The General Data Protection Regulation (GDPR) has been one of the most significant legal frameworks governing the protection of personal data worldwide for several years. Its territorial scope extends beyond the borders of the European Union, as its requirements may also apply to businesses established outside the EU that offer goods or services to individuals located there.
While the core principles of the GDPR remain unchanged, the rapid development of emerging technologies, the widespread adoption of remote working arrangements and the increasing use of artificial intelligence have created new challenges for organisations seeking to maintain compliance. At the same time, accountability, data security and effective risk management have become increasingly important in everyday business operations.
For international businesses entering the Polish or broader European market, understanding GDPR requirements is akey consideration. This is particularly relevant for companies offering services to EU-based customers, employing staff in Europe or relying on cloud-based and AI-driven solutions that process personal data. Those establishing a presence in Poland should also consider how these obligations affect their cooperation with local service providers.
1. Has GDPR compliance changed?
While terms such as “GDPR 2.0” or “a new era of data protection” are increasingly used in public debate, the fundamental principles of the GDPR remain unchanged. Organisations are still required to ensure that personal data is processed lawfully, fairly and transparently, in accordance with the principles of data minimisation, integrity and confidentiality.
This does not, however, mean that businesses can rely solely on policies and procedures implemented several years ago. The rapid development of digital technologies, changing business models and the widespread use of cloud-based services have significantly transformed how information is collected, used and stored.
Maintaining GDPR compliance is no longer viewed as a one-time implementation exercise. Regulatory authorities increasingly expect organisations not only to maintain appropriate documentation but also to demonstrate that themeasures they have adopted are effective in practice and reflect the realities of their day-to-day operations.
For many businesses, the greatest challenge today is not the initial implementation of these requirements but ensuring that internal policies, procedures and technical safeguards remain aligned with evolving business processes, technological developments and regulatory expectations.
In practical terms, this calls for regular reviews, risk assessments and updates to the way data protection responsibilities are managed.
2. GDPR and cross-border operations
International businesses operating across multiple jurisdictions often face additional compliance challenges, particularly in relation to data transfers, the engagement of service providers located outside the European Economic Area (EEA) and the allocation of responsibilities between group entities.
Organisations should ensure that their data processing arrangements are properly documented and supported by appropriate legal safeguards. This is especially important where personal data is transferred outside the EEA or processed by third-party vendors in other countries.
3. Current focus areas for European Data Protection authorities
Although the core obligations under the GDPR remain unchanged, European data protection authorities have increasingly focused on the practical implementation of compliance measures rather than the mere existence of documentation. Organisations are expected not only to maintain policies and procedures, but also to demonstrate that these are effectively in practise and regularly reviewed.
A key area of regulatory focus continues to be the principle of accountability. Businesses should be able to demonstrate that personal data is processed lawfully and that appropriate technical and organisational measures are in place to mitigate the associated risks.
Transparency obligations also remain high on the regulatory agenda. Privacy notices and other information provided to data subjects should be clear, accessible and kept up to date to reflect current processing activities and business practices.
Retention periods are also receiving increased scrutiny. Organisations should ensure that personal data is kept only for as long as necessary to fulfil the purposes for which it was collected and that appropriate storage and deletion procedures are in place.
In addition, supervisory authorities continue to pay close attention to data breach management and cybersecurity measures. Businesses should have effective processes to identify, assess and respond to incidents involving personal information.
Finally, the growing use of artificial intelligence is creating new compliance challenges. Organisations using AI-powered tools should carefully assess how personal data is processed within such systems and whether appropriate safeguards ensure that this use meets GDPR requirements.
4. GDPR compliance for SMEs
Small and medium-sized enterprises are not exempt from GDPR obligations. Regardless of their size, organisations processing personal data of customers, employees or business partners must ensure compliance with applicable requirements.
At the same time, the regulation follows a risk-based approach, meaning that the measures adopted should be proportionate to the nature, scope and purpose of the processing activities and the associated risks. Consequently, smaller businesses may not need the same governance structures and controls as large multinational corporations, provided that their safeguards adequately address those risks.
Nevertheless, SMEs should maintain appropriate documentation, implement adequate technical and organisational safeguards and establish procedures for handling data subject requests and personal data breaches.
Future regulatory changes for SMEs
In recent years, discussions at the European Union level have increasingly focused on reducing administrative burdens for small and medium-sized enterprises while maintaining a high standard of personal data protection.
At the time of writing, businesses should continue to comply with all applicable GDPR obligations until any relevantlegislative changes takes effect. However, these discussions should not be interpreted as a relaxation of regulation’s core principles or a general exemption for smaller firms.
As a result, organisations should therefore to monitor regulatory developments and keep their compliance measures up to date and properly documented.
5. How AI and the AI Act impact GDPR compliance
The rapid adoption of artificial intelligence technologies has transformed the way businesses process information, interact with customers and manage internal operations. AI-powered tools are increasingly used for content generation, document analysis, customer support, recruitment and decision-making. In many cases, these activities involve the processing of personal data, making GDPR compliance a key requirement. This is particularly relevant where such systems analyse customer behaviour, evaluate job applicants or generate personalised recommendations.
At the same time, businesses should be aware of the obligations arising from the EU AI Act, which establishes a regulatory framework for the development, deployment and use of artificial intelligence systems. While the GDPR focuses on the protection of personal data and privacy rights, the newer regulation addresses the safe, transparent and responsible use of this technology.
As a result, organisations should assess both the lawfulness of their processing activities and any additional requirements arising under the AI Act, taking into account their role and how the tools are used. Particular attention should be paid to risk management, transparency requirements, human oversight and the appropriate technical safeguards.
Importantly, the AI Act does not replace the GDPR. The two regulations operate alongside one another and should often be assessed together. Consequently, compliance with one does not automatically ensure that the obligations of the other have been met.
To minimise legal and regulatory risks, businesses should regularly review how AI tools are used in practise and ensure that appropriate internal responsibilities, procedures and controls are in place.
Conclusion
While the fundamental principles of the GDPR remain unchanged, organisations face increasingly complex compliance challenges due to technological developments, evolving regulatory expectations and the growing use of artificial intelligence. Businesses operating in the European market should regularly review their data protection frameworks, internal policies and security measures to ensure that these remain effective in practise.
Meeting GDPR requirements is an ongoing process that calls for clear responsibilities and a proactive approach to risk management. Keeping these arrangements up to date can help reduce exposure to sanctions, strengthen the trust of costumers and business partners and improve readiness for future legislative changes.
This is particularly important for international organisations operating across multiple jurisdictions, where data protection is an integral part of corporate governance and everyday decision-making.
