Poland software delivery: UODO, KSeF, BLIK and mObywatel

OutsourcingVN is operated by Netbase JSC, and this guide is written by a supplier that would welcome your project. It separates what Polish and EU law actually require from what Netbase can evidence about its own practice, with regulator and government sources named throughout for your own legal and tax advisers to verify. The guides index covers other markets, and the market index shows which question each one answers first.

Contents

• Who enforces data protection for a Poland-facing product?
• What can Netbase evidence for a Polish brief?
• Which requirement sits with which decision owner?
• Which steps come before a Poland-facing launch?
• Worked scenario: a Polish shopper pays with BLIK
• What has Netbase built that is relevant to a Polish brief?
• Which questions should you ask a supplier?
• What usually goes wrong?
• How this guide is sourced and where it stops
• Common questions
• Plan the first release

Who enforces data protection for a Poland-facing product?

GDPR applies directly across the European Union, and Poland's supervisory authority is the Urząd Ochrony Danych Osobowych (UODO), the Personal Data Protection Office. A controller must have a lawful basis for each use of personal data, honour access, correction, erasure and other subject-rights requests, and notify a qualifying breach to its supervisory authority without undue delay. UODO's own site notes that not every personal data breach needs to be reported, so the assessment itself is a documented step, not a formality. UODO takes complaints and works within the European Data Protection Board, and the European Commission's Your Europe guidance notes that failure to comply with the GDPR may result in significant fines.

None of that changes because the development team sits outside Poland: a buyer should decide who signs the processing agreement, who is named controller or processor, and who answers UODO's questions before discovery starts, not after a defect surfaces.

What can Netbase evidence for a Polish brief?

Procurement, security and data protection reviewers tend to ask for the same four statements. These are the ones Netbase can give.

• Compliance practices. Netbase's compliance practices are GDPR alignment for data privacy in Europe, HIPAA-aligned methodologies for healthcare data handling, and CCPA compliance for clients with U.S. customer bases. How GDPR and Poland's own implementing rules apply to your product, and who holds the data protection officer role, remains your organisation's task.
• Security practices. Security practices include secure code review and version control, role-based access control, MFA for admin dashboards, contributors under NDA, and NDAs and DPAs on request. A data processing agreement written for the Poland-facing system sits on top of this baseline.
• Information security management. Netbase JSC holds ISO 27001 certification for information security management.
• Markets, language and hours. Netbase serves clients in the United States, Europe and Asia-Pacific, and most projects come from clients outside Vietnam. Delivery communication is in English, with Polish copy review owned by a reviewer the buyer names where interfaces or contracts need it. The Hanoi office works Monday to Saturday, 9:00-18:15 Vietnam time (UTC+7), and support coverage follows those days; that working day falls at 03:00-12:15 in Warsaw during the Polish winter and 04:00-13:15 during the Polish summer.

Which requirement sits with which decision owner?

A Polish brief spans five owners inside the buying organisation, and a proposal that conflates them is the fastest way to miss one once the contract is signed.

Ask for this table filled in, not just a general compliance statement, before shortlisting a supplier.

Worked scenario: a Polish shopper pays with BLIK

A subscription retailer launches a Polish storefront where shoppers pay with BLIK alongside cards.

A proposal that cannot describe step 4, specifically what the checkout does when a BLIK code does not confirm in time, has not yet scoped Polish payments for this product.

What has Netbase built that is relevant to a Polish brief?

Netbase has delivered product personalisation on client print stores, including online designers and configurators for business cards, stickers, banners, photo books and mugs, for print-commerce clients in Singapore, Switzerland, Hong Kong, Germany, China, the United Kingdom, the Netherlands, the United States, Poland, France and Portugal. Separately, Netbase has built order-flow customisations for a German invitation-card printer, covering hidden design buttons on the cart page, a quantity dropdown, and the product key and ordered quantity written into the print PDF file name; the online designer feature builds record covers that engagement and the work for five other print businesses.

Which questions should you ask a supplier?

• Who signs the data processing agreement, and who is named controller? Expect a clear answer before contract, not during a breach.
• Can you show a structured invoice your platform has actually submitted to KSeF? Ask for the file, not just a claim that the connection exists.
• How does checkout handle BLIK alongside cards, and what happens when a code does not confirm in time? A vague answer usually means the path has not been tested.
• Does our product need mObywatel or trusted-profile sign-in, and who holds that integration? This usually stays with the buyer, with the supplier building inside the access granted.
• Who owns the Polish copy, and how does a change reach production? Translation drift is easiest to catch before launch, not after.
• How do you test against Poland's accessibility requirements? Ask for real assistive-technology testing, not a tool report alone.

What usually goes wrong?

• Compliance copied from a company page straight into a proposal. Signal: no one has actually tested this product's data flows, access rules or breach-response plan. Owner: the data protection officer.
• KSeF treated as a reporting feature added at the end. Signal: the first invoice to a Polish business bounces because it skipped the required platform. Owner: the finance systems owner, scoping the connection at discovery.
• BLIK added after checkout is already built around cards only. Signal: a late, disruptive change to the payment flow. Owner: the product owner, scoping both at discovery.
• Polish copy translated once and never re-tested. Signal: error messages and generated documents drift out of Polish after the first release. Owner: the localisation owner.

How this guide is sourced and where it stops

This guide draws on UODO's own description of its supervisory role, the KSeF platform's own description of the national e-invoicing system and its rollout stages, the gov.pl pages on mObywatel, the trusted profile and Poland's digital accessibility law, BLIK's own description of its payment service, and the European Commission's pages on the GDPR for business and the European Accessibility Act, checked on 2026-10-19 and 2026-10-20, together with company statements and delivery evidence approved in the OutsourcingVN claim register. It is written for product, procurement and operations leads scoping a Poland-facing brief; it does not decide which accessibility duty or language scope fits your organisation.

Plan the first release

Bring your UODO role split, your KSeF connection, your BLIK and mObywatel scope, and your Polish-language boundary. The data security and compliance guide lists the contract questions behind the data protection row, and the time zone and collaboration guide covers how overlap and handoff are agreed for a European working day. For neighbouring markets, the Germany guide covers works-council consultation and German e-invoicing formats, the Romania guide covers RO e-Factura and ANSPDCP's GDPR enforcement, and the Spain guide covers Verifactu invoicing rules and the AEPD; if you are also weighing where the engineering team itself should sit, Vietnam vs Poland for software outsourcing compares that sourcing decision directly, and the product personalisation and online design solution scopes configurator work of the kind behind the online designer feature builds record.

Custom Product Engineering is the service for a bounded build, and global delivery explains how remote delivery is organised. OutsourcingVN is Netbase's own outsourcing-services platform: submit a project with your Poland-facing scope, and a person will reply with whether discovery or a bounded implementation is the right next step.

Related services and solutions

Sources

• Urząd Ochrony Danych Osobowych (UODO)
• KSeF, Krajowy System e-Faktur
• KSeF, Etapy wdrożenia KSeF
• gov.pl, mObywatel
• gov.pl, Profil zaufany
• BLIK
• gov.pl, Digital accessibility
• European Commission, The EU becomes more accessible for all
• European Commission, Your Europe: data protection (GDPR) for business