Responding to a UODO enquiry
We turn IT questions into a list of records to collect. We check system configurations, explain controls and prepare technical attachments for the response drafted by your organisation.
Services / Support with UODO enquiries
Support with UODO enquiriesTechnical findings and documentation for UODO enquiries
Received a letter from the Polish Personal Data Protection Office, preparing for an inspection or investigating a possible breach? We review systems, analyse logs and collect records of security controls. We work with your data controller, data protection officer (DPO) and legal adviser to prepare the technical material.
When we can help
Authority enquiries, breaches and inspection preparation
We agree the work around your case and the systems involved. We first establish which records are available, the deadlines in the letter and who is responsible for preparing the response.
Investigating a suspected breach
We help preserve available logs and reconstruct events. We establish which systems and data may have been affected and document the steps taken to limit the impact.
Preparing for an inspection
We collect records of permissions, updates, monitoring and backups. We check whether documented controls operate in the systems and identify gaps to address.
Technical findings for notifications and responses
We examine the applications, databases, servers, cloud environments and backups that hold personal data. We link findings to available logs, configurations or test results, and record missing information and limits to the investigation.
Find where personal data is held and who can access it
We review databases, files, logs and test environments, including access held by employees, administrators and suppliers. We identify unnecessary permissions and places where data is shared too widely.
Individual access
We configure named accounts, multi-factor authentication and permissions limited to the work each person needs to do. We review how access is removed when someone leaves.
Test environments
We check whether production database copies and logs expose personal data. We agree data masking and restrictions on exports and access.
Implement controls and test recovery
We select encryption, access controls and backups to suit your systems and the data they hold. We remove unnecessary public access, update configurations and document the changes.
Separate backup access
We separate backup permissions from production accounts. We test file recovery or system restoration and record the results.
Retention and deletion
We configure log and backup retention according to rules agreed with the data controller. We check how deletion works in the application and after restoring a backup.
Establish what happened during a breach
We examine available logs, accounts and system configurations to establish the timeline, affected systems and possible extent of data access. We distinguish confirmed findings from questions the available evidence cannot answer.
Findings for the data controller
We document the event, actions taken and recommendations. The controller and data protection officer (DPO) can use these findings when assessing the breach and preparing a notification.
Technical inspection support
We help collect configuration records, permissions, backup information and test results. We explain the controls within the agreed technical scope.
Material for UODO responses
We describe the systems during the period under review, the sources supporting our findings and changes made. Where historical logs or configurations are missing, we identify the facts we cannot confirm.
Remedial work
We agree improvements, restrict unnecessary access and test controls after changes. We provide a record of completed work and outstanding tasks.
Working together
From understanding the case to records and improvements
We establish whether you need material for a UODO response, an incident investigation or a review before an inspection. We agree system access and how information will be shared before work begins.
- Understand the case We discuss the event or the authority’s questions. We agree deadlines, systems to examine and responsibilities across IT, the DPO and legal advisers.
- Collect records We preserve available logs and check accounts, configurations and backups. We document sources and what the records can confirm.
- Prepare technical findings We provide a timeline, descriptions of controls and answers to system questions. We discuss findings with the person preparing the notification or response.
- Implement and verify improvements We make agreed changes and test the controls. We document the resulting configuration and outstanding work.
What you receive
Deliverables depend on the systems reviewed and the work agreed.
- A description of the systems and data storage locations involved.
- Technical material for UODO responses or breach notifications.
- For a breach investigation: a timeline and possible extent of data access.
- Sources supporting the findings and limits caused by missing logs or records.
- Prioritised recommendations and records of changes and test results.
We are responsible for the agreed technical work. The data controller handles legal assessments, lawful bases for processing and notification decisions with support from a DPO or legal adviser.
Questions about support with UODO enquiries
We have received a letter from UODO. Where should we start?
Check the questions and the response deadline in the letter. Appoint a coordinator and collect existing records. We help establish which technical information is needed and where to find it. We agree how to share the letter and grant access securely before the review.
Can you help if another provider manages our servers?
Yes. Once the work and necessary authorisations are agreed, we can work with your hosting provider, administrator or application team. The findings depend on the logs, configurations and information the provider can supply.
Do these controls make a business GDPR compliant?
IT configuration alone does not establish GDPR compliance. We provide technical controls and findings. Your organisation must also address processing rules, privacy information and the other requirements of data protection law.
Who decides whether to notify UODO?
The data controller assesses the risk and decides whether to notify the Polish supervisory authority, UODO. We help establish the technical facts. Where we act as a processor, we inform the controller of a personal data breach without undue delay.
Must every breach be reported within 72 hours?
Notification is not required where a breach is unlikely to pose a risk to people’s rights and freedoms. Otherwise, the controller must notify the authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach. This is a GDPR notification deadline, not a response-time commitment for our service.
Does the service include a DPO or representation before UODO?
The service covers technical support. We work with the person you appoint to handle data protection. Acting as a DPO, providing legal opinions and representing your organisation before the authority are outside this offer.
Further guidance on breach notification: UODO guidance (Polish) and GDPR Articles 32 and 33 .
Talk
Need technical support with a UODO enquiry?
Tell us whether you have received a letter, face an inspection or suspect a breach. Include the response deadline and the types of systems involved. A brief description is enough to start. We will agree how to share documents and data separately.
Contact us