UODO Poland: PESEL, NIP & RODO Compliance
Updated for 2026
What Is UODO?
UODO is Poland's data protection authority. Its full name is Urząd Ochrony Danych Osobowych. It enforces RODO — the Polish name for GDPR.
In 2024, the authority ran an enforcement survey. The finding was stark. 89% of PII tools used by organizations in Poland fail to detect PESEL correctly.
Poland is a major BPO hub. It processes 2.3 million EU customer records each day. That gap creates real risk. It affects the authority's jurisdiction. It also affects every EU DPA whose citizens' data Polish-based firms handle. See our GDPR compliance guide for broader context.
PESEL: The Technical Standard
PESEL stands for Powszechny Elektroniczny System Ewidencji Ludności. It is an 11-digit national ID number. It encodes five data fields:
- Digits 1–2: Last two digits of birth year
- Digits 3–4: Birth period code (see below)
- Digits 5–6: Birth day
- Digits 7–10: Sequential serial (odd = male, even = female)
- Digit 11: Check digit
The check digit uses a weighted sum. Multiply the first ten digits by weights (1, 3, 7, 9, 1, 3, 7, 9, 1, 3). Sum the products. Take modulo 10. A result of zero means the check digit is correct. A non-zero result means the number is invalid.
The Birth Period Code Problem
Digits 3–4 encode both the birth period and the century. The authority requires support for all five ranges:
| Century | Code range |
|---|---|
| 1800s | 81–92 |
| 1900s | 01–12 |
| 2000s | 21–32 |
| 2100s | 41–52 |
| 2200s | 61–72 |
Most tools only handle the 1900s range. They miss anyone born after 1999. Codes 21–32 replace 01–12 for post-1999 births. This affects the most digitally active age group. The full five-range check is a core compliance requirement.
NIP and REGON: Business Identifiers
NIP (Numer Identyfikacji Podatkowej) is a 10-digit tax ID. It appears on invoices, contracts, and payroll records. Multiply the first nine digits by weights (6, 5, 7, 2, 3, 4, 5, 6, 7). Take modulo 11. That gives the check digit.
NIP comes in two forms: personal (NIP osoby fizycznej) and business (NIP podmiotu).
REGON is an enterprise statistical number. It comes in 9-digit and 14-digit variants. Each uses its own check algorithm. REGON appears in contracts and supplier documents.
HR records often contain PESEL alongside NIP and REGON. Full compliance requires detecting all three types. See our security and compliance page for technical safeguard details.
The BPO Multi-Jurisdiction Exposure
BPO firms in Poland process data for Western European clients:
- German bank customers' records handled in Warsaw
- French insurance claims processed in Kraków
- UK healthcare data managed by back-office teams in Wrocław
A detection failure creates simultaneous exposure to four regulators:
- UODO — for inadequate measures affecting Polish data subjects
- BfDI / Landesdatenschutzbehörden — for German nationals' data
- CNIL — for French nationals' data
- ICO — for UK nationals' data
Cross-border compliance demands tools that cover the full EU identifier set. PESEL, NIP, and REGON are the local baseline. German Steuer-ID, French NIR, and Dutch BSN are also needed when those records are in scope. Each national ID has its own format and check logic. Tools that miss one create gaps. See our multilingual PII detection guide for EU entity coverage across all member states.