Law No. 124/2024 "On Personal Data Protection" removed notification to the Commissioner, but gave the Commissioner more tools to check compliance. The Commissioner's work plan for 2026 focuses on full implementation of the new law, with inspections in healthcare, construction, the pharmaceutical sector, transport and education, as well as thematic inspections of insurers and online service providers.
What the inspector asks for. An inspection usually starts with a written request for the documents the law requires you to keep, such as the records of processing activities (RoPA), data processing agreements (DPAs) with processors and privacy notices. We explain what each of them must contain in Data protection: obligations companies often overlook. The inspector also asks about security measures, internal regulations and how requests from individuals concerning their data are handled.
What is found most often. The documents exist, but they do not match what happens in practice: the records describe systems that are no longer used, cameras have been installed without clear rules and no one in the company knows who is responsible for the data.
How to be ready:
1. Carry out an internal check. Go through the obligations one by one and note what you have, what is missing and who is dealing with it.
2. Prepare the inspection file. Keep the documents in one place, up to date and ready to hand over.
3. Appoint a contact person. A single person communicates with the inspectors and keeps a list of the documents handed over.
4. Do not improvise. When you do not know the answer, ask for time and reply in writing.
5. Treat the findings as a work plan. A corrective action plan with responsible persons and deadlines shows that the company takes its obligations seriously.
What to do now. If you are in one of the sectors in the Commissioner's plan, do not wait for notice of an inspection. A short check quickly shows where you stand.