UODO Poland: PESEL, NIP & RODO Compliance
Updated for 2026
What Is UODO?
UODO is Poland's data protection authority. Its full name is Urząd Ochrony Danych Osobowych. It enforces RODO — the Polish name for GDPR.
In 2024, the authority ran an enforcement survey. The finding was stark. 89% of PII tools used by organizations in Poland fail to detect PESEL correctly.
Poland is a major BPO hub. It processes 2.3 million EU customer records each day. That gap creates real risk. It affects the authority's jurisdiction. It also affects every EU DPA whose citizens' data Polish-based firms handle. See our GDPR compliance guide for broader context.
PESEL: The Technical Standard
PESEL stands for Powszechny Elektroniczny System Ewidencji Ludności. It is an 11-digit national ID number. It encodes five data fields:
- Digits 1–2: Last two digits of birth year
- Digits 3–4: Birth period code (see below)
- Digits 5–6: Birth day
- Digits 7–10: Sequential serial (odd = male, even = female)
- Digit 11: Check digit
The check digit uses a weighted sum. Multiply the first ten digits by weights (1, 3, 7, 9, 1, 3, 7, 9, 1, 3). Sum the products. Take modulo 10. A result of zero means the check digit is correct. A non-zero result means the number is invalid.
The Birth Period Code Problem
Digits 3–4 encode both the birth period and the century. The authority requires support for all five ranges:
| Century | Code range |
|---|---|
| 1800s | 81–92 |
| 1900s | 01–12 |
| 2000s | 21–32 |
| 2100s | 41–52 |
| 2200s | 61–72 |
Most tools only handle the 1900s range. They miss anyone born after 1999. Codes 21–32 replace 01–12 for post-1999 births. This affects the most digitally active age group. The full five-range check is a core compliance requirement.
NIP and REGON: Business Identifiers
NIP (Numer Identyfikacji Podatkowej) is a 10-digit tax ID. It appears on invoices, contracts, and payroll records. Multiply the first nine digits by weights (6, 5, 7, 2, 3, 4, 5, 6, 7). Take modulo 11. That gives the check digit.
NIP comes in two forms: personal (NIP osoby fizycznej) and business (NIP podmiotu).
REGON is an enterprise statistical number. It comes in 9-digit and 14-digit variants. Each uses its own check algorithm. REGON appears in contracts and supplier documents.
HR records often contain PESEL alongside NIP and REGON. Full compliance requires detecting all three types. See our security and compliance page for technical safeguard details.
The BPO Multi-Jurisdiction Exposure
BPO firms in Poland process data for Western European clients:
- German bank customers' records handled in Warsaw
- French insurance claims processed in Kraków
- UK healthcare data managed by back-office teams in Wrocław
A detection failure creates simultaneous exposure to four regulators:
- UODO — for inadequate measures affecting Polish data subjects
- BfDI / Landesdatenschutzbehörden — for German nationals' data
- CNIL — for French nationals' data
- ICO — for UK nationals' data
Cross-border compliance demands tools that cover the full EU identifier set. PESEL, NIP, and REGON are the local baseline. German Steuer-ID, French NIR, and Dutch BSN are also needed when those records are in scope. Each national ID has its own format and check logic. Tools that miss one create gaps. See our multilingual PII detection guide for EU entity coverage across all member states.
When This Approach Has Limits
PESEL checksum validation across all five birth-period ranges, plus NIP and REGON detection with their own check algorithms, is the right local baseline for UODO compliance — that approach is sound. But limits remain worth stating plainly.
The PESEL format needs full configuration plus held-out testing. The check digit uses the weighted sum 1, 3, 7, 9 repeated, taken modulo 10, but the harder gap is the birth-period code in digits three and four: most tools handle only the 1900s range 01–12 and miss codes 21–32 for post-1999 births — the most digitally active group. NIP uses weights 6, 5, 7, 2, 3, 4, 5, 6, 7 modulo 11, and REGON differs between its 9- and 14-digit variants. Configure all five PESEL ranges and verify against held-out Polish records before relying on the result, since UODO found 89% of deployed tools detect PESEL incorrectly.
Multi-jurisdiction BPO work multiplies the formats and languages to cover. Polish processors handle German, French, and UK records, so a single detection failure exposes the organization to UODO, the BfDI and Landesbehörden, CNIL, and the ICO at once. PESEL, NIP, and REGON are only the local set; German Steuer-ID, French NIR, and Dutch BSN each carry their own format and check logic, and multilingual NER accuracy varies by language. A configuration tuned for Polish does not transfer to German or French text. Test each national format and language against representative held-out data.
The tool supports compliance; it does not constitute it. UODO audits the organization's whole posture, not one detector's hit rate, and a clean PESEL pass does not satisfy that scrutiny. Residual false negatives bound any redaction step, and quasi-identifiers — birth date encoded in the PESEL combined with city and role — can re-identify a person after direct identifiers are removed, leaving output pseudonymized rather than anonymized and in scope. Human and legal review of the documented controls remains required; across four regulators, the records are inspected first.