Does the exemption from obtaining GIODO’s consent exempt also from the need to fulfill the remaining obligations?
No, the Data Protection Act, by introducing in its chapter 7 (Art. 47 and 48) of a special regime related to personal data transfer to third countries, does not exclude the application of the remaining provisions of the Act in such cases. The provisions of Art. 47 and 48 of the Act introduce additional requirements, which must be fulfilled in case of intention to transfer of personal data to a third country. For this reason the data controller shall be obliged to meet all the obligations imposed by the Act. Next to having a legal basis for the processing of specific categories of data, the data controller must among others ensure that their scope is admissible in the light of the legal provisions commonly binding in the territory of the Republic of Poland. At the same time, in case of qualified form of data processing, which is the transfer of data to another data controller established in a third country, there is a need to fulfill at least one of the legitimacy conditions enumerated in Art. 23 paragraph 1 or Art. 27 paragraph 2 of the Data Protection Act.


