The proceedings in cases regulated in the Act on Personal Data Protection shall be conducted pursuant to the provisions of the Code of Administrative Procedure, unless provided otherwise in the Act (Art. 22 of the Act on Personal Data Protection). The proceedings before the Inspector General for Personal Data Protection is governed by the provisions regulating the mode of conducting administrative proceedings.

The Inspector General was also granted competences of ruling nature. The tasks enumerated in Art. 12 of the Act on Personal Data Protection include issuing administrative decisions and considering complaints with respect to the enforcement of the provisions on the protection of personal data. Decisions determine the entire case or its part in terms of its essence or otherwise terminate the case. Such decisions, issued using the rules of material law, shape the rights and obligations of data subjects.

If, as a result of activities undertaken ex officio or at the interested party’s request, the Inspector General for Personal Data Protection reveals any breach of the provisions of the Act on Personal Data Protection, it shall order - by means of an administrative decision - to restore the proper legal state, and in particular:

• to remedy the negligence,
• to complete, update, correct, disclose, or not to disclose personal data,
• to apply additional measures protecting the collected personal data,
• to suspend the flow of personal data to a third country,
• to safeguard the data or to transfer them to other subjects,

These decisions may not restrict the freedom of the subject which nominates candidates or submits lists of candidates for President of the Republic of Poland elections, elections to the Diet, the Senate and territorial self-government bodies, as well as election to the European Parliament between the day when the election is announced and the voting day. Also in relation to the data files which were collected as a result of inquiry procedures held by officers of the bodies authorized to conduct such inquiries, the decisions cannot order to erase personal data collected in the course of these enquiries, if they are performed on the basis of legal provisions. In case where the provisions of other acts provide for a different mode of restoring the proper legal state, those other provisions shall be applied.

The party not satisfied with the decision issued by the Inspector General for Personal Data Protection may apply to the Inspector General for reconsidering its case. The decision may be appealed against within 14 days since the day of its delivery. The decisions shall not be executed until this term has expired, and making an appeal in the indicated term stays execution of the decision. The Inspector General shall inform the parties to the proceedings about made appeal. The application for reconsidering the case shall be handled on the basis of the provisions on appeals against decisions.

Pursuant to Art. 21 para. 2 of the Act on Personal Data Protection the decision by the Inspector General on the application to reconsider the case may be appealed against with the administrative court.