DPA case DKE.561.1.2026 – Violation Found (Poland, 2026)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A company in Poland faced a reprimand for not cooperating with the data protection authority during an investigation. This is important because it shows that companies must respond to requests for information from authorities. Failing to do so can lead to serious consequences.
What happened
The company did not respond to requests for information from the data protection authority regarding personal data access complaints.
Who was affected
Individuals whose personal data was involved in the complaints against the company.
What the authority found
The authority decided that the company violated GDPR rules by refusing to cooperate with the investigation.
Why this matters
This case highlights the necessity for companies to engage with data protection authorities. Ignoring requests can prolong investigations and lead to penalties.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Review needed — 18 October 2026.
Processing notes: amount discrepancy.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The DPA received two complaints against the same company (the controller) due to the unauthorised access to the data subjects’ personal data. The first complaint concerned processing that had taken place in January 2025, while the events giving rise to the second complaint had occurred in May 2025. During the proceedings initiated following the second complaint, the DPA requested certain information related to the processing operations at issue from the controller by sending the controller two letters in July and August respectively. The request included information on the scope of personal data processed, the sources from which the data were obtained, the legal basis and the purposes of processing. The controller never collected the first letter from the post office and failed to respond to the second one despite having received it. The DPA initiated administrative proceedings against the controller for refusal to cooperate due to the controller’s failure to respond to the request for information. The controller was requested to provide information on its income for 2025 for the purposes of determining an administrative fine, which it also failed to do. It was then discovered that the controller had also engaged in similar conduct in the proceedings related to the first complaint. Following this, the DPA contacted the controller electronically, and the controller provided information related to both complaint cases. The DPA held that the controller had violated Articles 31, 58(1)(a), and 58(1)(e) GDPR and issued it a reprimand. According to the DPA, the controller had refused to cooperate with the supervisory authority by failing to respond to the requests for information sent to it. Denying access to the information prevented a comprehensive and timely examination of the case, which in turn resulted in an unjustified prolongation of the proceedings. Furthermore, the DPA held that a reprimand was a sufficient sanction in the present case: the controller had submi
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case DKE.561.1.2026 in PL
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case DKE.561.1.2026 - Poland (2026). Retrieved from cookiefines.eu
Last updated: