of admission is then sufficient.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Access to information from the register is worth limiting to a narrow group of authorised persons who process it only on instructions from the controller (Article 29 GDPR). The information notice under Article 13 GDPR states among others that providing the information is a statutory requirement and what the possible consequences of failure to provide it are (Article 13(2)(e) GDPR). If the notice also contains the information under Article 14 about the entity&#8217;s query to the register, including the source of the data, separate information is not needed (Article 14(5)(a) GDPR).<\/p>\n\n\n\n<h2 id=\"wnioski\" class=\"wp-block-heading\">Conclusions and next steps<\/h2>\n\n\n\n<div class=\"wp-block-group ll-art-zdanie is-layout-constrained wp-block-group-is-layout-constrained\">\n\n<p class=\"wp-block-paragraph\">Remember<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The criminal record check works best as a step in the role assignment process and not as a one-off HR exercise.<\/p>\n\n<\/div>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Security and IT. List the tasks under Articles 8 and 11 together with the intermediate zone and the incident escalation list. Assign named persons to them with deputies and on-call staff.<\/li>\n\n\n\n<li>Board. If the head of the entity does not admit persons personally, designate in writing the person to whom the head entrusts checking and admission with that person&#8217;s consent.<\/li>\n\n\n\n<li>HR. Set the route for obtaining the information, its scope (Articles 265\u2013269b of the Criminal Code) and who pays the fee.<\/li>\n\n\n\n<li>HR with the data protection officer. Decide who sees the information, what goes into the records and for how long. Add the check to the record of processing activities (Article 30 GDPR) and update the information notice.<\/li>\n\n\n\n<li>HR. Describe the procedure on refusal, on a final and unexpunged conviction for an offence from Chapter XXXIII and on a justified suspicion of a conviction.<\/li>\n\n\n\n<li>HR and IT. Build the criminal record check into onboarding and role changes.<\/li>\n\n\n\n<li>HR. Collect the information or the details of valid security clearances from persons who already perform these tasks, with a margin before the adaptation deadline expires.<\/li>\n\n\n\n<li>Purchasing and legal. In contracts with suppliers and group companies specify requirements for the staff who perform tasks under Article 8 or 11 (Article 8(1)(2)(e)). Limit the privileged access of those staff and log its use (points (g) and (n)). I recommend not requesting information from the register about a supplier&#8217;s people, because according to the Minister the obligation to present the information does not cover them (Q&amp;A 3.48), and the basis for processing such data is easy to challenge.<\/li>\n<\/ol>\n\n\n\n<h2 id=\"materialy-powiazane\" class=\"wp-block-heading\">Related materials<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/www.lablogic.pl\/en\/nis2-management-liability\/\"><strong>What is the head of an essential or important entity personally responsible for?<\/strong><\/a> \u2014 the catalogue of obligations of the head of the entity and the entrustment of tasks.<\/li>\n\n\n\n<li><a href=\"https:\/\/www.lablogic.pl\/en\/who-needs-nis2-training-besides-the-board\/\"><strong>Who else needs NIS2 training besides the management board?<\/strong><\/a> \u2014 the circle of persons performing tasks under Articles 8 and 11 as the basis of a training plan.<\/li>\n\n\n\n<li><a href=\"https:\/\/www.lablogic.pl\/en\/nis2-supply-chain-security\/\"><strong>How to manage supplier risk under NIS2?<\/strong><\/a> \u2014 requirements for supplier staff in contracts.<\/li>\n\n\n\n<li><a href=\"https:\/\/www.lablogic.pl\/en\/nis2-risk-management-measures\/\"><strong>What risk management measures must an essential entity implement?<\/strong><\/a> \u2014 the elements of the system under Article 8 that define the circle of persons.<\/li>\n<\/ul>\n\n\n\n<h2 id=\"zrodla\" class=\"wp-block-heading\">Sources<\/h2>\n\n\n\n<ul class=\"wp-block-list ll-art-sources\">\n<li>Act of 5 July 2018 on the National Cybersecurity System, consolidated text as at 18 August 2026 \u2014 Article 2(8a) and (10), Article 5(1)(3), Article 7l(7), Article 7m(6), Article 8, Article 8c(3), Article 8f, Article 8i(1) and (2), Article 11, Article 16, Article 16d and Article 73a(1) and (2) (in Polish) \u2014 <a href=\"https:\/\/isap.sejm.gov.pl\/isap.nsf\/DocDetails.xsp?id=WDU20180001560\" target=\"_blank\" rel=\"noreferrer noopener\">isap.sejm.gov.pl<\/a>.<\/li>\n\n\n\n<li>Act of 23 January 2026 amending the Act on the National Cybersecurity System and certain other acts (Journal of Laws 2026, item 252) \u2014 Article 1(17), Article 10, Article 33(1), Article 35 and Article 49 (in Polish) \u2014 <a href=\"https:\/\/isap.sejm.gov.pl\/isap.nsf\/DocDetails.xsp?id=WDU20260000252\" target=\"_blank\" rel=\"noreferrer noopener\">isap.sejm.gov.pl<\/a>.<\/li>\n\n\n\n<li>Act of 24 May 2000 on the National Criminal Register, consolidated text (Journal of Laws 2024, item 276, as amended) \u2014 Article 1(2), Article 4(1)(5), Article 6(1)(10c), Article 7(1) and (1a), Article 19, Article 20(1) and (1d), Article 23 and Article 24(1) (in Polish) \u2014 <a href=\"https:\/\/isap.sejm.gov.pl\/isap.nsf\/DocDetails.xsp?id=WDU20000500580\" target=\"_blank\" rel=\"noreferrer noopener\">isap.sejm.gov.pl<\/a>.<\/li>\n\n\n\n<li>Act of 6 June 1997 \u2014 Criminal Code, consolidated text as at 28 July 2026 (Journal of Laws 2025, item 383, as amended) \u2014 Article 76 \u00a7 1, Article 106, Article 114a, Articles 265\u2013269b of Chapter XXXIII and Article 287 (in Polish) \u2014 <a href=\"https:\/\/isap.sejm.gov.pl\/isap.nsf\/DocDetails.xsp?id=WDU19970880553\" target=\"_blank\" rel=\"noreferrer noopener\">isap.sejm.gov.pl<\/a>.<\/li>\n\n\n\n<li>Act of 26 June 1974 \u2014 Labour Code, consolidated text (Journal of Laws 2026, item 1245) \u2014 Article 22\u00b9 \u00a7 4, Article 22\u00b9\u1d43 \u00a7 1 and 2, Article 30 \u00a7 1, Article 42, Article 52 \u00a7 1(2), \u00a7 2 and 3 and Article 94(9b) (in Polish) \u2014 <a href=\"https:\/\/isap.sejm.gov.pl\/isap.nsf\/DocDetails.xsp?id=WDU20260001245\" target=\"_blank\" rel=\"noreferrer noopener\">isap.sejm.gov.pl<\/a>.<\/li>\n\n\n\n<li>Regulation (EU) 2016\/679 of the European Parliament and of the Council (GDPR) \u2014 Article 5(1)(c) and (e), Article 6(1)(c), Article 10, Article 13, Article 14, Article 29 and Article 30 \u2014 <a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/?uri=CELEX%3A02016R0679-20160504\" target=\"_blank\" rel=\"noreferrer noopener\">eur-lex.europa.eu<\/a>.<\/li>\n\n\n\n<li>Minister of Digital Affairs, National Cybersecurity System \u2014 questions and answers on the amendment of the KSC Act, update of October 2026 \u2014 Q&amp;A 1.21, 1.37, 2.60, 3.3, 3.10, 3.28, 3.29, 3.34, 3.48 and 4.7 (in Polish) \u2014 <a href=\"https:\/\/cyber.gov.pl\/assets\/pdf\/faq-ksc.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">cyber.gov.pl<\/a>.<\/li>\n<\/ul>\n\n\n\n<div class=\"wp-block-group ll-art-cta is-layout-constrained wp-block-group-is-layout-constrained\">\n<h2 class=\"wp-block-heading ll-nietoc\">Let us establish who the check covers<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The circle of persons and the check procedure are easiest to establish together with a map of the tasks of the information security management system. <a href=\"https:\/\/www.lablogic.pl\/en\/nis2-ksc\/\">NIS2 and KSC readiness support<\/a> covers assigning tasks under Articles 8 and 11 to persons and a criminal record check procedure with an admission record and an information notice that takes Article 10 GDPR into account.<\/p>\n\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\">\n<div class=\"wp-block-button\"><a class=\"wp-block-button__link wp-element-button\" href=\"https:\/\/www.lablogic.pl\/en\/nis2-ksc\/\">NIS2 and KSC readiness support<\/a><\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>The criminal record check under Article 8f of the KSC Act covers persons performing Article 8 or 11 tasks in an essential or important entity. Before starting them the person presents register information on no convictions for offences against the protection of information, and the head of the entity admits them.<\/p>\n","protected":false},"author":2,"featured_media":6087,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ll_stan_prawny":"","footnotes":""},"categories":[74],"tags":[],"class_list":["post-6088","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-nis2"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"Criminal record check under Article 8f KSC \u2014 who it covers in an essential or important entity, when to present the certificate and how to protect the data.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Micha\u0142 Rutkowski\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/www.lablogic.pl\/en\/nis2-criminal-record-check\/\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"LabLogic - Micha\u0142 Rutkowski | DPO, GDPR, NIS2 and cybersecurity in practice\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"Who to check in the National Criminal Register for NIS2\" \/>\n\t\t<meta property=\"og:description\" content=\"Criminal record check under Article 8f KSC \u2014 who it covers in an essential or important entity, when to present the certificate and how to protect the data.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/www.lablogic.pl\/en\/nis2-criminal-record-check\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/10\/ll-og-nis2-criminal-record-check-en.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/10\/ll-og-nis2-criminal-record-check-en.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t\t<meta property=\"article:section\" content=\"NIS2 and KSC\" \/>\n\t\t<meta property=\"article:tag\" content=\"nis2\" \/>\n\t\t<meta property=\"article:tag\" content=\"ksc\" \/>\n\t\t<meta property=\"article:tag\" content=\"criminal record check\" \/>\n\t\t<meta property=\"article:tag\" content=\"krk\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-10-30T17:49:48+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-10-30T18:46:36+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:title\" content=\"Who to check in the National Criminal Register for NIS2\" \/>\n\t\t<meta name=\"twitter:description\" content=\"Criminal record check under Article 8f KSC \u2014 who it covers in an essential or important entity, when to present the certificate and how to protect the data.\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/10\/ll-og-nis2-criminal-record-check-en.jpg\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/nis2-criminal-record-check\\\/#article\",\"name\":\"Criminal record check under NIS2 \\u2014 who and when to check\",\"headline\":\"Who must be checked in the National Criminal Register for NIS2, and when?\",\"author\":{\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/#michal-rutkowski\"},\"publisher\":{\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.lablogic.pl\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/ll-og-nis2-criminal-record-check-en.jpg\",\"width\":1200,\"height\":630,\"caption\":\"Who to check in the criminal register \\u2014 LabLogic article graphic by Micha\\u0142 Rutkowski\"},\"datePublished\":\"2026-10-30T18:49:48+01:00\",\"dateModified\":\"2026-10-30T19:46:36+01:00\",\"inLanguage\":\"en-US\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/nis2-criminal-record-check\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/nis2-criminal-record-check\\\/#webpage\"},\"articleSection\":\"NIS2 and KSC\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/nis2-criminal-record-check\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/#listItem\",\"position\":1,\"name\":\"LabLogic\",\"item\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/baza-wiedzy\\\/nis2\\\/#listItem\",\"name\":\"NIS2 and KSC\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/baza-wiedzy\\\/nis2\\\/#listItem\",\"position\":2,\"name\":\"NIS2 and KSC\",\"item\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/baza-wiedzy\\\/nis2\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/nis2-criminal-record-check\\\/#listItem\",\"name\":\"Who must be checked in the National Criminal Register for NIS2, and when?\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/#listItem\",\"name\":\"LabLogic\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/nis2-criminal-record-check\\\/#listItem\",\"position\":3,\"name\":\"Who must be checked in the National Criminal Register for NIS2, and when?\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/baza-wiedzy\\\/nis2\\\/#listItem\",\"name\":\"NIS2 and KSC\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/#organization\",\"name\":\"LabLogic\",\"description\":\"DPO, GDPR, NIS2 and cybersecurity in practice\",\"url\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/\",\"email\":\"m.rutkowski@lablogic.pl\",\"telephone\":\"+48586231777\",\"foundingDate\":\"2004\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.lablogic.pl\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/cropped-lablogic-site-icon-512.png\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/nis2-criminal-record-check\\\/#organizationLogo\",\"width\":512,\"height\":512},\"image\":{\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/nis2-criminal-record-check\\\/#organizationLogo\"},\"sameAs\":[\"https:\\\/\\\/www.linkedin.com\\\/in\\\/michal-rutkowski-iod\"],\"additionalType\":\"https:\\\/\\\/schema.org\\\/ProfessionalService\",\"legalName\":\"LabLogic Consulting Micha\\u0142 Rutkowski\",\"address\":{\"@type\":\"PostalAddress\",\"streetAddress\":\"ul. Wolno\\u015bci 15\",\"postalCode\":\"81-327\",\"addressLocality\":\"Gdynia\",\"addressRegion\":\"pomorskie\",\"addressCountry\":\"PL\"},\"vatID\":\"PL9580972114\",\"taxID\":\"9580972114\",\"areaServed\":{\"@type\":\"Country\",\"name\":\"Poland\"},\"knowsAbout\":[\"GDPR\",\"Data Protection Officer (DPO)\",\"NIS2 Directive\",\"Polish National Cybersecurity System Act (KSC)\",\"Cybersecurity incident and data breach response\",\"EU AI Act\",\"ISO\\\/IEC 27001\",\"Information security management\"],\"founder\":{\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/#michal-rutkowski\"},\"hasOfferCatalog\":{\"@type\":\"OfferCatalog\",\"name\":\"Services\",\"itemListElement\":[{\"@type\":\"Offer\",\"itemOffered\":{\"@type\":\"Service\",\"name\":\"External Data Protection Officer (DPO)\",\"url\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/external-dpo\\\/\"}},{\"@type\":\"Offer\",\"itemOffered\":{\"@type\":\"Service\",\"name\":\"NIS2 and KSC implementation support\",\"url\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/nis2-ksc\\\/\"}},{\"@type\":\"Offer\",\"itemOffered\":{\"@type\":\"Service\",\"name\":\"Incident and data breach response\",\"url\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/incident-response\\\/\"}},{\"@type\":\"Offer\",\"itemOffered\":{\"@type\":\"Service\",\"name\":\"GDPR and NIS2 training\",\"url\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/training\\\/\"}},{\"@type\":\"Offer\",\"itemOffered\":{\"@type\":\"Service\",\"name\":\"AI Act: roles, obligations and preparation\",\"url\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/ai-act\\\/\"}}]}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/#michal-rutkowski\",\"url\":\"https:\\\/\\\/www.lablogic.pl\\\/michal-rutkowski\\\/\",\"name\":\"Micha\\u0142 Rutkowski\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/#michal-rutkowski-portret\",\"url\":\"https:\\\/\\\/www.lablogic.pl\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/michal-rutkowski-iod-dpo-rodo-nis2-lablogic.webp\",\"width\":864,\"height\":1080,\"caption\":\"Micha\\u0142 Rutkowski\"},\"sameAs\":[\"https:\\\/\\\/www.linkedin.com\\\/in\\\/michal-rutkowski-iod\"],\"jobTitle\":\"Data Protection Officer (DPO), NIS2\\\/KSC and cybersecurity advisor\",\"description\":\"Data protection and cybersecurity practitioner, owner of LabLogic. Since 2004 he has supported medium and large organisations: audits, implementations, incidents and training.\",\"email\":\"m.rutkowski@lablogic.pl\",\"knowsAbout\":[\"GDPR\",\"Data Protection Officer (DPO)\",\"NIS2 Directive\",\"Polish National Cybersecurity System Act (KSC)\",\"Cybersecurity incident and data breach response\",\"EU AI Act\",\"ISO\\\/IEC 27001\",\"Information security management\"],\"worksFor\":{\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/nis2-criminal-record-check\\\/#webpage\",\"url\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/nis2-criminal-record-check\\\/\",\"name\":\"Criminal record check under NIS2 \\u2014 who and when to check\",\"description\":\"Criminal record check under Article 8f KSC \\u2014 who it covers in an essential or important entity, when to present the certificate and how to protect the data.\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/nis2-criminal-record-check\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/#michal-rutkowski\"},\"creator\":{\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/#michal-rutkowski\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.lablogic.pl\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/ll-og-nis2-criminal-record-check-en.jpg\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/nis2-criminal-record-check\\\/#mainImage\",\"width\":1200,\"height\":630,\"caption\":\"Who to check in the criminal register \\u2014 LabLogic article graphic by Micha\\u0142 Rutkowski\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/nis2-criminal-record-check\\\/#mainImage\"},\"datePublished\":\"2026-10-30T18:49:48+01:00\",\"dateModified\":\"2026-10-30T19:46:36+01:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/www.lablogic.pl\\\/en\\\/\",\"name\":\"Micha\\u0142 Rutkowski - LabLogic\",\"alternateName\":\"LabLogic\",\"description\":\"DPO, GDPR, NIS2 and cybersecurity in practice\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.lablogic.pl\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"Criminal record check under NIS2 \u2014 who and when to check","description":"Criminal record check under Article 8f KSC \u2014 who it covers in an essential or important entity, when to present the certificate and how to protect the data.","canonical_url":"https:\/\/www.lablogic.pl\/en\/nis2-criminal-record-check\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.lablogic.pl\/en\/nis2-criminal-record-check\/#article","name":"Criminal record check under NIS2 \u2014 who and when to check","headline":"Who must be checked in the National Criminal Register for NIS2, and when?","author":{"@id":"https:\/\/www.lablogic.pl\/#michal-rutkowski"},"publisher":{"@id":"https:\/\/www.lablogic.pl\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/10\/ll-og-nis2-criminal-record-check-en.jpg","width":1200,"height":630,"caption":"Who to check in the criminal register \u2014 LabLogic article graphic by Micha\u0142 Rutkowski"},"datePublished":"2026-10-30T18:49:48+01:00","dateModified":"2026-10-30T19:46:36+01:00","inLanguage":"en-US","mainEntityOfPage":{"@id":"https:\/\/www.lablogic.pl\/en\/nis2-criminal-record-check\/#webpage"},"isPartOf":{"@id":"https:\/\/www.lablogic.pl\/en\/nis2-criminal-record-check\/#webpage"},"articleSection":"NIS2 and KSC"},{"@type":"BreadcrumbList","@id":"https:\/\/www.lablogic.pl\/en\/nis2-criminal-record-check\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/www.lablogic.pl\/en\/#listItem","position":1,"name":"LabLogic","item":"https:\/\/www.lablogic.pl\/en\/","nextItem":{"@type":"ListItem","@id":"https:\/\/www.lablogic.pl\/en\/baza-wiedzy\/nis2\/#listItem","name":"NIS2 and KSC"}},{"@type":"ListItem","@id":"https:\/\/www.lablogic.pl\/en\/baza-wiedzy\/nis2\/#listItem","position":2,"name":"NIS2 and KSC","item":"https:\/\/www.lablogic.pl\/en\/baza-wiedzy\/nis2\/","nextItem":{"@type":"ListItem","@id":"https:\/\/www.lablogic.pl\/en\/nis2-criminal-record-check\/#listItem","name":"Who must be checked in the National Criminal Register for NIS2, and when?"},"previousItem":{"@type":"ListItem","@id":"https:\/\/www.lablogic.pl\/en\/#listItem","name":"LabLogic"}},{"@type":"ListItem","@id":"https:\/\/www.lablogic.pl\/en\/nis2-criminal-record-check\/#listItem","position":3,"name":"Who must be checked in the National Criminal Register for NIS2, and when?","previousItem":{"@type":"ListItem","@id":"https:\/\/www.lablogic.pl\/en\/baza-wiedzy\/nis2\/#listItem","name":"NIS2 and KSC"}}]},{"@type":"Organization","@id":"https:\/\/www.lablogic.pl\/#organization","name":"LabLogic","description":"DPO, GDPR, NIS2 and cybersecurity in practice","url":"https:\/\/www.lablogic.pl\/en\/","email":"m.rutkowski@lablogic.pl","telephone":"+48586231777","foundingDate":"2004","logo":{"@type":"ImageObject","url":"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/08\/cropped-lablogic-site-icon-512.png","@id":"https:\/\/www.lablogic.pl\/en\/nis2-criminal-record-check\/#organizationLogo","width":512,"height":512},"image":{"@id":"https:\/\/www.lablogic.pl\/en\/nis2-criminal-record-check\/#organizationLogo"},"sameAs":["https:\/\/www.linkedin.com\/in\/michal-rutkowski-iod"],"additionalType":"https:\/\/schema.org\/ProfessionalService","legalName":"LabLogic Consulting Micha\u0142 Rutkowski","address":{"@type":"PostalAddress","streetAddress":"ul. Wolno\u015bci 15","postalCode":"81-327","addressLocality":"Gdynia","addressRegion":"pomorskie","addressCountry":"PL"},"vatID":"PL9580972114","taxID":"9580972114","areaServed":{"@type":"Country","name":"Poland"},"knowsAbout":["GDPR","Data Protection Officer (DPO)","NIS2 Directive","Polish National Cybersecurity System Act (KSC)","Cybersecurity incident and data breach response","EU AI Act","ISO\/IEC 27001","Information security management"],"founder":{"@id":"https:\/\/www.lablogic.pl\/#michal-rutkowski"},"hasOfferCatalog":{"@type":"OfferCatalog","name":"Services","itemListElement":[{"@type":"Offer","itemOffered":{"@type":"Service","name":"External Data Protection Officer (DPO)","url":"https:\/\/www.lablogic.pl\/en\/external-dpo\/"}},{"@type":"Offer","itemOffered":{"@type":"Service","name":"NIS2 and KSC implementation support","url":"https:\/\/www.lablogic.pl\/en\/nis2-ksc\/"}},{"@type":"Offer","itemOffered":{"@type":"Service","name":"Incident and data breach response","url":"https:\/\/www.lablogic.pl\/en\/incident-response\/"}},{"@type":"Offer","itemOffered":{"@type":"Service","name":"GDPR and NIS2 training","url":"https:\/\/www.lablogic.pl\/en\/training\/"}},{"@type":"Offer","itemOffered":{"@type":"Service","name":"AI Act: roles, obligations and preparation","url":"https:\/\/www.lablogic.pl\/en\/ai-act\/"}}]}},{"@type":"Person","@id":"https:\/\/www.lablogic.pl\/#michal-rutkowski","url":"https:\/\/www.lablogic.pl\/michal-rutkowski\/","name":"Micha\u0142 Rutkowski","image":{"@type":"ImageObject","@id":"https:\/\/www.lablogic.pl\/#michal-rutkowski-portret","url":"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/08\/michal-rutkowski-iod-dpo-rodo-nis2-lablogic.webp","width":864,"height":1080,"caption":"Micha\u0142 Rutkowski"},"sameAs":["https:\/\/www.linkedin.com\/in\/michal-rutkowski-iod"],"jobTitle":"Data Protection Officer (DPO), NIS2\/KSC and cybersecurity advisor","description":"Data protection and cybersecurity practitioner, owner of LabLogic. Since 2004 he has supported medium and large organisations: audits, implementations, incidents and training.","email":"m.rutkowski@lablogic.pl","knowsAbout":["GDPR","Data Protection Officer (DPO)","NIS2 Directive","Polish National Cybersecurity System Act (KSC)","Cybersecurity incident and data breach response","EU AI Act","ISO\/IEC 27001","Information security management"],"worksFor":{"@id":"https:\/\/www.lablogic.pl\/#organization"}},{"@type":"WebPage","@id":"https:\/\/www.lablogic.pl\/en\/nis2-criminal-record-check\/#webpage","url":"https:\/\/www.lablogic.pl\/en\/nis2-criminal-record-check\/","name":"Criminal record check under NIS2 \u2014 who and when to check","description":"Criminal record check under Article 8f KSC \u2014 who it covers in an essential or important entity, when to present the certificate and how to protect the data.","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/www.lablogic.pl\/en\/#website"},"breadcrumb":{"@id":"https:\/\/www.lablogic.pl\/en\/nis2-criminal-record-check\/#breadcrumblist"},"author":{"@id":"https:\/\/www.lablogic.pl\/#michal-rutkowski"},"creator":{"@id":"https:\/\/www.lablogic.pl\/#michal-rutkowski"},"image":{"@type":"ImageObject","url":"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/10\/ll-og-nis2-criminal-record-check-en.jpg","@id":"https:\/\/www.lablogic.pl\/en\/nis2-criminal-record-check\/#mainImage","width":1200,"height":630,"caption":"Who to check in the criminal register \u2014 LabLogic article graphic by Micha\u0142 Rutkowski"},"primaryImageOfPage":{"@id":"https:\/\/www.lablogic.pl\/en\/nis2-criminal-record-check\/#mainImage"},"datePublished":"2026-10-30T18:49:48+01:00","dateModified":"2026-10-30T19:46:36+01:00"},{"@type":"WebSite","@id":"https:\/\/www.lablogic.pl\/en\/#website","url":"https:\/\/www.lablogic.pl\/en\/","name":"Micha\u0142 Rutkowski - LabLogic","alternateName":"LabLogic","description":"DPO, GDPR, NIS2 and cybersecurity in practice","inLanguage":"en-US","publisher":{"@id":"https:\/\/www.lablogic.pl\/#organization"}}]},"og:locale":"en_US","og:site_name":"LabLogic - Micha\u0142 Rutkowski | DPO, GDPR, NIS2 and cybersecurity in practice","og:type":"article","og:title":"Who to check in the National Criminal Register for NIS2","og:description":"Criminal record check under Article 8f KSC \u2014 who it covers in an essential or important entity, when to present the certificate and how to protect the data.","og:url":"https:\/\/www.lablogic.pl\/en\/nis2-criminal-record-check\/","og:image":"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/10\/ll-og-nis2-criminal-record-check-en.jpg","og:image:secure_url":"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/10\/ll-og-nis2-criminal-record-check-en.jpg","og:image:width":1200,"og:image:height":630,"article:section":"NIS2 and KSC","article:tag":["nis2","ksc","criminal record check","krk"],"article:published_time":"2026-10-30T17:49:48+00:00","article:modified_time":"2026-10-30T18:46:36+00:00","twitter:card":"summary_large_image","twitter:title":"Who to check in the National Criminal Register for NIS2","twitter:description":"Criminal record check under Article 8f KSC \u2014 who it covers in an essential or important entity, when to present the certificate and how to protect the data.","twitter:image":"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/10\/ll-og-nis2-criminal-record-check-en.jpg"},"aioseo_meta_data":{"post_id":"6088","title":"Criminal record check under NIS2 \u2014 who and when to check","description":"Criminal record check under Article 8f KSC \u2014 who it covers in an essential or important entity, when to present the certificate and how to protect the data.","keywords":null,"keyphrases":{"focus":{"keyphrase":"criminal record check","score":0,"analysis":[]},"additional":[{"keyphrase":"National Criminal Register NIS2","score":0,"analysis":[]},{"keyphrase":"Article 8f KSC Act","score":0,"analysis":[]},{"keyphrase":"criminal record certificate NIS2","score":0,"analysis":[]},{"keyphrase":"KRK information cybersecurity","score":0,"analysis":[]}]},"primary_term":null,"canonical_url":null,"og_title":"Who to check in the National Criminal Register for NIS2","og_description":"Criminal record check under Article 8f KSC \u2014 who it covers in an essential or important entity, when to present the certificate and how to protect the data.","og_object_type":"article","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":"NIS2 and KSC","og_article_tags":[{"label":"NIS2","value":"NIS2"},{"label":"KSC","value":"KSC"},{"label":"criminal record check","value":"criminal record check"},{"label":"KRK","value":"KRK"}],"twitter_use_og":true,"twitter_card":"summary_large_image","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","local_seo":null,"breadcrumb_settings":null,"limit_modified_date":false,"ai":{"faqs":[],"keyPoints":[],"schemas":[],"titles":[],"descriptions":[],"socialPosts":{"email":{"subject":"","preview":"","content":""},"linkedin":[],"twitter":[],"facebook":[],"instagram":[]}},"created":"2026-10-30 18:09:14","updated":"2026-10-30 18:47:50","seo_analyzer_scan_date":null,"focus_keyword":"criminal record check","additional_keywords":[{"word":"National Criminal Register NIS2","score":0},{"word":"Article 8f KSC Act","score":0},{"word":"criminal record certificate NIS2","score":0},{"word":"KRK information cybersecurity","score":0}],"truseo_locale":null},"spectra_blocks_featured_image_url":{"thumbnail":{"url":"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/10\/ll-og-nis2-criminal-record-check-en-150x150.jpg","width":150,"height":150},"medium":{"url":"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/10\/ll-og-nis2-criminal-record-check-en-300x158.jpg","width":300,"height":158},"medium_large":{"url":"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/10\/ll-og-nis2-criminal-record-check-en-768x403.jpg","width":768,"height":403},"large":{"url":"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/10\/ll-og-nis2-criminal-record-check-en-1024x538.jpg","width":1024,"height":538},"full":{"url":"https:\/\/www.lablogic.pl\/wp-content\/uploads\/2026\/10\/ll-og-nis2-criminal-record-check-en.jpg","width":1200,"height":630}},"spectra_blocks_author_info":{"display_name":"Micha\u0142 Rutkowski","avatar_url":"https:\/\/secure.gravatar.com\/avatar\/29f5af5a0ce65a4307813722032192bdf08e740cbda98b61aa73b548422ff768?s=96&d=mm&r=g","author_link":"https:\/\/www.lablogic.pl\/en\/author\/michal-rutkowski\/","description":"Micha\u0142 Rutkowski \u2014 praktyk ochrony danych i cyberbezpiecze\u0144stwa, w\u0142a\u015bciciel LabLogic. Od 2004 roku pracuje na styku technologii, ochrony danych i zarz\u0105dzania ryzykiem. Pe\u0142ni funkcj\u0119 zewn\u0119trznego IOD\/DPO, prowadzi audyty RODO, kwalifikacj\u0119 i wdro\u017cenia NIS2 oraz ustawy o KSC, wspiera organizacje przy incydentach i naruszeniach ochrony danych, szkoli zarz\u0105dy, kadr\u0119 kierownicz\u0105 oraz zespo\u0142y IT i compliance. Pracuje ze \u015brednimi i du\u017cymi organizacjami, w tym z sektora finansowego i bran\u017c regulowanych."},"_links":{"self":[{"href":"https:\/\/www.lablogic.pl\/en\/wp-json\/wp\/v2\/posts\/6088","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.lablogic.pl\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.lablogic.pl\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.lablogic.pl\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.lablogic.pl\/en\/wp-json\/wp\/v2\/comments?post=6088"}],"version-history":[{"count":2,"href":"https:\/\/www.lablogic.pl\/en\/wp-json\/wp\/v2\/posts\/6088\/revisions"}],"predecessor-version":[{"id":6091,"href":"https:\/\/www.lablogic.pl\/en\/wp-json\/wp\/v2\/posts\/6088\/revisions\/6091"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.lablogic.pl\/en\/wp-json\/wp\/v2\/media\/6087"}],"wp:attachment":[{"href":"https:\/\/www.lablogic.pl\/en\/wp-json\/wp\/v2\/media?parent=6088"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.lablogic.pl\/en\/wp-json\/wp\/v2\/categories?post=6088"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.lablogic.pl\/en\/wp-json\/wp\/v2\/tags?post=6088"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}