When a foreign buyer or lender examines a Polish asset as collateral, one question surfaces early: on what legal basis was personal data collected, processed, and stored in connection with that asset? The answer determines whether the data underpinning the collateral file is lawfully held — and whether gaps in that file reflect a compliance failure or a deliberate restriction.
- What the question concerns
- The GDPR legal basis for personal data processed in the context of a Polish asset transaction — land register entries, company records, beneficial ownership declarations. Source: Regulation (EU) 2016/679 · verified 2026-07-12
- Primary applicable bases
- Article 6(1)(b) GDPR (contract performance), Article 6(1)(c) (legal obligation), Article 6(1)(e) (public task) — each applies to a distinct layer of the collateral file. Source: GDPR Art. 6 · verified 2026-07-12
- Supervisory authority
- Urząd Ochrony Danych Osobowych (UODO) — the Polish data protection authority. Decisions are published at uodo.gov.pl. Source: UODO · verified 2026-07-12
- What the basis does not determine
- Whether the asset itself is encumbered, who holds security interests, or what the collateral is worth. Those questions require separate register searches.
Why the legal basis matters for collateral analysis
A collateral file for a Polish asset typically contains personal data at several layers. The land register (Księga Wieczysta) records natural persons as owners, co-owners, or mortgage creditors. Company registers record directors and shareholders. Beneficial ownership declarations in the Central Register of Beneficial Owners (CRBR) record ultimate controlling persons. Each layer was created under a different legal basis, and each carries different access conditions for a foreign verifier.
The practical consequence: a gap in the collateral file may reflect a lawful restriction on disclosure, not concealment. Knowing which basis applies to which layer tells the verifier whether the gap is expected or anomalous.
| File layer | Register / source | GDPR basis (Art. 6) | Access for foreign verifier |
|---|---|---|---|
| Real property ownership and mortgages | Księga Wieczysta (EKW system) | Art. 6(1)(e) — public task | Publicly searchable by book number; no registration required |
| Company structure, directors, share capital | Krajowy Rejestr Sądowy (KRS) | Art. 6(1)(c) — legal obligation | Publicly searchable; documents downloadable at rejestr.io / prs.ms.gov.pl |
| Beneficial ownership declarations | Centralny Rejestr Beneficjentów Rzeczywistych (CRBR) | Art. 6(1)(c) — legal obligation (AML Act) | Public access confirmed; mode subject to verification by local counsel before reliance |
| Tax identification and VAT status | Biała Lista Podatników VAT | Art. 6(1)(e) — public task | Publicly searchable by NIP; returns bank account numbers for counterparty verification |
| Insolvency and restructuring proceedings | Krajowy Rejestr Zadłużonych (KRZ) | Art. 6(1)(e) — public task | Publicly searchable; negative result does not exclude a filed application not yet published |
| Registered pledges over movables | Rejestr Zastawów | Art. 6(1)(c) — legal obligation | Searchable by debtor name or PESEL/NIP; fee applies per search |
The three bases most relevant to collateral files
Three GDPR bases recur across Polish asset registers. Each implies a different relationship between the data subject and the processing controller.
Article 6(1)(b) — contract performance. This basis covers data processed because a specific contract requires it: a loan agreement, a sale agreement, a pledge agreement. Data processed on this basis exists in the counterparty's internal file, not in a public register. A foreign verifier cannot access it directly. What is accessible is the downstream trace: a mortgage entry in the land register, a pledge entry in the Rejestr Zastawów.
Article 6(1)(c) — legal obligation. This basis covers data that Polish law requires to be recorded and, in most cases, published. KRS, CRBR, Rejestr Zastawów, and KRZ all operate on this basis. The obligation to register is the obligation to disclose. A gap here — a company that should be registered but is not — is a compliance issue, not a privacy restriction.
Article 6(1)(e) — public task. This basis covers data processed by public authorities in the exercise of official functions. The land register, VAT register, and insolvency monitor operate on this basis. Access is generally open because disclosure is part of the public task itself.
What the basis does not resolve
The legal basis for processing tells a verifier whether data was lawfully collected. It does not answer the collateral questions that matter for a transaction: whether a mortgage is registered and in what amount, whether a pledge covers the asset in question, whether insolvency proceedings have been opened. Those answers require separate searches in each register.
The basis also does not resolve conflicts between registers. A beneficial ownership declaration in CRBR may name a different person than the shareholder list in KRS. That discrepancy is a factual finding, not a data protection issue. The data protection basis for each entry may be identical; the conflict between the entries is a separate problem.
Data subject rights and their effect on the collateral file
Where data is processed under Article 6(1)(c) or 6(1)(e), the right to erasure under GDPR Article 17 does not apply. A director cannot request removal from KRS. A beneficial owner cannot request deletion from CRBR. A mortgagee cannot be erased from the land register while the mortgage subsists. This is relevant for collateral analysis: the data in public registers is not subject to the same deletion risk as data held in private files.
Where data is processed under Article 6(1)(b) — in a lender's internal file — the right to erasure may apply after the contract ends. The collateral file held by a bank or fund is outside the scope of what a public register search can establish.
UODO decisions and their relevance
UODO publishes its decisions at uodo.gov.pl. Decisions relevant to real property and company data have addressed the scope of lawful processing by register authorities, the obligations of entities disclosing data to third parties, and the conditions under which a legitimate interest basis (Article 6(1)(f)) can be invoked by private actors. A foreign verifier relying on data from Polish registers does not need to establish a separate GDPR basis: the basis belongs to the controller of the register, not to the recipient of the information.
The limit of what the sources allow
Public registers establish what was declared and when. They do not establish what is true. A beneficial ownership declaration in CRBR reflects what the obligated entity reported; it does not confirm that the reported structure is accurate or current. A land register entry reflects what was registered; it does not confirm that the underlying transaction was valid.
The data protection basis for a given entry does not cure these limits. Knowing that a KRS entry was made under a legal obligation does not make the entry accurate. Knowing that a CRBR declaration was required by the AML Act does not make the declared beneficiary the actual controlling person.
The ceiling of what the sources allow is stated before payment. A collateral file assembled from Polish public registers will identify registered encumbrances, declared ownership structures, and published insolvency proceedings. It will not identify unregistered security interests, undisclosed beneficial owners, or proceedings filed but not yet published. Those limits are part of the finding, not a failure of the search.
Where the sources disagree
Discrepancies between registers are a known feature of the Polish data environment. The most common pattern: the shareholder list in KRS does not match the beneficial ownership declaration in CRBR. A second pattern: the land register shows a natural person as owner, but KRS shows the same person as a director of a company that holds an unregistered interest in the property.
These discrepancies are findings. They are reported as facts, not as conclusions about the parties' intentions or the validity of the underlying arrangements. The data protection basis for each entry does not resolve the discrepancy; it only confirms that each entry was lawfully made.
Frequently asked questions
Does GDPR restrict access to Polish land register data?
No. The Księga Wieczysta system operates under Article 6(1)(e) — public task. Access is open and does not require a stated purpose. The EKW system is searchable by book number without registration.
Can a beneficial owner request removal from CRBR before a transaction closes?
No. CRBR data is processed under Article 6(1)(c) — legal obligation. The right to erasure under GDPR Article 17 does not apply. The declared beneficiary remains in the register until the underlying obligation changes.
Does a foreign lender need a GDPR basis to receive a Polish register search result?
No. The GDPR basis belongs to the controller of the register, not to the recipient of publicly available information. A foreign lender receiving a land register extract or a KRS printout is not the controller of that data and does not need to establish a separate processing basis for receipt.
What does a discrepancy between KRS and CRBR indicate?
It indicates that the declared beneficial owner and the registered shareholder differ. This is a factual finding. It may reflect a compliant holding structure, a reporting error, or a failure to update one register after a change. The finding is reported; the cause requires further inquiry.
Disclaimer: This report is a factual compilation from official registers and public sources. It is provided for informational purposes only, does not constitute legal advice, and contains no legal qualification of the facts established. KORDECKI & Partners assumes no liability for actions taken or not taken based on this material. For advice regarding your particular situation, please contact info@kordeckipartners.com.