Article 6 PDPA
Exclusion of the application of the provisions of the law to the processing of personal data for the purpose of national security or by special services

Laws and Regulations 2016/679 shall not apply to:

1) the processing of personal data by units of the public finance sector, referred to in Article 9 point 1, 3, 5, 6 and 14 of the Act of August 27, 2009 on Public Finance (Journal of Laws of 2017, item 2077 and of 2018, item 62 and 1000), to the extent that such processing is necessary for the performance of tasks aimed at ensuring national security, if specific legislation provides for necessary measures to protect the rights and freedoms of the data subject;

2) activities of special services within the meaning of Article 11 of the Act of May 24, 2002 on the Internal Security Agency and the Intelligence Agency (Journal of Laws of 2017, items 1920 and 2405, and 2018, items 138, 650, 723 and 730).

1. The provisions of Articles 4-7, Article 11, Article 12, Article 16, Article 17, Article 24 (1) and (2), Article 25 (1) and (2), Articles 28-30, Article 32, Article 34, Article 35, Article 37-39, and Article 86 of Regulation 2016/679, as well as the provisions of Article 6 and Article 11 of the Law, shall apply to the processing of personal data in the exercise of the constitutional and statutory powers of the President of the Republic of Poland, to the extent not covered by national security, respectively.

2. The processing of the data referred to in Article 9 and Article 10 of Regulation 2016/679 shall be carried out to the extent necessary for the realization of the constitutional and statutory powers of the President of the Republic of Poland, if the rights or freedoms of the data subject are not overridden by the realization of the tasks arising from those powers.