Rules concerning the registration of personal data filing systems, including an obligation to register personal data filing systems, mandatory content of the notification and cases in which controller is exempted from the obligation of registration, have been specified in Chapter 6 of the Act on the Protection of Personal Data – Registration of Personal Data Filing Systems.
Statutory tasks (Art. 12 (3)) of the Inspector General for Personal Data Protection include keeping a national register of personal data filing systems and giving information on registered filing systems.
While performing this task, the Inspector General for Personal Data Protection among others accepts notifications of personal data filing systems to registration, handles received notifications in terms of compliance with the statutory provisions, and in case of compliance enters the filing system into the “National register of personal data filing systems”. The types of information included in the filing system are specified in Art. 41 para. 1 items 1-4a and 7. Paragraph 2 of this Article states that controllers shall be obliged to notify the Inspector General about any changes made in the filing system, within 30 days following the date of the change introduced to the filing system
Pursuant to Art. 42 (2) of the Act on the Protection of Personal Data the register kept by the Inspector General for Personal Data Protection is an open register. Interested persons may consult the register in the Bureau of the Inspector General or by means of e-GIODO electronic platform, which allows a search according to many criteria such as name of the filing system, controller’s name, controller’s seat or REGON number.