---
title: "McDonald’s Polska Sp. z o.o. fined PLN 16,932,657 (Poland, 2025)"
canonical: "https://dposchool.com/gdpr/fine/uodo-mcdonalds-2025-07"
source: "https://uodo.gov.pl/pl/138/3827"
source_note: "Only the authority's decision is authoritative."
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en"
publisher: "DPO School"
---

Fine · Poland

# McDonald’s Polska Sp. z o.o.: PLN 16,932,657

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/gdpr/about#review)

- **Authority:** Prezes Urzędu Ochrony Danych Osobowych (Polish Data Protection Authority)
- **Country:** Poland
- **Date:** Announced on 21 July 2025
- **Amount:** PLN 16,932,657, as imposed (not converted)
- **Appeal status:** Unknown
- **Provisions cited:** [Article 5(1)(c)](https://dposchool.com/gdpr/article/5#1-c), [Article 24](https://dposchool.com/gdpr/article/24), [Article 25(1)](https://dposchool.com/gdpr/article/25#1), [Article 28(1)](https://dposchool.com/gdpr/article/28#1), [Article 32(1)](https://dposchool.com/gdpr/article/32#1), [Article 32(2)](https://dposchool.com/gdpr/article/32#2), [Article 38(1)](https://dposchool.com/gdpr/article/38#1)

## What the fine was for (summary, not the official text)

Outsourced staff scheduling without risk analysis or supervision of the processor, so employee data (names, PESEL or passport numbers, shifts) ended up in a public directory.

Not fully confirmed: Decision date not shown on the page (announcement date used). Three fines: PLN 1,632,063 + 13,600,528 + 1,700,066. The processor was fined PLN 183,858 in total. Articles taken from the narrative; the page does not give a single list of infringed articles.

## Official source

- [Decision or announcement of the authority](https://uodo.gov.pl/pl/138/3827)

Checked against the official source on 28 October 2026.

Only the authority's decision is authoritative. This is reference material, not legal advice.

## Navigation

[GDPR Navigator](https://dposchool.com/gdpr) / [Fines](https://dposchool.com/gdpr/fines) / McDonald’s Polska Sp. z o.o.

[All fines](https://dposchool.com/gdpr/fines)

Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/gdpr/llms.txt
- JSON API: https://dposchool.com/gdpr/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents