Sanction RGPD Polish National Personal Data Protection Office (UODO) — DPD Polska sp. z o.o. : 2,7 M€ (2026)
- Autorité de contrôle
- Polish National Personal Data Protection Office (UODO)
- Pays
- Pologne
- Entreprise / secteur
- DPD Polska sp. z o.o.
- Montant de l'amende
- 2,7 M€
- Date de la décision
- 5 février 2026
- Fondement juridique
- Art. 5 (1) a), f), (2), Art. 24 (1), (2), Art. 29, Art. 32 (1), (4)
- Manquement
- Contrat de sous-traitance insuffisant
Résumé des faits
The Polish DPA has imposed a fine of EUR 2,682,000 on DPD Polska sp. z.o.o. The controller offers postal services and uses subcontractors for certain transport services. As they are processing data to fulfil their obligations, the subcontractors are therefore processors. However, the controller failed to enter into a data processing agreement with the subcontractors. The controller also failed to ensure that the processors only processed the data according to their instructions.