Poland Recording Laws: One-Party Consent Rules and Penalties (2026)

How Poland Treats Recording Under Criminal Law

Poland's approach to recording conversations rests on a single dividing line: whether you are inside the conversation or outside it. If you are a participant, you can record. If you are not, recording the conversation is a crime.

This framework sits within Article 267 of the Kodeks karny (Criminal Code), originally enacted on June 6, 1997 (Dz.U. 1997 nr 88 poz. 553) and most recently consolidated in 2024 (Dz.U. 2024 poz. 17). The statute falls under Chapter XXXIII of the Criminal Code, which protects the confidentiality of information and communications. The Polish Constitution reinforces this protection through Article 49, which guarantees that "the freedom and privacy of communication shall be ensured" and that restrictions may be imposed "only in cases and in a manner specified by statute."

Polish courts and legal scholars refer to this system as the "participant rule" rather than a formal one-party consent doctrine. The distinction matters: the question is not whether someone consented to the recording. The question is whether the person pressing record was actively taking part in the exchange being captured.

Article 267: Breaking Down Each Paragraph

Article 267 contains four paragraphs. Together they define what constitutes unauthorized acquisition of information, what tools and methods are covered, and what happens when someone shares illegally obtained material.

§1: Unauthorized Access to Information

The first paragraph criminalizes gaining access, without authorization, to information not intended for the perpetrator. It covers three methods: opening a sealed letter, connecting to a telecommunications network, and bypassing or defeating electronic, magnetic, or other protective measures.

Penalties under §1: a fine (grzywna), restriction of liberty (ograniczenie wolności), or imprisonment for up to two years (pozbawienie wolności do lat 2).

§2: Unauthorized Access to IT Systems

The second paragraph extends the prohibition to unauthorized access to the contents of a computer system or telecommunications network. This covers hacking and digital intrusion. While not directly about recording conversations, it overlaps when someone gains access to stored recordings, voicemails, or communication logs without permission.

§3: The Wiretapping Paragraph

This is the provision that governs recording. Article 267 §3 states that a person who, in order to obtain information to which they are not entitled, installs or uses an eavesdropping device (urządzenie podsłuchowe), visual recording device (urządzenie wizualne), or any other device or software, is subject to the same penalties as under §1.

The Supreme Court addressed §3 directly in its ruling of December 30, 2020 (case V KK 363/20). The Court confirmed that intentional acquisition of information not intended for the perpetrator, by means of audio or video recording devices operated without the knowledge of the participants, constitutes a criminal act. The ruling made clear that the type of device is irrelevant. A voice recorder, a smartphone, a hidden camera, dedicated surveillance hardware, or a spy application all qualify. What matters is that the person recording had no right to receive the information being captured.

The ruling also reinforced the prosecution requirement: Article 267 offenses are prosecuted on the motion of the injured party (na wniosek pokrzywdzonego). The state does not pursue these cases on its own. The person whose communication was intercepted must file a formal complaint to trigger criminal proceedings.

§4: Sharing Illegally Obtained Recordings

The fourth paragraph criminalizes disclosing to another person information obtained through any of the methods described in paragraphs one through three. If someone illegally records a conversation and then shares that recording with a colleague, posts it online, or plays it for someone else, they face the same maximum sentence of two years imprisonment.

This means the chain of liability extends beyond the person who pressed record. Anyone who knowingly distributes material obtained through illegal eavesdropping risks prosecution.

The Participant Rule in Practice

The logic behind Poland's recording laws is straightforward. When you are part of a conversation, the information being exchanged is directed at you. You are entitled to receive it. Capturing it on a device does not change that entitlement.

This applies equally to phone calls, face-to-face meetings, video conferences, and voice messages. A person recording their own conversation with a neighbor, a business partner, a landlord, or a government official is not committing a criminal act. There is no requirement to announce that recording is taking place. There is no beep tone requirement. There is no obligation to obtain verbal or written consent before pressing record.

Polish legal scholarship and court decisions consistently support this reading. The Criminal Code criminalizes obtaining information you are not entitled to. If you are a participant, you are entitled to the information being shared with you. Full stop.

That said, the absence of criminal liability does not mean the absence of all consequences. Civil law and data protection law both create separate obligations that can apply even when no crime has been committed. A person who records a private conversation and then publishes it online may face civil claims for violating the other party's personal rights, even though the act of recording itself was lawful.

Phone Calls vs. In-Person Conversations

Polish law draws no distinction between recording a telephone conversation and recording a face-to-face conversation at the level of the Criminal Code. The participant rule applies identically to both.

A participant in a phone call may record it without informing the other party. A participant in a face-to-face meeting may place a voice recorder on the table, or keep a phone recording in a pocket, without telling other attendees. The analysis under Article 267 is the same in both scenarios.

Practically, telephone recordings surface more often as evidence in Polish courts. They appear regularly in labor disputes, contract disagreements, debt collection cases, and harassment proceedings. Courts generally admit participant recordings as evidence, though judges examine the purpose for which the recording was made and whether it was obtained in bad faith.

The Supreme Court established the foundational test for admissibility in its ruling of April 22, 2016 (case II CSK 478/15). In that case, the Court held that a recording may be used as evidence in civil proceedings if the circumstances in which it was made do not indicate a serious violation of the principles of social coexistence (zasady współżycia społecznego), and if admitting it is justified by the need to protect a party's right to a fair trial under Article 45 of the Constitution. The Court balanced the right to privacy under Article 47 of the Constitution against the right to a fair hearing, concluding that privacy is not absolute and must sometimes yield to evidentiary necessity.

Non-participant recording of telephone communications, for example tapping a line without being on the call, installing a call-intercepting app on someone's phone without their knowledge, or using a network-level interception device, falls squarely under Article 267 §3 and is criminal.

GDPR and UODO Enforcement

Recording a conversation creates personal data whenever the recording captures a voice, a name, a phone number, or other identifying information. Once personal data is involved and the recording is used outside of purely personal or household activity, the General Data Protection Regulation (Regulation (EU) 2016/679) applies.

In Poland, the supervisory authority responsible for enforcing GDPR is the Urząd Ochrony Danych Osobowych (UODO), the Personal Data Protection Office. UODO operates under the framework of both the GDPR and the Polish Act on Personal Data Protection of May 10, 2018.

GDPR requires every controller processing personal data through recordings to identify a valid legal basis under Article 6(1). The bases most commonly relied upon for recording are:

• Consent (Article 6(1)(a)): The data subject gives clear, specific, informed, and unambiguous consent to the recording.
• Legitimate interest (Article 6(1)(f)): The controller has a legitimate interest that outweighs the individual's privacy rights, documented through a formal balancing test.
• Legal obligation (Article 6(1)(c)): A statute requires the recording, as in certain financial services or public safety contexts.
• Contract performance (Article 6(1)(b)): Recording is necessary to perform or document a contractual obligation.

The Warsaw Centre for Intoxicated Persons Case

UODO's enforcement track record on audio recording crystallized in a decision issued on June 23, 2022 (case DKN.5131.51.2021). The authority fined the Warsaw Centre for Intoxicated Persons (Stołeczny Ośrodek dla Osób Nietrzeźwych) PLN 10,000 for operating a surveillance system that captured both video and audio without any valid legal basis.

The facility had recorded sound through its monitoring system from 2016 through December 2021, retaining footage for 30 to 60 days. UODO found that no provision of the applicable legislation, including the Act on Upbringing in Sobriety and Counteracting Alcoholism (Ustawa o wychowaniu w trzeźwości i przeciwdziałaniu alkoholizmowi), authorized audio recording at the facility. The controller attempted to invoke Article 6(1)(c) GDPR, arguing compliance with a legal obligation, but UODO rejected this, finding no statutory basis for capturing sound.

UODO stated explicitly that "audio-visual recording is undoubtedly a greater form of interference with privacy than video alone" and that controllers "should not choose solutions that contain functions that are not necessary." The decision cited EDPB Guidelines 3/19 on video surveillance, which recommend that audio recording in surveillance systems should generally be disabled unless an explicit legal basis exists.

The Voivodeship Administrative Court in Warsaw upheld the fine on October 28, 2022. The decision stands as the leading Polish authority on audio recording without a valid legal basis.

The fine in this case was modest at PLN 10,000 (roughly EUR 2,200), partly because the controller cooperated with UODO and ceased audio recording before the final decision. But GDPR allows maximum fines of EUR 20 million or four percent of global annual turnover for serious violations. Organizations processing recordings at scale face substantially higher exposure.

Workplace Recording and Employer Obligations

Employer surveillance of employees is regulated by Article 22(2) of the Kodeks pracy (Labor Code), introduced by amendments that took effect on May 25, 2018. These provisions work in tandem with GDPR requirements.

What Employers Can Do: Video Monitoring

Under Article 22(2) §1, an employer may introduce video monitoring (monitoring wizyjny) in the workplace when it is necessary for one of four enumerated purposes:

1. Ensuring the safety of employees
2. Protecting property
3. Controlling production processes
4. Maintaining the confidentiality of information whose disclosure could harm the employer

This list is exhaustive. Using cameras to monitor working time, track breaks, or observe off-duty behavior does not fit within the authorized purposes.

Video monitoring may not cover restrooms, changing rooms, canteens, smoking rooms, or trade union premises. An exception exists where the employer demonstrates necessity and obtains agreement from employee representatives, but even then, footage must be processed to prevent identification of individuals (for example, by blurring faces).

What Employers Cannot Do: Audio Recording

The Labor Code provision authorizes visual monitoring. It says nothing about audio. UODO's position, reinforced by the 2022 Warsaw Centre decision, is that audio recording in workplace surveillance systems is impermissible unless a specific statute authorizes it for that particular type of facility or function.

Polish law reserves audio surveillance authority primarily to law enforcement and security services operating under judicial oversight. An employer who installs microphones in the office, records phone calls of employees without statutory authorization, or enables audio capture on security cameras faces both GDPR enforcement action and potential criminal liability under Article 267 if employees were not participants in the captured conversations.

Employee Recording of Employers

The flip side of the participant rule benefits workers. An employee who records a conversation with a supervisor, a performance review, a meeting with HR, or a phone call with a manager is not committing a crime under Polish law, because the employee is a participant.

Polish labor courts have admitted employee-made recordings as evidence in wrongful termination cases, mobbing (workplace bullying) claims, and discrimination proceedings. The Supreme Court's April 2016 ruling in case II CSK 478/15 applies in the labor context as well: the recording is admissible if the method of obtaining it does not violate the principles of social coexistence and if the evidence serves the interest of a fair hearing.

Employer Compliance Checklist

Before activating any monitoring system, employers must:

1. Document the specific legal basis under Article 22(2) and GDPR Article 6(1).
2. Consult with the works council or employee representatives if one exists.
3. Notify all employees in writing at least two weeks before monitoring begins.
4. Include monitoring details in employment contracts or onboarding documentation.
5. Post visible signs or notices at entrances to monitored areas.
6. Retain video recordings for no longer than three months from the date of capture, unless footage is needed as evidence in pending legal proceedings.
7. Disable audio recording on all surveillance equipment unless an explicit statutory basis exists.

Recording in Public Places

Recording in publicly accessible spaces follows separate rules shaped by the lower expectation of privacy that applies in public settings.

In parks, streets, public transport, shopping centers, and government buildings, individuals generally may record their surroundings. Article 23 of the Kodeks cywilny (Civil Code) protects a person's image (wizerunek) as a personal right, but Polish case law recognizes that people appearing incidentally in public settings have limited grounds to object to being captured on camera.

Key limitations on public recording include:

Publishing identifiable images of individuals without their consent requires a legal basis. Polish copyright law (Ustawa o prawie autorskim i prawach pokrewnych, Art. 81) requires consent to disseminate a recognizable likeness unless the person is a public figure acting in an official capacity, the person forms part of a larger crowd or public event, or another statutory exception applies.

Intimate recording in public carries severe penalties. Article 191a §1 of the Criminal Code criminalizes the covert recording of a person's naked body or sexual activity without consent. This offense is punishable by imprisonment from three months to five years, regardless of whether the recording occurred in a public or private setting.

Private property open to the public, such as shopping centers, stadiums, and museums, may restrict or prohibit recording under their internal regulations. Violating these rules can result in removal from the premises and potentially trespass liability.

Government and public officials acting in their official capacity may be recorded in public without their consent. Polish law recognizes a broad right to document the actions of public servants and elected officials.

Civil Liability for Recording

Even where no criminal offense has been committed, recording can generate civil liability for violating personal rights (dobra osobiste) under Articles 23 and 24 of the Civil Code.

Article 23 provides that personal rights, including health, freedom, honor, name, image, and the confidentiality of correspondence, are protected under civil law independently of any protection offered by other statutes. Article 24 allows a person whose personal rights are threatened to demand that the threatening conduct cease, and to seek monetary compensation (zadośćuczynienie) where a violation has occurred.

Polish courts have recognized recording as a potential violation of:

• Privacy (prywatność)
• The confidentiality of correspondence and communication (tajemnica korespondencji)
• Personal dignity and reputation (godność, dobre imię)

A person whose personal rights are violated through recording may seek:

• An injunction ordering the recording to be deleted or its distribution to cease
• A public apology published in a specified medium
• Monetary compensation, which courts have awarded in amounts ranging from several thousand to several hundred thousand PLN depending on the severity and scope of the violation

Civil and criminal liability are independent tracks. A person may face both simultaneously. For example, someone who illegally eavesdrops on a private conversation and then posts it on social media could face criminal prosecution under Article 267 §3, criminal charges for sharing the recording under §4, and a civil lawsuit for violation of personal rights under Articles 23 and 24 of the Civil Code.

Business Compliance for Call Recording

Polish businesses that record telephone calls with customers or partners must navigate overlapping obligations under criminal law, GDPR, the Labor Code, and the Electronic Communications Law (Prawo komunikacji elektronicznej, which replaced the Prawo telekomunikacyjne effective November 10, 2024).

A compliant call recording program typically includes:

1. Pre-call notification: Inform the caller at the start of the conversation that recording is taking place, using a pre-recorded announcement or a verbal statement by the agent.
2. Purpose specification: State the reason for recording. Common purposes include quality assurance, training, documentation of orders or instructions, and dispute resolution.
3. Legal basis documentation: Identify and document the GDPR legal basis. For customer calls, legitimate interest (Article 6(1)(f)) is the most common basis. The balancing test must be completed in writing and available for UODO inspection.
4. Access controls: Limit access to recordings to staff who require them for the documented purpose.
5. Retention limits: Define and enforce a retention period. Three to six months is standard for quality monitoring. Calls documented for legal or contractual purposes may be retained longer, but indefinite storage violates GDPR's data minimization principle.
6. Data processing agreements: Execute Article 28 GDPR data processing agreements with any external vendor that stores, processes, or transmits the recordings.
7. Privacy notices: Address recording in both employee-facing privacy policies and customer-facing privacy notices.
8. Opt-out mechanism: Where consent is the legal basis, provide a meaningful way for the caller to decline recording.

Failure to comply exposes the business to UODO enforcement, which has grown more active year over year. In 2022 alone, UODO issued 2,030 administrative decisions, including 20 decisions imposing fines totaling PLN 7,850,861 (approximately EUR 1.87 million).

Penalties at a Glance

Offense	Legal Provision	Maximum Penalty
Non-participant eavesdropping	Art. 267 §3 Kodeks karny	2 years imprisonment
Sharing an illegally obtained recording	Art. 267 §4 Kodeks karny	2 years imprisonment
Intimate recording without consent	Art. 191a §1 Kodeks karny	5 years imprisonment
Audio surveillance without GDPR basis	Art. 6(1) GDPR via UODO	EUR 20 million or 4% of turnover
Employer audio monitoring without basis	Labor Code + GDPR	UODO administrative fine
Violation of personal rights via recording	Art. 23-24 Kodeks cywilny	Civil damages (court-determined)
Publishing identifiable image without consent	Copyright Law Art. 81	Civil damages

Recent Legal Developments

The Criminal Code was amended in 2024 (Dz.U. 2024 poz. 1228) to explicitly add "special software" as a criminal instrument under Article 267. This change responded to the proliferation of commercial stalkerware and spyware applications marketed for intercepting private communications. Surveillance apps installed on a target's phone without their knowledge now fall unambiguously within the scope of criminal liability.

Poland's Electronic Communications Law (Prawo komunikacji elektronicznej), which took effect on November 10, 2024, replaced the Telecommunications Law (Prawo telekomunikacyjne) that had been in force since 2004. The new law expanded regulatory coverage to include interpersonal communication services that do not use publicly assigned numbering resources, bringing messaging platforms, email providers, and video conferencing tools within its scope. Data retention obligations for communications providers were updated, and the law requires providers to accept and securely manage retained data in compliance with both Polish law and EU directives.

UODO continued its enforcement trajectory into 2025, issuing guidance reaffirming that audio recording capabilities in surveillance systems should remain disabled by default and activated only when a controller can point to an explicit statutory authorization or a thoroughly documented legitimate interest that survives proportionality review.