Can a Data Controller Authorise an Employee to Grant Permissions to Process Personal Data?

ANSWER

As a general rule, authorisations to process personal data on behalf of the data controller are granted by the controller itself. In the case of a limited liability company (sp. z o.o.) acting as a data controller, responsibility for granting authorisations rests with the management board, in accordance with the representation rules entered in the National Court Register (KRS).

The GDPR does not prohibit the authorisation of another person — such as a commercial proxy (prokurent), an employee of the company, or the Data Protection Officer — to grant authorisations to process personal data on behalf of the controller. Nevertheless, the data controller, i.e. in this case the company represented by the president of the management board, should formally authorise a specific person (employee) to grant the relevant data processing permissions on its behalf.