New statutes of limitations for claims and how they relate to the GDPR in Poland

​New legislation entered into force in Poland on 9 July 2018 introducing significant changes in the limitation periods for claims under civil law. Two most significant changes are: the reduction of one of the basic limitation periods from ten to six years, and the introduction of the rule that the end of the limitation period falls on the last day of the calendar year (unless the limitation period is shorter than two years).

It needs to be noted, however, that the previously ten-year and now six-year limitation period generally does not affect transactions between enterprises. This follows from the provision which says that the limitation period for claims related to periodic performances and claims related to pursuing business activity is three years.

But the second of the aforementioned changes concerning the statute of limitations will be very important to enterprises. Every limitation period longer than two years lapses no sooner than on the last day of the relevant calendar year. Consequently, e.g. in the case of a three-year limitation period, a claim which becomes due on 1 January 2019 will become time-barred only on 31 December 2022, and not on 1 January 2022 like it was before.

The storage limitation principle

The above change will significantly affect the storing of personal data in the enterprise, in particular when it comes to determining data retention periods after which the data should be deleted. Pursuant to one of the basic GDPR principles, the storage limitation principle, personal data may be kept for no longer than it is necessary for the purposes for which the personal data are processed. The purposes are often related to the limitation periods for claims, therefore, the discussed changes are of particular importance to entities being data controllers.

Grouping of data and their deletion

Adopting the limitation periods as the basis for determining the retention periods may become a useful tool in everyday data processing. That is because the new way of calculating the limitation periods allows grouping the collected data according to the year in which they were entered into the system, and then determining on that basis the unified data deletion date for individual data groups. So far, if the adopted retention periods corresponded with the limitation periods, the data had to be deleted from the system day by day during a year. The new principles apply also if the limitation period is interrupted, which allows enterprises to flexibly determine the retention periods based on civil law.