VPNs with servers in Poland

Article 43 separately requires such undertakings to provide technical conditions of access and recording for the Police, the ABW, Military Counter-intelligence, the CBA, the tax administration and other listed bodies. On 4 May 2026 the Ministry of Digital Affairs described the retention as general and undifferentiated, a consequence of laws on those bodies not yet adapted, and said the implementing regulations were still being drafted.

The duty binds telecommunications undertakings, defined by reference to public networks and publicly available telecommunications services, which include internet access and transmission of signals. On 14 May 2026 the data protection authority said a draft act strengthening judicial oversight of operational surveillance, under consideration in the Sejm, does not fully ensure compliance with the Strasbourg judgment of 28 May 2024 on notifying people afterwards. Whether a VPN operator is one is not established.

Under article 15f of the Gambling Act (consolidated text of April 2025) the finance minister keeps a public register of domains used to offer gambling contrary to the Act. Internet access providers must remove a listed domain from their name-resolution systems within 48 hours and redirect to a ministry page that warns of liability under the fiscal penal code.

Defamation (pomówienie, art. 212 of the Penal Code) is punished by a fine or restriction of liberty, and by up to a year’s imprisonment when done through mass media; insult (art. 216) likewise. Both are prosecuted on private accusation. Truth in a public statement on the conduct of a public official, or in defence of a socially justified interest, is not an offence (art. 213(2)).

Retained data are released to authorised bodies, courts and prosecutors under the separate laws governing each; the Ministry cites article 28 of the ABW Act and article 20c of the Police Act.

On 28 May 2024, in Pietrzak and Bychawska-Siniarska v. Poland, the European Court of Human Rights found three violations of Article 8. It held that the legislation on secret surveillance and on retention of communications data did not give sufficient safeguards against excessive recourse to surveillance, and that judicial review did not make up for it.

On Pegasus, a Senate commission found in 2023 the 2017 purchase unlawful. On 21 October 2026 a Sejm committee adopted a report finding the purchase and use against government opponents illegal and filed reports with the prosecutor. The order of the rows is the security score, and a server’s location is not a recommendation.