You see a video, a product catches your eye, and an “add to cart” button is already blinking in the corner of the screen. A few seconds later the order is placed, paid for, and on its way — all without leaving the app. That’s how TikTok Shop works: a closed-loop model in which the path from watching a piece of content to completing a purchase has been cut to the bare minimum. That very immediacy is its greatest strength and, at the same time, the source of its most serious concerns.

A platform that in 2017 drew around 72 million monthly users now attracts more than 1.5 billion — and between 11 and 15 million in Poland alone. TikTok has stopped being merely a place for entertainment and has turned into a powerful advertising and sales engine, combining influencer marketing, algorithmic personalization, and the emotional purchasing impulse. For businesses, it is a new and remarkably effective retail space. For consumers, it is an environment in which it grows ever harder to tell an authentic recommendation from an ad, or a fleeting enthusiasm from a considered decision.

That is precisely why TikTok Shop has landed at the center of lawmakers’ attention. While its model is not unlawful, the platform’s operation intersects with an entire web of regulation: from consumer law and the ban on “dark patterns,” through the EU’s DSA and DMA, data protection and safeguards for minors, all the way to advertising, media, and electronic communications law. This article shows where the convenience of one-tap shopping ends and the protection of the buyer’s free will begins.

What makes the TikTok Shop platform innovative?

Today, an effective marketing strategy is becoming an increasingly important priority for sellers. In Poland, monopolies in sales are relatively rare. Many competing companies operate in most industries. When purchasing products, consumers must choose from hundreds, or even thousands, of options offered by different brands. The scale of this phenomenon is evidenced by the fact that in the fourth quarter of 2025, over 2.9 million active businesses operated in Poland alone, the largest group of which were those associated with the retail sector. Meanwhile, buyers generally do not want to spend much time thoroughly analyzing goods available on the market. They are often guided by the opinions of other users, brand recognition, or media coverage. Therefore, in an information society based on the dynamic development of social media, tailoring advertising to current consumer needs and behaviors becomes crucial for running a business. Authentic and credible recommendations from trusted creators are becoming more important, and for many buyers, they are more persuasive than formulaic television commercials.

Considering the above arguments, many companies are making changes to their advertising strategies, for example, opting for influencer marketing. Online creators typically publish aesthetically and thematically consistent content that captures the interest of users with similar preferences and tastes. A business partnering with an influencer who shares similar values gains the opportunity to reach a large group of potential consumers, made up of the influencer’s followers. TikTok has become the dominant platform enabling the implementation of the marketing model described above. In 2017, the application had approximately 72 million monthly active users, and according to data from 2026, this number has increased to approximately 1.54 billion. In Europe alone, TikTok has already reached over 200 million users, and in Poland, the number ranged from 11 to 15 million. The average time spent on the platform is 70 minutes per day, which translates to approximately 35 hours per month. These statistics also indicate the continued growth of TikTok’s popularity, confirming the future of using social media for advertising and promotional purposes.

The development of influencer marketing significantly changed existing marketing practices, and its increasing prevalence led to the transformation of the TikTok app from a social media platform into an advertising system. The effective and profitable collaboration between media and advertising prompted the platform to take the next step in its development, combining these two sectors. Users were offered the opportunity to completely simplify the purchasing process. Previously, consumers only saw product advertisements, which attracted their attention and prompted them to search for sales offers. However, this pattern left them time to consider whether a purchase was truly necessary or necessary. It was also likely that, despite their interest in the product, they would eventually forget about the advertised product, and therefore their desire to purchase it.

The solution to the marketing strategy described above turned out to be a new feature presented by TikTok: TikTok Shop. The innovative nature of this tool is based on a closed-loop model, meaning the purchasing process takes place within a single app. Users first encounter content promoting a specific item. They then have the option to immediately purchase it by adding the advertised item to their shopping cart in the bottom corner of the app. TikTok acts as an intermediary for payment, shipping, and the entire order process. In this way, the app has evolved not only into a profitable advertising system but also an online store, becoming a marketplace platform that mediates payment, logistics, and order fulfillment.

The origins of TikTok Shop

Initially, the online shopping phenomenon developed through e-commerce. Its popularity contributed to the diversification of online sales into several business models: B2C, B2B, and C2C. The former involves a relationship between a business and an individual customer (examples include online stores such as Zalando, Zara, and IKEA). B2B refers to transactions between businesses, while C2C refers to sales between individuals, such as on platforms like Vinted, OLX, and Allegro.

These e-commerce models typically control the sales process independently. Their profits largely come from consumers who shop by searching for specific products they need. Entrepreneurs compete with each other through marketing activities aimed at convincing consumers of the quality of their products and building brand recognition.

In the next stage, the development of social media, and consequently influencer marketing, contributed to the emergence of a completely new type of buyer, one driven by impulse. Online creators present a specific lifestyle on their profiles in a significantly idealized form, which attracts the attention of their followers and becomes a role model. The desire to emulate the creator they follow can manifest itself both in their behavior and in the possessions they possess. The influencer thus becomes a person who inspires and encourages the purchase of a given product. Even if, from a rational perspective, the buyer doesn’t need the product, they often decide to purchase it under the influence of influencer marketing.

Additionally, a new branch of e-commerce has emerged, known as discovery commerce . This model relies on the discovery and purchase of new items while actively browsing social media. Highly advanced algorithms select content for users that aligns with their tastes or interests, in order to evoke certain emotions that then transform into a strong purchasing impulse. Social media platforms, recognizing this profitable sector, have contributed to the development of social commerce, including TikTok Shop. This solution capitalizes on users’ fleeting enthusiasm and allows them to complete their order without leaving the app. The entire process, from advertising content to payment and shipping, is handled by TikTok, which can limit the time available for rational purchase consideration.

What exactly does the purchasing process look like on TikTok Shop?

TikTok Shop is not a separate app, but a new feature added to the TikTok platform. There’s no need to create a new account or install a new app. This solution provides access to a wide group of potential consumers, as every existing TikTok user over the age of 18 can familiarize themselves with the new feature. This solution gives businesses multiple ways to reach consumers. The platform offers a separate tab, “Shop,” where users can search for specific products using filters and categories, or browse recommended items based on their activity on the platform.

Products offered by sellers using the TikTok Shop service can also be viewed on the “For You Page” tab. This is the subpage most frequently visited by users. This option is especially useful when a company decides to use influencer marketing. A creator posts a video promoting a selected product, and buyers are immediately presented with a purchase button at the bottom of the page. Consumers can also directly access the profiles of brands and creators to find the products they offer or promote.

The latest feature, TikTok Live, is gaining popularity. Before the live stream begins, the seller or influencer adds products available in the TikTok Shop. During the live stream, the host can showcase products, communicate with users, and answer their questions via chat. This can increase the credibility of the product and the seller, as well as encourage consumers to make a purchase, which they can do without interrupting the stream.

The very process of posting ads on TikTok Shop helps build consumer trust. Becoming a seller requires thorough verification, which the TikTok platform conducts to protect users from unreliable and fictitious businesses.

The first step to becoming a seller is to log in to your TikTok Seller Center account using your email address, phone number, or existing TikTok account. You’ll also need to fill out an application form with information that proves your seller credentials, such as your company name, address, and contact information.

After successful verification, the seller completes their store profile, adding a description, name, logo, seller details, addresses, customer service information, and tax information. It’s also necessary to configure payment and delivery methods, including the shipping address, available delivery methods, order processing time, and return policy. Connecting the store dashboard to a regular TikTok account is also crucial. This allows for tagging offered products in live videos, etc. The seller then has the option to publish their product, including the title, description, price, available models, and inventory. The platform also allows businesses to add listings by importing a product catalog from another sales platform.

After a consumer makes a purchase, the seller receives a sale notification in the TikTok Seller Center. The seller is then responsible for packaging and shipping the item to the user, which can be done manually or using external order processing systems.

Distance selling and consumer rights

The TikTok Shop platform offers the option of concluding a sale via a distance contract. This does not require the parties to be physically present at the same time, but rather requires at least one means of distance communication (Act of 30 May 2014 on consumer rights, Article 2). Therefore, when making a purchase through the TikTok Shop, consumer rights are governed by national and European Union law.

In Poland, the primary legal act regulating these activities is the Act of May 30, 2014, on Consumer Rights. Article 12 requires businesses to clearly inform consumers in distance contracts, including the method and deadline for contract execution, the total price including taxes, the right to withdraw from the contract, the complaint procedure, and the seller’s identifying information. The TikTok Shop platform is therefore obligated to provide the required information to the user before finalizing the order via the app. An important regulation is also included in Article 17 of the aforementioned Act and concerns the requirement to design the interface in a way that confirms the consumer’s awareness of the obligation to pay. In the case of platforms that allow order completion via a “button,” it must be clearly marked, e.g., “I buy with an obligation to pay” or “I buy and pay.” Otherwise, the contract is not concluded. The requirements described above are referred to as ” button ” solution ” and are intended to protect consumers from accidentally concluding paid contracts. Alternative obligations also arise from the Directive of the European Parliament and of the Council of 25 October 2011 on consumer rights.

The Consumer Rights Act also implements the EU Commodity Directive (2019/771), introducing uniform standards for the conformity of goods with the contract. A trader is liable for any lack of conformity of goods with the contract upon delivery and for two years from the date the discrepancy is discovered. The Act also governs basic consumer claims in the event of non-conformity, including repair or replacement of the goods, and if this is not possible, a price reduction or withdrawal from the contract.

Given that the sales strategy on the TikTok Shop platform relies on recommendation algorithms and influencer marketing, the Omnibus Directive (EU) 2019/2161 of November 27, 2019, plays a significant role in consumer empowerment. Its regulations introduce the obligation to provide information about the lowest price, disclose whether reviews were published by verified consumers, and indicate whether the seller is a business or an individual. The Omnibus Directive therefore increases consumer awareness and allows consumers to make more rational and manipulation-free purchasing decisions.

Digital Services Act Regulation

Due to their global nature, online platforms reach hundreds of millions of users. Content published through them can reach a very wide audience, thus influencing social, political, and economic relations. Massive social networking sites, therefore, go beyond simply providing entertainment or communication services and digital space, and are beginning to shape the reality around us.

The strong influence of individual platforms on current international relations has initiated more stringent oversight, including through the provisions of Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on the single market for digital services and amending Directive 2000/31/EC (Digital Services Act – DSA). Based on this regulation, TikTok was recognized by the European Commission as a Very Large Online Platform (VLOP). This status is granted to portals with monthly active users exceeding 10% of the EU population. TikTok exceeded the threshold and was classified as a VLOP in 2023.

Platforms deemed globally influential are not solely responsible for removing illegal content. They are also required to counteract the negative consequences that may arise from their operation. Among the most important responsibilities of very large online platforms (VLOPs) is the identification and assessment of systemic risks and the potential implementation of proportionate mitigation measures. Impacts on fundamental rights, democratic processes, the protection of minors, public safety, and the dissemination of illegal content are particularly scrutinized. Once a specific risk is identified, measures are planned to counteract its escalation, such as modifying the user interface or changing certain advertising practices. In emergency situations, the European Commission has the authority to require VLOP providers to assess the platform’s impact on the development of the crisis, implement specific mitigation measures, and submit periodic reports on the effectiveness of these actions. Very large online platforms are also required to undergo an annual independent audit of compliance with the Digital Services Act (DSA) and regularly publish comprehensive reports on their activities. The aim of this action is to ensure transparency of the platform’s operation towards users and supervisory authorities.

The DSA also regulates advertising by introducing the requirement to maintain a public ad repository. This repository should include, among other things, the ad’s content, advertiser, funding entity, broadcast time, and the number of recipients. This solution is intended to ensure transparency in advertising messages and enable social and scientific analysis of platforms’ promotional activities. Restrictions have also been imposed on recommendation systems. This means that VLOPs are required to provide users with at least one way to display content that is not based on profiling, meaning it does not use user activity history or data. To monitor platforms’ compliance with the EU regulation, it is also possible to impose a requirement to share data on, for example, the performance of recommendation algorithms with the European Commission, national digital service coordinators, or verified researchers.

TikTok, however, is not subject only to the obligations of very large online platforms. It is subject to all regulations provided for in the Digital Services Act. According to Article 26, each advertisement must be clearly identified as promotional material and indicate the advertiser, the funding entity, and the mechanism by which it was tailored to the user. This restriction is particularly useful for the TikTok Shop platform, where sponsored content is commonly created in the manner of regular content published by creators. Limiting the phenomenon of so-called hidden advertising through the provisions described above aims to increase user awareness.

One of the DSA’s key goals is also the protection of minors. When designing their services, platforms are required to consider a high level of protection for minors and their privacy. It is prohibited to display advertisements based on the profiling of minors when the platform has knowledge of the user’s minor status. The goal is to limit the use of children’s data for marketing purposes and reduce the risk of addictive use of the app.

The European Commission has also become concerned about potential negative consumer behavior resulting from the increasing transformation of large social media platforms into e-commerce portals. Complex profiling algorithms, influencer marketing, and instant purchases can encourage users to make impulsive decisions or even become dependent on purchasing processes. Articles 25 and 27 of the Consumer Protection Act (DSA) mitigate this risk. Designing web interfaces that manipulate or complicate consumer decision-making – so-called dark patterns – is prohibited. Examples of unacceptable solutions include hiding options that are less favorable to the business, making it difficult to unsubscribe from services, or designing buttons that encourage a specific choice. Users should also be fully aware of how the recommendation system works; therefore, platforms are required to clearly present its main parameters and the possibility of changing the content suggestion method.

Tamper protection and dark patterns

A key premise of the TikTok Shop platform is the immediacy of purchases. While this solution is very beneficial for businesses and, typically, consumers, it can lead to abuse. Sales without leaving the app, a simplified order completion process, and algorithmic personalization of recommended products seem to provide greater convenience when shopping online. However, some activities can be classified as ” dark patterns”, manipulations used to mislead users and influence their decisions. Because the practices described above can lead to impulsive behavior and distort consumer will, they may be treated as unfair market practices and subject to criminal penalties.

The Act of 23 August 2007 on Counteracting Unfair Market Practices defines an unfair market practice as a sale that is contrary to good practice and significantly distorts or may distort the market behavior of the average consumer before, during or after the conclusion of a product agreement , in particular a misleading market practice and an aggressive market practice (Act of 23 August 2007 on Counteracting Unfair Market Practices, Article 4). The main grounds for considering a market practice misleading include the dissemination of false information or truthful information in a potentially misleading manner. Such misleading information typically concerns the existence of a product, its type or availability, price, the method of price calculation, or the existence of a special price advantage.

To encourage immediate purchases, sellers pressure buyers with messages suggesting limited availability or a limited-time promotion for a specific product. Examples of such messages include phrases like “100 people are viewing the product,” “offer ends in 2 hours,” or “only 4 items left.” This practice is not illegal and is one of the most common marketing mechanisms. Problems arise when the website or portal is programmed to continually extend promotions, the offer doesn’t actually expire after the specified date, or the counter restarts upon page refresh.

Misleading practices, such as suggesting the limited nature of a permanently available offer, and aggressive practices, such as exerting time pressure, may result in legal consequences. In addition to the aforementioned Act of 23 August 2007 on Combating Unfair Commercial Practices, this issue is also regulated by Directive 2005/29/EC concerning unfair business-to-consumer commercial practices in the internal market. This directive distinguishes between misleading commercial practices and aggressive commercial practices. Together, they constitute unfair commercial practices, which include, in particular, actions that are contrary to the requirements of professional diligence and that significantly distort or are likely to significantly distort the economic behavior of the average consumer who reaches or is targeted by the practice, or the average member of a group of consumers if the commercial practice is targeted at a specific group of consumers (Directive 2005/29/EC of the European Parliament and of the Council of 11 May 2005 concerning unfair business-to-consumer commercial practices in the internal market and amending Council Directive 84/450/EEC, Directives 97/7/EC, 98/27/EC and 2002/65/EC of the European Parliament and of the Council and Regulation (EC) No 2006/2004 of the European Parliament and of the Council (“Unfair Commercial Practices Directive”), Chapter 2, Article 5, paragraph 2).

Directive (EU) 2019/2161 of the European Parliament and of the Council of 27 November 2019 (Omnibus Directive) is also intended to combat various manifestations of the “dark patterns” phenomenon. It requires sellers to disclose the lowest price for a product within the last 30 days. This is intended to prevent the practice of artificially inflating prices and then announcing sales. The practice of fake reviews has also been curbed by introducing an obligation to disclose whether and how reviews posted on sales websites are verified. The Omnibus Directive also introduced the requirement to indicate on marketplace platforms whether the seller is a private individual or a professional entrepreneur, so that consumers are aware of who they are buying from.

The European Union has also introduced restrictions related to the design of digital services, contained in Regulation 2022/2065 on the Digital Single Market (DSA). As a result, online platform providers cannot design, organize, or operate their online interfaces in a way that misleads, manipulates, or otherwise interferes with or limits the ability of service users to make free and informed decisions. The regulation therefore directly addresses the fight against “dark patterns,” i.e., website design practices that deliberately use deceptive techniques, such as pre-selected consents or difficult unsubscribes.

The President of the Office of Competition and Consumer Protection (UOKiK) has broad authority to protect consumers from the unfair commercial practices mentioned above. Under the Act of 16 February 2007 on Competition and Consumer Protection, one of his powers is to protect the collective interests of consumers, including through provisions counteracting unfair market practices. If necessary, the UOKiK President may initiate proceedings against a business, ordering it to cease the unfair practice, or requiring the seller to remedy the effects of the violation. Should a business fail to comply with the guidelines, he may impose a fine of up to 10% of the business’s turnover in the previous year.

The number of legal acts, including EU documents, regulating unfair commercial practices reflects the considerable interest in this issue among both legislators and consumer protection authorities. TikTok Shop, as a social commerce model, is not illegal. It utilizes mechanisms combining influencer marketing, personalization, and emotional impact on the recipient, but the design of the user interface is crucial for this platform. The popularity of mass sales portals has contributed to the increasing use of “dark patterns” by businesses over the past few years. For this reason, the European Union and the Office of Competition and Consumer Protection (UOKiK) are increasingly rigorously monitoring sales tactics and issuing new legal acts to protect consumers and their free will when making purchases.

Influencer Marketing and Advertising Law

The effectiveness of influencer marketing stems from combining advertising with the ability to make an immediate purchase. Affiliate links, product tags, or direct purchase buttons, such as those on the TikTok Shop platform, are displayed beneath posts, videos, or other promotional materials. This purchasing model has proven effective by significantly simplifying the ordering process, thus reducing the time consumers spend considering the rationale behind the transaction.

The popularity of the marketing strategy described above stems from its perception by users, who perceive it as authentic and credible. Influencers present promoted products in a natural way, integrating them into their daily routine. However, if the material does not solely reflect the creator’s personal opinion but is created after receiving a benefit in return, it is considered commercial communication. This means it is subject to legal regulations on advertising and consumer protection. In Poland, influencers should clearly label advertising content in accordance with the Recommendations of the President of the Office of Competition and Consumer Protection. These regulations are intended to prevent misleading users.

Only content regarding a product that the influencer purchased independently and for which they did not receive remuneration or other benefits can be marked as a private opinion. Such material contains genuine feelings and opinions and therefore does not constitute advertising under the law and is not subject to advertising law. This is the most credible and reliable form of review for potential consumers, as it was created by a person not under any obligation to the manufacturer.

A manufacturer may enter into an agreement with an influencer to promote a product in exchange for a free product, financial benefit, or other form of remuneration. This creates legally regulated advertising. It may take the form of a post, report, or live broadcast in which the creator demonstrates how they use the product and its positive properties. Due to the natural presentation of the product as an everyday element, the recipient may have difficulty distinguishing a genuine recommendation from commercial content. The Act of August 23, 2007, on Counteracting Unfair Market Practices, classifies the act of concealing a promotional message as a misleading omission. Failure to clearly indicate the commercial nature of the material may hinder consumers’ proper assessment of the message and directly influence their purchasing decisions.

Another common advertising strategy is to feature a product integrated into published content without directly promoting it, for example, by placing it in the background of the material. This phenomenon is called product placement. Activities covered by advertising and consumer protection law also include, among others, affiliate and partner links, ambassador programs, and partner competitions. In Poland, these practices must contain clear, understandable to the average recipient, and visible advertising labels from the very beginning, such as “advertisement,” “paid collaboration,” or “sponsored content.” The Office of Competition and Consumer Protection (UOKiK) also recommends the use of two-level labeling, meaning that, in addition to the information contained in the content, the platform’s functionality must also be used to announce the paid collaboration. Detailed guidelines can be found in the Recommendations of the President of the UOKiK regarding the labeling of advertising content by influencers. Material is considered advertising content not only when the influencer receives monetary compensation in exchange for its creation. The same obligation applies when promoting your own business, receiving a free product or service, or obtaining a sales commission via an affiliate link or discount code (Recommendations of the President of the Office of Competition and Consumer Protection regarding the marking of advertising content by influencers).

In the event of non-compliance with the Recommendations of the President of the Office of Competition and Consumer Protection regarding the labeling of advertising content by influencers, pursuant to the Act of 16 February 2007 on Competition and Consumer Protection, the Office of Competition and Consumer Protection (UOKiK) conducts proceedings against entrepreneurs using practices that violate the collective interests of consumers. Actions may be taken against advertisers, influencers, and marketing agencies. Therefore, responsibility for incorrect labeling of advertising content rests not only with the creator publishing the material but also with all entities participating in organizing the promotional campaign. One of the sanctions that the President of the UOKiK has the right to impose is a financial penalty. Incorrectly labeled promotional material can also be considered surreptitious advertising. Due to the dynamic development of influencer marketing, the proper creation of marketing content is currently widely subject to UOKiK scrutiny. Therefore, it is worth clearly and understandably labeling sponsored publications, among other things, to avoid significant financial penalties.

Personal data protection

TikTok Shop, as a hybrid social network and e-commerce platform, processes a significant amount of data related to both user activity and purchasing processes. The app’s operation is based on audience profiling and matching the most relevant content. Therefore, the platform’s operations are subject to the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR).

In addition to user data such as name, surname, contact details, shipping addresses, and payment information, media platforms also collect information that allows for behavioral analysis. Time spent browsing specific products, interactions with ads, and the history of items added to carts or wish lists allow the TikTok Shop platform to create a personalized recommendation system based on past activity. This phenomenon creates so-called behavioral advertising, a marketing strategy based on user profiling using advanced algorithms to predict future purchasing decisions. The concept of profiling refers to the automated processing of personal data, particularly for the purpose of predicting a user’s economic situation, personal preferences, interests, health, and location.

According to the GDPR, profiling is permissible, but it also comes with a number of obligations. Platforms are obligated to transparently inform users about, among other things, the purposes of profiling, the legal basis for data processing, the consequences of the actions taken, and their rights, including the right to object to profiling. Data of minors is particularly protected. Due to the growing popularity of the TikTok app among young users, it was necessary to subject it to special regulations in this regard. In the area of information society services, the processing of data of children over 16 years of age is lawful. An exception is made for situations in which a person with parental authority or guardianship provides prior consent. However, EU member states may introduce a lower age limit in their laws, but it must be at least 13 years old, as is the case in Poland, for example. To ensure that platforms enforce their obligations related to the protection of minors, they should use appropriate age verification mechanisms. In practice, however, this solution requires further improvement due to the common practice of users providing false data during registration.

The President of the Office of Competition and Consumer Protection (UOKiK) plays a crucial role in protecting users, especially the collective interests of consumers. He is authorized to take action against entrepreneurs who engage in unfair market practices, design manipulative interfaces, and so on. Personal data protection, however, falls primarily within the remit of the Office for Personal Data Protection (UODO), which oversees compliance with the GDPR and the secure processing of information by companies and institutions. Due to its global influence, TikTok has attracted increasing attention from EU authorities in recent years and is becoming the subject of more frequent inspections. Due to the platform’s European headquarters being located in Ireland, the relevant supervisory authority is the Irish Data Protection Commission (DPC). For example, in 2025, this institution imposed a fine of €530 million on ByteDance, the app’s owner. The fine was imposed on the transfer of user data from the European Economic Area to China in violation of the GDPR and the failure to demonstrate data protection at the level guaranteed in the EU.

The GDPR is supplemented by Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications), which regulates, in addition to the processing of personal data, the confidentiality of electronic communications, also known as ePrivacy. Due to the scope of its regulations, the provisions of this directive have particular relevance to the TikTok Shop application. The platform uses numerous tracking technologies, such as cookies and mobile device advertising identifiers, to monitor user activity. Information may be stored on a user’s device or accessed only after obtaining prior consent. Exceptions are made only for technologies strictly necessary to provide the service requested by the user, such as remembering a shopping cart. An additional ePrivacy regulation was also envisaged, the purpose of which was to replace the current directive and harmonize the personal data protection rules applicable in all EU Member States. The changes were to include, among other things, simplifying the rules regarding cookies. However, the project encountered legislative difficulties and was not adopted by decision of the European Commission.

Abuse of Market Power and the Digital Markets Plan

The dynamic expansion of the largest digital platforms’ influence has led to the need to adapt competition law to the new situation, particularly in the digital market. To this end, the European Union adopted Regulation (EU) 2022/1925 of the European Parliament and of the Council of 14 September 2022 on contestable and fair markets in the digital sector and amending Directives (EU) 2019/1937 and (EU) 2020/1828 (Digital Markets Act – DMA). The Act introduces the concept of a gatekeeper. This term refers to an entrepreneur with an influential position in the internal market, through which business users reach end users. A gatekeeper provides a core platform service and maintains an established market position.

The dominant position of a gatekeeper is also associated with a number of obligations. Among other things, the practice of self-preferencing, which involves favoring one’s own products or services over the offers of other businesses using the platform, is prohibited. In the case of TikTok Shop, this could involve using recommendation algorithms to increase the visibility of products promoted by individual sellers, without applying objective and fair advertising criteria. This type of favoritism and limiting the reach of individual entities could lead to a distortion of fair competition between businesses using TikTok Shop for sales purposes.

By decision of the European Commission, BytaDance Ltd. was granted gatekeeper status solely for the operation of the TikTok application as a social media platform. The DMA regulations governing the gatekeeper position do not apply directly to TikTok Shop, but they may impact the rules for recommending products and using entrepreneurs’ data.

Media law and audiovisual regulations

Audiovisual materials are the primary tool for promoting and selling products on the TikTok Shop marketplace. Therefore, the app’s operations are also subject to scrutiny for compliance with media law and regulations governing audiovisual media services. The dominant role in this regard is played by Directive 2010/13/U of the European Parliament and of the Council of 10 March 2010 on the coordination of certain provisions laid down by law, regulation, or administrative action in Member States concerning the provision of audiovisual media services (Audiovisual Media Services Directive – AVMSD) and the Broadcasting Act of 29 December 1992, which implements it into Polish law. As a result of the amendment to the Act of 11 August 2021, the regulations have been extended to video-sharing platforms, including the TikTok app.

Video-sharing platforms are primarily obligated to implement appropriate measures to protect minors from harmful content that could negatively impact their moral, mental, or physical development. These provisions have been implemented into Polish law through Article 47e of the Broadcasting Act, which mandates, among other things, the marking of potentially inappropriate content with special graphics for young viewers. These regulations are particularly important for the TikTok Shop platform due to the constantly growing number of underage users. Posting content that spreads hatred and discrimination is also prohibited.

TikTok Shop, a hybrid social media platform and e-commerce platform, is often used to publish so-called audiovisual commercial communications—images used to directly or indirectly promote goods, services, or individuals (Directive 2010/13/U of the European Parliament and of the Council of 10 March 2010 on the coordination of certain provisions laid down by law, regulation or administrative action in Member States concerning the provision of audiovisual media services, Article 1). Article 9 of the AVMSD requires member states to ensure that such communications are easily recognizable, thus prohibiting hidden audiovisual commercial communications. The use of subliminal techniques or the inclusion of discriminatory content would also be illegal. The National Broadcasting Council (KRRiT) is responsible for ensuring compliance with audiovisual law. Its remit includes, among other things, overseeing the activities of video-sharing platform providers.

The sales method used by TikTok Shop may seem analogous to teleshopping, offerings directly to consumers to deliver goods or services in exchange for payment. This modern form of interactive audiovisual commerce (live shopping) bears numerous similarities to traditional teleshopping. The mechanisms of both aforementioned sales methods involve presenting the product, its specific features, available options, and generally encouraging the recipient to purchase. However, teleshopping is targeted at a general, anonymous audience who may only be interested in the recommended product. Meanwhile, TikTok Shop relies on advanced algorithms that target promotional content to users who, based on their previous activity, have shown interest in similar content.

Platform liability under e-commerce regulations

The original act regulating the legal liability of online platforms in the European Union was Directive 2000/31/EC of the European Parliament and of the Council of 8 June 2000 on certain legal aspects of information society services, in particular electronic commerce, in the Internal Market (Directive on electronic commerce). Its foundation was the so-called safe harbor principle, i.e., the principle of limited liability of online intermediaries. According to this principle, hosting service providers and online platforms were not liable for content or goods published by users, provided they had no actual knowledge of the illegal nature of the content or goods or services or, upon obtaining such knowledge, promptly removed any infringements. Furthermore, the directive did not impose a general obligation on platforms to monitor content published by users.

However, the ongoing development of digital platforms has made it necessary to amend the current liability model. Regulation (EU) 2022/2065 – Digital Services Act (DSA) – came into effect on February 17, 2024. This regulation does not eliminate the principle of limited liability but significantly expands monitoring obligations, especially for very large online platforms (VLOPs). One of the key obligations introduced under the new regulations is the Know Your Business Customer (KYBC) principle. This regulation aims to increase the safety of consumers shopping online by limiting sales conducted by dishonest or anonymous traders. Before enabling sales through its platform, an online platform must collect and verify basic data identifying the seller. The required information includes, among others, the trader’s name, registered office address, contact details, registration number in the relevant register of traders, and the trader’s payment account details. In the event of refusal to provide the specified data or providing it falsely, the platform should prevent the trader from conducting sales until the situation is resolved.

A problematic issue related to the TikTok Shop app is defining the platform’s responsibility for transactions conducted by sellers using it. Although TikTok Shop formally acts as an online intermediary, it can be argued that its operating mechanism goes beyond passive hosting. A recommendation system using algorithms, promoting offers, and providing marketing and analytical tools to sellers are the mechanisms TikTok Shop uses to shape consumer behavior and purchasing decisions. The platform’s influence on the visibility of offers and the order fulfillment process may support assigning it broader responsibilities in overseeing the online sales process.

Regulations on electronic communications, including the European Electronic Communications Code and the Polish Electronic Communications Law

The TikTok Shop platform does not constitute an electronic communications service under European Union law, but its operations provide for various forms of electronic communication. TikTok Shop’s use of push notifications, in-app messages, and marketing communications requires the platform to comply with regulations governing electronic marketing and the protection of user privacy in electronic communications. The primary legal acts regulating these aspects are Directive (EU) 2018/1972 of the European Parliament and of the Council of 11 December 2018 establishing the European Electronic Communications Code (EECC) and the Act of 12 July 2024 – Electronic Communications Law.

The primary function of TikTok Shop is to enable entities to sell goods through the social media platform. Article 2 of the European Electronic Communications Code defines an electronic communications service as the transmission of signal transmissions or the provision of interpersonal communications services. The mere ability to exchange messages between users or with sellers does not automatically qualify the TikTok Shop platform as a provider of electronic communications services, as this is not its core competency and does not constitute its core business. However, because electronic communications are primarily used for marketing purposes, it is obligated to comply with regulations governing direct marketing and the protection of user privacy.

Push notifications, messages sent directly to users’ mobile devices, are an increasingly popular marketing solution. TikTok Shop uses them to provide information about order status, discounts, time-limited campaigns, or the launch of live shopping. Transactional notifications regarding order fulfillment, shipping, or payment status are typically part of the contract and do not require marketing consent. However, notifications encouraging potential consumers to make a purchase are classified as direct marketing and, in accordance with electronic communications law, require prior user consent.

The practice of using automated calling systems and electronic means of communication for advertising purposes without the user’s prior consent is also prohibited. Users should be clearly informed about the purpose of receiving marketing communications, the data controller, and the possibility of withdrawing consent, which should not result in any negative consequences. With respect to the TikTok Shop platform, the above position means that it is unlawful to send promotional content to users solely based on the fact that they have an account on the app.

TikTok Shop is the clearest example of how thin the line between entertainment, advertising, and commerce has become – a one-tap purchase woven into a stream of content is now as effortless as liking a video. Yet that convenience comes at a price: the closed-loop model and algorithmic personalization shrink the time left for rational reflection, while responsibility for protecting the consumer shifts increasingly away from the buyer and onto the platform and the legislator. EU and national regulations – from consumer law, through the DSA and DMA, data protection and safeguards for minors, all the way to media and electronic communications law – form a web meant to counterbalance the platform’s power and restore the buyer’s awareness of their own choices. TikTok Shop thus remains a dual phenomenon: on one hand a groundbreaking innovation in digital commerce, on the other a test of whether the law can keep pace with a technology that sells faster than we can think.

Artykuł A Store in Your Pocket, the Law in the Background: TikTok Shop Under the Regulators’ Lens pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

Analysis of key changes for business managers

We have analyzed the proposed changes to criminal procedure, which introduce a new structure for conducting proceedings, moving away from the current, restrictive model. The foundation of the amendment is the liberalization of regulations and the strengthening of procedural guarantees for suspects, which is a direct response to the need to implement EU directives and restore the adversarial standard.

Compared to the current state of affairs, the draft law shifts away from the inquisitorial model and instead provides real legal protection for economic participants. These changes are crucial for individuals serving on corporate boards, effectively increasing their legal security in the area of risks inherent in running a business.

Recent years in Polish criminal procedure have been characterized by the primacy of procedural efficiency over individual rights, leading to a systematic tightening of discipline. This has manifested itself, among other things, in the facilitation of the use of preventive measures and the admission of evidence obtained illegally. Project 1600 makes a systemic shift towards strengthening citizen guarantees, restoring the principle of full equality of the parties and fair litigation. For the business sector, this means a real opportunity to actively shape their defenses at the pre-trial stage, instead of adopting a solely reactive approach.

A key element of this reform is to address years of neglect related to the implementation of the so-called EU defense directives (Directive 2013/48/EU of the European Parliament and of the Council of 22 October 2013 on the right of access to a lawyer in criminal proceedings and in European arrest warrant proceedings, and on the right to have a third party informed upon deprivation of liberty and to communicate with third persons and with consular authorities while deprived of liberty (OJ L 294, 2013, p. 1)). The existing regulations failed to meet European standards, which became the basis for the European Commission to initiate proceedings for Poland’s violation of its treaty obligations. The most important change in this regard is Article 245 § 1 of the Code of Criminal Procedure, which requires that a detained person be immediately allowed to contact a defense attorney and have a direct conversation. As the bill’s justification indicates, detention is a criminal act aimed at prosecuting, and therefore a lawyer or legal advisor providing assistance at this stage has full defense status. Furthermore, the introduction of mandatory on-call duty for lawyers and legal advisors, as defined in Article 245 § 2 of the Code of Criminal Procedure, guarantees effective legal assistance from the very first minute of the proceedings.

This solution is important for management bodies, as the isolation of an organization’s leader creates the risk of paralyzing the entity’s decision-making. The guarantee of immediate legal assistance enables the implementation of crisis management procedures and significantly reduces the risk of submitting flawed procedural declarations with a high degree of economic complexity.

Project 1600 introduces systemic mechanisms to limit the arbitrariness of imposing preventive measures in isolation. A significant change is the increase in the threshold for a severe sentence from 8 to 10 years (Article 258 § 2 of the Code of Criminal Procedure) and the requirement to demonstrate a real risk of perversion in each case. This eliminates the automatic nature of detention in commercial cases, obliging the court to assess whether the severity of the impending sanction actually poses a threat to the course of proceedings in the specific factual circumstances.

The new wording of Article 248 §§ 2 and 3 of the Code of Criminal Procedure serves to discipline law enforcement agencies. It introduces an absolute obligation to release a detainee if, within twenty-four hours (reduced from the current forty-eight) of being brought to the attention of the court, they are not served with a detention order and justification. The legislature establishes an absolute prohibition on re-arrest based on the same facts and evidence. This solution curbs the practice of circumventing procedural deadlines by repeatedly detaining an individual under the same circumstances. For governing bodies, this regulation guarantees the stability of their procedural status and protects personal freedom through repeated isolation.

The reform is complemented by the expansion of evidence disclosure. The amendment to Article 156 § 5a of the Code of Criminal Procedure removes the previous restriction on the exclusion of witness statements from accessible files. The current wording requires the authority to immediately provide the suspect and defense attorney with evidence attached to the arrest request. Restoring full equality of arms allows the defense to substantively refute the prosecution’s entire case, rather than select fragments. For management, implementing these rigors provides fundamental protection against the use of isolation as a pressure tool, directly protecting the reputation and operational stability of the company.

The planned amendment introduces a fundamental change to the Polish criminal process, restoring the primacy of procedural fairness to establishing the material truth at all costs. A key element of the reform is the definitive rejection of the admissibility of so-called “fruits of the poisonous tree,” which directly implements the fair trial standard. Under the current legal framework, shaped by the controversial wording of Article 168a of the Code of Criminal Procedure, evidence cannot be deemed inadmissible solely on the basis that it was obtained in violation of procedural rules or through a prohibited act. Therefore, previous case law permitted the procedural validation of evidence from unlawful sources, provided it was not obtained as a result of the most serious crimes (such as murder or deprivation of liberty). The amendment replaces this model with an absolute prohibition on using materials obtained as a result of a prohibited act. This excludes the possibility of subsequently deeming evidence obtained in violation of the law admissible and prevents law enforcement agencies from remedying procedural deficiencies by invoking an overriding public interest.

In the area of operational control, the reform introduces adequacy rules, which significantly modifies the current procedure for handling incidental evidence. The previous regime of Article 168b of the Code of Criminal Procedure allowed for almost unlimited use of wiretapping materials in cases involving any crime, even if they did not fall within the list of acts justifying the use of operational control. This led to a phenomenon referred to in the doctrine as fishing expeditions, where surveillance ordered in high-stakes cases became a gateway to seeking marginal violations, such as fiscal violations, which would not, in themselves, legitimize such a profound interference with civil liberties. The amendment thus compels the prosecutor to exercise a higher level of investigative diligence, shifting the defense’s focus from substantive analysis of evidence to reviewing the legality of its acquisition.

For the business sector, the implementation of these solutions brings enormous guarantee benefits, primarily in the form of protecting the integrity of business communications and eliminating uncertainty as to the procedural status of managers.

The analysis is based on the standards developed by the European Court of Human Rights in the context of Article 6 of the ECHR, as well as the constitutional principle of proportionality and the right to privacy. The new wording reflects the desire to civilize criminal procedure, where the reliability of state authorities becomes paramount over the ad hoc effectiveness of the public prosecutor, which is the foundation of economic security in a state governed by the rule of law.

The overall proposed changes to criminal procedure should be viewed as a significant strengthening of the legal position of entrepreneurs and management. The shift from an inquisitorial model to a fully adversarial and transparent judicial process significantly minimizes the risk of procedural abuses, which could previously be used as a tool for extraneous pressure in commercial disputes. The reinstatement of strict evidentiary prohibitions and the shortening of procedural deadlines for deprivation of liberty compel law enforcement agencies to adhere to a higher standard of diligence, which directly translates into the operational stability of businesses. Under the new legal framework, the most crucial element of a defense strategy is not only the substantive refutation of allegations but, above all, rigorous oversight of the legality of the state’s operational actions.

Sources:

Directive 2010/64/EU of the European Parliament and of the Council of 20 October 2010 on the right to interpretation and translation in criminal proceedings (OJ L 280, 26.10.2010, p. 1);

Directive 2012/13/EU of the European Parliament and of the Council of 22 May 2012 on the right to information in criminal proceedings (OJ L 142, 1.6.2012, p. 1);

Directive 2014/41/EU of the European Parliament and of the Council of 3 April 2014 regarding the European Investigation Order in criminal matters (OJ EU L 130, 1.5.2014, p. 1, OJ EU L 201, 30.7.2019, p. 47, OJ EU L 39, 21.02.2022, p. 1 and OJ EU L 2023/2843, 27.12.2023);

Directive (EU) 2016/343 of the European Parliament and of the Council of 9 March 2016 on the strengthening of certain aspects of the presumption of innocence and of the right to be present at the trial in criminal proceedings (OJ L 65, 11.03.2016, p. 1);

Artykuł Criminal Procedure Reform (Project 1600) – Polish Standards of Protection in Commercial Matters pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

1. Reports only via e-Sanepid

Every dietary supplement introduced to the market for the first time must be reported to the Chief Sanitary Inspector (GIS). Until now, various forms were acceptable – paper or electronic, with a handwritten or electronic signature. After the amendment comes into effect, the only acceptable method will be the e-Sanepid platform.

What does this mean in practice?

• It is necessary for each person submitting notifications to have a qualified electronic signature or a trusted profile.
• All communication with sanitary inspection bodies – letters, decisions, and confirmations – will be handled through the platform account. The moment of notification submission will be clearly confirmed with an official receipt, eliminating disputes over the deadline.
• Companies that have previously used paper forms or traditional correspondence must immediately switch to the new channel and ensure appropriate employee training.

The change also concerns the timing of the notification obligation: the previous option to notify the Chief Sanitary Inspectorate (GIS) at the stage of intended product introduction is no longer available. The obligation now arises at the time of actual introduction to the market.

2. Strict deadlines and automatic presumption of irregularities

The amendment introduces a completely new mechanism for conducting investigations. This change has the greatest potential to surprise companies without effective internal compliance procedures.

How does the new mechanism work?

If the Chief Sanitary Inspectorate initiates an investigation and requests the entity to submit a scientific opinion, the company has exactly 14 days to submit an application to an accredited scientific unit – at the same time forwarding a copy of it to the Chief Sanitary Inspectorate.

The mechanism for presuming irregularities is a significant innovation. Previously, a company’s inaction during the proceedings did not automatically result in any legal consequences – the proceedings could drag on for years. Following the amendment, any failure to meet the 14-day deadline will lead to direct negative consequences, regardless of whether the product is safe.

3. Advertising without reporting? A fine of nearly one million zlotys

This change directly impacts brands engaging in active digital marketing. Previously, advertising or presenting a dietary supplement without prior notification to the Chief Sanitary Inspectorate (GIS) was punishable by a fine (a misdemeanor). Following the amendment, this becomes grounds for imposing an administrative fine – with new, significantly higher penalties.

What exactly is prohibited?

The amendment penalizes not only the sale of a supplement without reporting it to the Chief Sanitary Inspectorate (GIS), but also the mere advertising or presentation of it if the notification has not been effectively submitted. In other words:

• Sponsored post on Instagram or Facebook promoting a new supplement before notification = grounds for an administrative penalty.
• Product page in the online store visible to the public before successful reporting to GIS = risk of infringement.
• Promotional materials sent to wholesalers or distributors before GIS is notified = potential infringement.
• Influencer marketing initiated before the date of effective notification = liability on the part of the entity commissioning the campaign.

Prohibition on suggesting medicinal properties – wider scope

The amendment expands liability for violations of advertising requirements from labeling to the entire marketing message. Previously, sanctions primarily covered incorrect packaging labeling. Following the amendment, a company is responsible for every communication channel – online advertising, point-of-sale materials, newsletters, or YouTube videos – if the message suggests that a varied diet does not provide sufficient nutrients, or if a supplement is presented as a medicinal product.

4. Public register – the company’s reputation under public scrutiny

The Chief Sanitary Inspectorate (GIS) has maintained a register of dietary supplements before, but the amendment will significantly expand its scope and availability. The data will be published on the e-Sanepid platform and will include:

• the name of the product and its qualitative composition (without quantitative data – the recipe remains protected),
• product qualification proposed by the entity,
• information about the initiation or ongoing investigation,
• data on the detection of a prohibited ingredient.

5. Fines – increase by over 330%

The maximum administrative fine for violating food safety regulations is increasing from 30 to 100 times the average monthly salary. At the current salary level, this means:

The new penalties are imposed administratively (not as fiscal or misdemeanor offenses), which means faster proceedings and no need to prove intentional guilt. A mere finding of a violation is sufficient. The increased level of sanctions has a real deterrent effect, especially for companies with turnover in the tens of millions of zlotys.

The biggest risks – a practical overview

Artykuł CLIENT ALERT Dietary supplements market in Poland Amendments to food safety regulations | May 2026 pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

We are delighted to share an important milestone in the continued development of KG Legal’s Data, AI & Cybersecurity Desk.

It has been a great honour to serve as the exclusive expert contributors for Poland to the OneTrust DataGuidance Privacy Overview – Poland, one of the world’s leading professional legal compliance resources relied upon by in-house counsel, privacy professionals, compliance officers, multinational organisations and technology companies operating across multiple jurisdictions.

Preparing this contribution was a long-term project that required several months of intensive legal analysis, research and editorial work. Our objective was not simply to describe the application of the GDPR in Poland. Instead, we sought to create a practical and comprehensive guide reflecting the significant transformation of the Polish regulatory landscape that has taken place in recent years as a result of new European legislation and its implementation into Polish law.

The publication therefore extends far beyond a traditional overview of Polish data protection law. It examines the interaction between privacy, digital regulation, cybersecurity and artificial intelligence, providing readers with practical guidance on the most important legal developments affecting organisations operating in Poland.

Our contribution discusses, among other things:

• the practical application of the GDPR within the Polish legal system;
• the powers and regulatory practice of the Polish supervisory authority for personal data protection;
• employee monitoring and workplace privacy;
• cookies, consent mechanisms and online tracking technologies;
• electronic communications and direct marketing requirements;
• international data transfers;
• personal data breaches and notification obligations;
• practical compliance with Polish privacy legislation;
• cybersecurity-related regulatory developments;
• the growing interaction between data protection and artificial intelligence governance.

A particularly important aspect of this work was addressing the rapidly evolving legislative environment. During the last few years, Poland has experienced substantial regulatory changes resulting from the implementation of numerous European legal instruments and the entry into force of directly applicable EU regulations that significantly affect organisations processing personal data.

Accordingly, the publication takes into account the practical implications of the evolving European digital regulatory framework, including the interaction between the GDPR and newer legal instruments governing digital services, artificial intelligence, cybersecurity and data governance. The analysis also reflects the impact of the AI regulatory framework, developments concerning data governance and electronic communications, as well as the increasingly interconnected compliance obligations facing businesses operating in today’s digital economy.

Rather than presenting legislation in isolation, the publication adopts a practical, compliance-oriented perspective. It combines:

• the GDPR and Polish implementing legislation;
• guidance issued by the European Data Protection Board (EDPB);
• the jurisprudence of the Court of Justice of the European Union;
• decisions and regulatory guidance published by the Polish Personal Data Protection Office (UODO);
• recent Polish legislative developments and market practice.

Our ambition was to create a resource that would assist both international and domestic organisations in navigating one of the fastest-changing areas of European regulation, where privacy law increasingly intersects with cybersecurity, AI governance, digital platforms, online communications and emerging technologies.

The contribution was prepared by Małgorzata Kiełtyka and Jakub Gładkowski, whose combined experience covers complex cross-border advisory work in data protection, artificial intelligence, life sciences, healthcare, technology law, cybersecurity, intellectual property and regulatory compliance.

https://www.dataguidance.com/experts-directory/Jakub_G%C5%82adkowski

https://www.dataguidance.com/experts-directory/Malgorzata_Kieltyka

For many years, Małgorzata Kiełtyka has advised international companies on GDPR compliance, healthcare regulation, AI governance, technology transactions and cross-border regulatory matters. Her practice combines strategic legal advice with practical implementation of compliance frameworks for multinational businesses operating in highly regulated sectors.

Jakub Gładkowski focuses on data protection, digital regulation, cybersecurity, intellectual property, IT law and emerging technologies. His practice includes advising innovative businesses on regulatory compliance, digital transformation projects and the implementation of European technology legislation affecting both public and private sector organisations.

Being entrusted with preparing Poland’s national contribution to OneTrust DataGuidance represents an important recognition of our team’s expertise and international standing. We are particularly proud that this publication reflects not only our experience in privacy law, but also our broader interdisciplinary approach, integrating data protection with AI regulation, cybersecurity, digital compliance and technology law.

We sincerely thank the editorial team at OneTrust DataGuidance for their confidence in our expertise and for the opportunity to contribute to a publication that supports legal and compliance professionals around the world.

For KG Legal, this publication marks another significant milestone in the continued growth of our Data, AI & Cybersecurity Desk and reinforces our commitment to delivering practical, business-oriented legal advice at the intersection of privacy, technology and innovation.

Artykuł A Major Milestone for KG Legal’s Data, AI & Cybersecurity Practice: Exclusive Poland Contribution to OneTrust DataGuidance pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

On January 15, 2024, there will be held the event KRAKÓW: City – space for business. Synergy for the reconstruction of Ukraine. The event is organized by the Polis-Ukrainian Chamber of Commerce within the framework of the social campaign “Partnership and Employment” and the project “Work for Reconstruction of Entrepreneurship in Ukraine.” The event will provide a unique platform for diverse professionals, thought leaders, and stakeholders to come together and discuss critical issues surrounding urban development, business opportunities, and collaborative efforts for the reconstruction of Ukraine. The conference will cover a wide range of topics such as urban planning, sustainable development, and the role of businesses in contributing to the reconstruction efforts in Ukraine. Renowned experts and speakers will share valuable insights, best practices, and innovative ideas, fostering a rich exchange of knowledge and experience. Participation in the Conference will be an enriching experience. The insights we will gain and connections made will undoubtedly contribute to our professional growth. The event will be participated by Weronika Mazurek on behalf of KIELTYKA GLADKOWSKI KG LEGAL.

• Lootboxes in Computer Games – Between Gambling Law and Consumer Protection. Regulatory Analysis Against the Background of Polish and European Union Law.
  July 24, 2026
  Publication date: July 24, 2026 The dynamic development of the computer games market has led to a significant change in the monetization models used by game producers and publishers. The traditional sales model, based on a one-time purchase of a product by the consumer, has been largely replaced by solutions based on long-term user engagement […]
• A Store in Your Pocket, the Law in the Background: TikTok Shop Under the Regulators’ Lens
  July 24, 2026
  Publication date: July 24, 2026 You see a video, a product catches your eye, and an “add to cart” button is already blinking in the corner of the screen. A few seconds later the order is placed, paid for, and on its way — all without leaving the app. That’s how TikTok Shop works: a […]
• Kiełtyka Gładkowski KG Legal has published an expert contribution in Infor, devoted to loot boxes in video games
  July 24, 2026
  Publication date: July 24, 2026 We are pleased to share that Kiełtyka Gładkowski KG Legal has published an expert contribution in Infor, one of Poland’s leading legal and financial publications, devoted to one of the most intriguing regulatory phenomena of the digital economy: loot boxes in video games. “Loot boxes in video games: between gambling […]
• Criminal Procedure Reform (Project 1600) – Polish Standards of Protection in Commercial Matters
  July 24, 2026
  Publication date: July 24, 2026 Analysis of key changes for business managers We have analyzed the proposed changes to criminal procedure, which introduce a new structure for conducting proceedings, moving away from the current, restrictive model. The foundation of the amendment is the liberalization of regulations and the strengthening of procedural guarantees for suspects, which […]
• Biostimulants under the microscope of the law – where does information end and prohibited advertising of medical devices begin?
  July 24, 2026
  Publication date: July 24, 2026 Biostimulants in aesthetic medicine – current regulatory challenges for manufacturers, distributors and clinics The aesthetic medicine market is currently one of the fastest-growing healthcare segments in Europe. Particularly dynamic growth is observed in so-called tissue biostimulants, preparations used to stimulate the body’s natural regenerative processes. While traditional fillers dominated just […]
• A well-aimed shot at American e-commerce. A practical guide to customs clearance of US shipments through the Polish Post.
  July 24, 2026
  Publication date: July 24, 2026 Jan K., a literature enthusiast with an extraordinary fondness for Polish children’s poetry, finally managed to find a very rare book after a long search – an edition of Julian Tuwim’s “Locomotive,” which he purchased without hesitation from a used bookstore in Maryland, USA, via the online platform AbeBooks. The […]
• Summer holidays? Not for our litigation team. We are preparing a dispute before the EU General Court
  July 24, 2026
  Publication date: July 24, 2026 The holiday season is in full swing, but our litigation team remains fully alert — and fully engaged. The best proof: ongoing preparations for proceedings before the General Court of the European Union in Luxembourg in one of the most complex categories of disputes — EU grant litigation. What is […]
• Faking reviews in e-commerce – analysis of new legal regulations, algorithmic mechanisms and market practices in the e-commerce sector
  July 10, 2026
  Publication date: July 10, 2026 The phenomenon of fake reviews in the digital space has evolved from a marginal image issue to a central focus of market supervision authorities and EU legislators. The contemporary ontology of this phenomenon extends beyond primitive content fabrication to encompass any form of communication that, by distorting the actual consumer […]
• NOTE – EU Cloud and AI Development Act (CADA) project and the concept of the sovereign cloud in the European Union’s digital policy
  July 10, 2026
  Publication date: July 10, 2026 I. Introduction On June 3, 2026, the European Commission adopted a proposal for the Cloud and AI Development Act (hereinafter: CADA or the draft), which is the centerpiece of the broader European Technological Sovereignty Package. This draft seeks to translate the political concept of digital sovereignty into binding legal standards […]
• CLIENT ALERT Dietary supplements market in Poland Amendments to food safety regulations | May 2026
  July 8, 2026
  Publication date: July 07, 2026 The draft Act of April 13, 2026, amending the Act on Food and Nutrition Safety will enter into force six months after its publication. The new regulations primarily impact producers, importers, distributors, and sellers of dietary supplements – both in traditional and online channels. Below, we present the real changes […]

Artykuł <strong>KIELTYKA GLADKOWSKI KG LEGAL TAKES PART IN THE EVENT “KRAKÓW: City – space for business. Synergy for the reconstruction of Ukraine”, January 15, 2024</strong> pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

The Wall Street Journal recently described quirks in the U.S. Tax Treaty with Malta that became a popular topic in the legal advice sector.[1] In the said article, WSJ describes an offshore tax shelter (a tax regulation in Malta) which promises rich Americans they can avoid lots of capital-gains taxes by setting up pensions in Malta. This issue is not only American struggle with tax abuse. For instance, Poland has also signed an international tax treaty with Malta (Agreement between the Government of the Republic of Poland and the Government of Malta for the avoidance of double taxation and the prevention of fiscal evasion with respect to taxes on income signed in La Valetta on 7 January 1994)[2] and in 2020 the Treaty was amended due to the necessity of closing loopholes in the international (bilateral) tax system[3]. Moreover as a restoration of the Polish industry after COVID-19 pandemic, the Polish Government and the Ministry of Finance prepared the new Tax Act which shall prevent the change of the entity’s tax residence to the offshore tax shelter [4].

Before we move to the tax abuse based on the U.S. bilateral tax treaty with Malta it is advisable to start with Treaty’s provisions treatment.

U.S. – MALTA TAX TREATY

The Treaty was done in 8 August 2008 and came into force in late 2010. As Jeffrey L. Rubinger wrote The Treaty contains very favorable provisions that can result in significant tax benefits to U.S. members of a Maltese pension. In order for such U.S. members to take advantage of these benefits, the pension must qualify as a resident of Malta under the Treaty and also satisfy the limitation on benefits (LOB) article of the Treaty. [5] In his article Rubinger enumerates the Treaty’s provisions that could become a victim of the interpretation tax abuse.

Article 4

RESIDENT

Section 2 The term “resident of a Contracting State” includes:

1. A pension fund established in that State; and
2. An organization that is established and maintained in that State exclusively for religious, charitable, scientific, artistic, cultural, or educational purposes. [6]

Notwithstanding that all or part of its income or gains may be exempt from tax under the domestic law of that State. In Rubinger’s opinion, a pension fund established both in the U.S. and Malta is a resident for the purpose of the Treaty, despite that all or part of the income or gains of such a pension may be exempt from tax under the domestic law of the relevant country.[7]

Article 22(2)

e) a pension fund, provided that more than 75 percent of the beneficiaries, members or participants of the pension fund are individuals who are residents of either Contracting State; (…)

Rubinger summarizes this provision in the following way: Thus, as long as a Maltese pension is formed pursuant to relevant Maltese law and more than 75% of its members are U.S. and/or Maltese residents, the pension plan should be eligible for Treaty benefits. [8]

Other crucial provisions are:

Article 18

PENSIONS FUNDS

Where an individual who is a resident of one of the States is a member or beneficiary of, or participant in, a pension fund that is a resident of the other State, income earned by the pension fund may be taxed as income of that individual only when, and, subject to the provisions of paragraph 1 of article 17, to the extent that, it is paid to, or for the benefit of, that individual from the pension fund (and not transferred to another pension fund in that other State). [9]

Article 17(1)(b)

PENSIONS, SOCIAL SECURITY, ANNUITIES, ALIMONY, AND CHILD SUPPPORT

Notwithstanding subparagraph a), the amount of any such pension or remuneration arising in a Contracting State that, when received, would be exempt from taxation in that State if the beneficial owner were a resident thereof shall be exempt from taxation in the Contracting State of which the beneficial owner is a resident. [10]

Taking into account the above, the following opportunity is emerging: if some highly-appreciated U.S. citizen (who has real estates, crypto- currency assets, shares, etc.) wishes to avoid the American tax system and high tax rates, he or she could decide to contribute these assets to a Maltese pensions fund. That American citizen is well-off thus the legal conditions are fulfilled. After that he/ she can sell the real estate and shares and have a pension fund (assuming that this person is at least 50 years old). Considering Maltese law regime, money from that fund can be distributed within 1 year (I stage), 4 years (II stage) and every next year (III stage) with a low tax burden (fiscal charge).

To read about and analyse the entire practical example with details and general conclusions, visit: https://www.jdsupra.com/legalnews/the-malta-pension-plan-a-supercharged-74273/

POLISH LEGAL FRAMEWORK PERSPECTIVE

As mentioned above, Poland also signed such tax Treaty with Malta government that shall prevent Polish tax system from the activities similar to Malta Pension Plan.

To read this Treaty: (link)

In this Act in its article 23 there is a provision on avoidance of double taxation and in article 24 – equal treatment provision that should provide no-loopholes in the bilateral tax legal system. Additionally, since 1^st January 2020 the Multilateral Convention implementing Measures of Treaty Tax Law to Prevent Tax Base Erosion and Profit Shifting, done at Paris on 24 November 2016 shall apply to this Treaty.

But the tax abuse danger comes from one more side – from the Controlled Foreign Corporation (CFC) which is a corporate entity that is registered and conducted in a different jurisdiction or country than the residency of the controlling owners. Control of the foreign company is defined according to the percentage of shares owned by citizens. The CFC legal regulations are intended to combating harmful tax competition on the part of certain countries (so-called offshore tax shelters), by preventing tax avoidance through the mechanism of shifting income to countries with preferential tax regimes. This assumption is implemented through taxation in Poland, as income attributed to a Polish entity, of income determined in relation to profits earned of a CFC, being a tax resident of another country, in which more favourable tax solutions are in force. [11]

These tax provisions are included in the:

• Act of 26 July 1991 on Personal Income Tax [12];
• Act of 15 February on Corporate Income Tax [13].

To read about these provisions and closing loopholes in the tax system, see:

https://www.rp.pl/Podatek-dochodowy/307119991-Zagraniczna-spolka-kontrolowana-jak-rozliczac-zyski-w-zagranicznej-spolce.html

https://www.rp.pl/Podatek-dochodowy/301099991-Opodatkowanie-dochodow-uzyskiwanych-przez-polskich-podatnikow-za-posrednictwem-zagranicznych-spolek-kontrolowanych.html

[1] https://www.wsj.com/articles/taxes-malta-pension-plan-11629418826, (access date: 23^rd August 2021). 

[2] http://www.przepisy.gofin.pl/przepisy,4,15,101,140,,,umowa-miedzy-rzadem-rzeczypospolitej-polskiej-a-rzadem-malty.html, (access date: 23^rd August 2021). 

[3] To read about this amendment: https://podatki.gazetaprawna.pl/artykuly/1497869,polska-i-malta-poprawiaja-umowe-podatkowa.html, (access date: 23^rd August 2021). 

[4] To read about this concept: https://www.money.pl/gospodarka/koniec-rajow-podatkowych-przedsiebiorcy-ktorzy-chca-wyniesc-sie-za-granice-beda-bardziej-kontrolowani-6661193624083072a.html, (data access: 23^rd August, 2021). 

[5] https://www.jdsupra.com/legalnews/the-malta-pension-plan-a-supercharged-74273/, (access date: 23^rd August 2021).

[6] https://www.foreign.senate.gov/imo/media/doc/treaty111-1.pdf, (access date: 23^rd August, 2021). 

[7] https://www.jdsupra.com/legalnews/the-malta-pension-plan-a-supercharged-74273/, (access date: 23^rd August 2021).

[8] https://www.foreign.senate.gov/imo/media/doc/treaty111-1.pdf, (access date: 23^rd August, 2021).

[9] https://www.foreign.senate.gov/imo/media/doc/treaty111-1.pdf, (access date: 23^rd August, 2021).

[10] https://www.foreign.senate.gov/imo/media/doc/treaty111-1.pdf, (access date: 23^rd August, 2021).

[11] https://www.rp.pl/Podatek-dochodowy/307119991-Zagraniczna-spolka-kontrolowana-jak-rozliczac-zyski-w-zagranicznej-spolce.html, (access date: 23^rd August 2021). 

[12] https://isap.sejm.gov.pl/isap.nsf/DocDetails.xsp?id=WDU19910800350, (access date; 23^rd August, 2021). 

[13] https://isap.sejm.gov.pl/isap.nsf/DocDetails.xsp?id=WDU19920210086 , (access date: 23^rd August, 2021). 

Artykuł An offshore tax shelter in the European Union on the example of “Malta pensions plan” featured by Wall Street Journal pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

On 7 September 2021 KIELTYKA GLADKOWSKI will take part in the Webinar Analysing the Role of Telemedicine in Post-Pandemic Care organised by Reuters Events in conjunction with the Digital Health division of the World Health Organisation which provides opportunities to accelerate progress in attaining health and well-being related Sustainable Development Goal (SDGs), especially SDG 3, and achieving triple billion targets for 2023 as articulated in its Thirteenth General Programme of Work (GPW13).

The webinar will focus on the growing importance of remote telemedicine, its aspects and opportunities. The speakers will include:

– Peter Thomas, CCIO and Director of Digital Medicine at Moorfields Eye Hospital

– Toralf Schnell, Chief Digital Officer and Head of the Digitization Unit at University Medicine Greifswald

– Dr. Evgeny Zheleznyakov, Technical Officer, WHO European Centre for Primary Health Care.

Telemedicine and digital health remains in the core specialisation of lifescience and healthcare expertise of KIELTYKA GLADKOWSKI, having vast experience in handling projects at the intersection of new technologies and healthcare, including data protection, regulatory and transactional aspects.

Artykuł KIELTYKA GLADKOWSKI TAKES PART IN THE WEBINAR DEVOTED TO THE ROLE OF TELEMEDICINE IN POST-PANDEMIC CARE pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

On 2 to 4 November 2021 KIELTYKA GLADKOWSKI KG LEGAL will take part in the virtual SPG 2021 Forum organised by R3 (Association of Business Recovery Professionals) SPG Forum (link) is a conference for trustees, restructuring experts and their employees.

During this 3-day event, our lawyers will have the opportunity to discuss the practical issues, participate in workshops and network with peers.

Some of the topics discussed will be the current regulatory framework for insolvency practitioners, key legal changes affecting the insolvency and restructuring of people and companies, and the exclusion of directors, the FCA’s guidelines for managers appointed or intended to be appointed by regulated firms; panel sessions with representatives of the financial industry discussing their experiences with the pandemic, recovery and new market trends; workshops, during which it will be possible to look at issues related to the insolvency of a real estate enterprise; workshop sessions during which the investigation and prosecution of claims in insolvent real estate will be discussed in-depth; interactive workshops, entirely devoted to the possibilities of the hotel business dealing with the challenges of the pandemic.

Some of the speakers will include:

1. Antoniya Mercer, Associate, TLT LLP
2. Caroline Sumner, CEO, R3
3. James Jeffreys, Head of Press, Policy and Public Affairs, R3
4. James Fagan, Radcliffe Chambers
5. Lauren Kreamer, Radcliffe Chambers
6. Craig Dickson, CT Inspector, Technical and Specialist Team, HMRC
7. Chris Herron, Partner, Herron Fisher
8. Simeon Gilchrist, Partner, Edwin Coe LLP
9. Jane Moore, Head of the Resolution Department, Financial Conduct Authority
10. Dan Burton, Executive Director, Cynergy Bank
11. Tom Weedall, Co-founder & Managing Director, Blazehill Capital
12. Miles Hacking, Managing Associate, Freeths
13. Chris Herron, Partner, Herron Fisher
14. James Hopkirk, Director of Restructuring, Kreston Reeves
15. Philippa Lai, Associate, JMW Solicitors LLP
16. Aileen McErlean, Hardwicke Chambers
17. Neil Stewart, Associate Director, Manolete Partner plc
18. James Pickering, Enterprise Chambers
19. Nicola Clark, Azets
20. Antoniya Mercer, Associate, TLT LLP
21. Phil Moran, TLT LLP
22. Brad Pomfret, Barrister, 23 Essex

The topics discussed during the conference are in the core of restructuring and insolvency specialisation of KIELTYKA GLADKOWSKI law firm, particularly from the perspective of business reconstruction and cross border insolvency procedures in cases when assets of the bankrupt are located in a number of countries.

Artykuł KIELTYKA GLADKOWSKI KG LEGAL TAKES PART IN R3 SPG Forum 2021 pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

Identification of the hacking problem

Based on the US Cybersecurity Trends Report (link to an online source at the end of the article), the hacking phenomenon records an increase in cyber-attacks in 2019 and 2020. From the legal perspective, what is particularly interesting is a significant increase in the recorded data loss events as a result of hacking activities in relation to the number of cases in individual years in the 2015-2020 prediction. One of the studies in the indicated report shows two specific moments over the years. The first one took place in 2016-2017, where we see an increase in hacker attacks by nearly 2,000 violations, but this is not related to a proportional increase in lost data, which differs from those from 2016 by about 1.5 million. In 2017, there was a slight increase in infringements, but more importantly, less data was lost. The second of these important moments indicated by the experts took place in 2018-2019, when there was a drastic increase in lost data with a slight increase in violations compared to 2018. We are seeing a drastic decrease in the number of breaches with a simultaneous huge increase in lost data.

From the analysis of the report, a surprising conclusion can be drawn that currently data breaches by hackers are less and less frequent compared to previous years, but much more effective.

The report also shows annual global cybersecurity transactions and equity financing in 2016-2021. In this respect there can be observed the huge projected increase in cash outlays for the cybersecurity target compared to 2020. The projected increase is over $ 10 billion. Despite the increase in spending, there has been a decline in the number of cybersecurity contracts.

The report presents the share of global cybersecurity transactions in 2020 by country. The first thing that throws up is that the US has over a half of shares in global market and is thus becoming a sort of hegemon in the fight against hackers. China ranks second with 12%. On the other hand, Israel ranks third with a 10% share, also showing a 4% increase compared to 2019. With the same trend, it has a good chance of overtaking China in this respect. The report shows the number of annual departures from the cybersecurity sector through mergers and acquisitions and stock market debuts. In the years 2016-2019, an upward trend can be noticed. From year to year, the number of departures increased by 100.

The report also shows the ratio of the increase in the number of the so-called megarounds (contracts worth over $100 million), which results in an increase in the volume of transactions.

All these increases in value did not go unnoticed. The consequence of the development of this type of industry, which is cybersecurity, is the creation and development of private companies. There are already over 30 companies in the world involved in the development of cybersecurity technologies, the value of which exceeds $ 1 billion. In Europe, for example, Acronis is such a company.

Almost 75% of cyber defenders are based in the United States, most of them in California. Second place, with almost 20% concentration of cyber defenders, is Israel. Canada and Ireland boast one “cyber defender” within their borders. In Canada it is the company “Isara”, and in Ireland “Tines”.

Methods of counteracting cyber attacks

There can be differentiated various methods of counteracting cyber-attacks. Most innovative ones are presented below:

“Identity orchestration”

This method is based on managing access to multicloud environments and enforcing the least privileged framework.

Two companies specialize in this method: “Ermetic” and “STRATA”. It is worth remembering that companies operating in on-premise systems and many clouds lack one, unified solution for identity management and limiting access to data and systems. The report shows how often companies dealt with an incident related to the security of a public cloud. In almost all of the countries surveyed, this problem exceeds 50%. Managing identity and access for any cloud and on-premises application can be a problem, so startups of all kinds take up the challenge of unifying identities across their IT infrastructure. As for identity orchestration, Ermetic inventories identities and assets across multiple clouds. Identifying risky permissions and behaviors across all cloud platforms and applying uniform rules can reduce the impact of cyber attacks. In turn, as for “STRATA”, it provides an abstraction layer for consolidating divergent identity management systems. By providing a single identity solution for on-premise applications and multicloud deployments, “STRATA” helps reduce security risks.

“Data Firewalls”

It consists in classifying, monitoring and controlling access to the most valuable data of the enterprise. Companies specializing in this protection are, for example, “Cyral” and “Open Raven”.

Companies face financial and reputational costs when their data is stolen by hackers or disclosed to the public. The report shows clearly that the 3 sectors that have the greatest problem with data theft or data leakage to the public are healthcare, energy and finance. 80% of data breaches contain customer identification information. In turn, 32% of data breaches concern intellectual property.

“Security Creds”

The above method is met by meeting compliance standards and conducting security audits. The companies “Vanta” and “Drata” specialize in this area.

The description of the methods in the report is guided by the rule that “a company is only as strong as its weakest partner”. In adapting to this new threat landscape, companies strive to differentiate themselves from the competition and gain customers by displaying their security credentials. In order to verify the attitude in the field of cybersecurity and acquire customers, companies undergo audits in order to obtain security certificates.

“Outsourced Security”

It stands for putting cybersecurity into the hands of external contractors. Detection and response service providers often use artificial intelligence to help companies identify and respond to threats. Their view of all customers can provide a better understanding of the threat landscape. The companies “ActZero” and “Confluera” specialize in this method.

„SaaS Security”

The above-mentioned concept can be interpreted as securing a growing ecosystem of SaaS applications for enterprises. In recent years, companies from various industries have increasingly used SaaS applications, i.e. third-party software operating in the cloud. Managing and monitoring a growing network of applications provides a unique set of challenges. In 2020, the leading industry in the use of SaaS applications is Technology, where as many as 155 applications were in use.

The use of Saas applications comes with an obligation, namely organizations using Saas applications must develop a plan to manage and secure their growing application ecosystems, especially for the users who have access to them. Emerging cybersecurity service providers are tackling this challenge by mapping corporate SaaS applications and implementing the necessary measures to secure the application ecosystem.

The above Saas customers responsibilities include:

1. Securing user access to the application
2. Verification of the identity of logging in users
3. Data / application integration

What steps does Saas take to protect the data of customers using the ecosystem of the above-mentioned application?

It does this in 3 ways.

1. It has constant access to all SaaS ecosystems.
2. It manages rights to SaaS applications
3. It monitors all activity within the limits of the SaaS application.

Companies specializing in SaaS protection are “AppOmni” and “Grip”. “AppOmni” monitors the Saas application ecosystem in search of suspicious activity, and manages user access to the data and the application itself. On the other hand, “Grip” maps SaaS applications and monitors their use, and helps to identify abuses and set permissions to reduce the risk.

„Crypto defense”

This type of cyber protection focuses on protecting the integrity of blockchain transactions.

What is blockchain?

Blockchain is a technology that stores and transmits information about transactions concluded on the Internet. This information is arranged in the form of consecutive data blocks. One block contains information about a certain number of transactions, then, after it is saturated, another block of data is created, followed by the next and the next, creating a kind of chain. Information about various types of transactions, e.g. trading, buying or selling currencies, including cryptocurrencies, can be sent there. The main essence of blockchain operation is to maintain a joint and collective transaction ledger in digital form, distributed over the network, in the same copies (more about Blockchain technology at: https://www.lazarski.pl/pl/wydzialy-i-jednostki/instytuty/wydzial-ekonomii-i-zarzadzania/centrum-technologii-blockchain/co-to-jest-blockchain-i-jakie-moze-miec-znaczenie-z-punktu-widzenia-ekonomii/ )  

It has to be kept in mind that blockchain is not inherently secure. Although blockchain has features that support security and privacy (such as an immutable ledger), it is not immune to cyber attacks. As evidence that blockchain technology is not secure, it can be demonstrated that more than $ 500 million was lost or stolen from decentralized financial projects (DeFi) in 2020.

Companies dealing with this type of protection are “valid.network” and “CERTIK”.

The first organization offers tools for detecting weaknesses in decentralized application code and monitors and controls transactions in real time. The latter, on the other hand, uses a formal verification method developed by scientists at Yale University to mathematically prove “the correctness of the program and its resistance to hackers.”

„Security-infused networks”

This method is understood as anti-hacker protection, mainly concerned with adding security to corporate networks.

Particularly in the environment of remote work, companies rely on reliable networks to enable safe transfer of information. Historically, these networks have been protected with numerous point solutions (e.g. VPNs, firewalls, VPN security brokers, firewalls, cloud access security brokers) which can frustrate IT teams and employees.

Startups and technology companies implement cyber security in software-defined network solutions (eg SD-WAN). A unified security model that is delivered as a service reduces complexity and helps multiple businesses keep their cybersecurity protocols up to date.

Some examples of the above technology providers are “Twingate” and “Ananda”.

“Twingate” provides users with secure access to corporate applications. The company secures networks by offering built-in access control and keeping them invisible to the internet. In turn, “Ananda” offers a cloud-managed, secure global local area network (LAN). The company enables companies to create their own private networks with security features such as encryption, microsegmentation and granular access control.

„Cyber automation”

This concept covers the development of cybersecurity processes and the automation of workflows. In the context of this type of protection, attention should be paid to a significant problem. Cyber-attacks, alerts and vulnerabilities continue to grow while the supply of qualified cybersecurity specialists remains limited.

The solution to this problem is automation, which increases the capabilities of cybersecurity workers. Companies using defined cybersecurity and threat data workflows have automated cyber processes and integrated with supporting systems such as Slack, Atlassian and SIEM (security information and event management). Automation of these processes significantly solves the problem of a small supply of qualified specialists. However, automation is also a kind of risk as what is automated can also be hacked.

In the context of this new risk, companies that specialize in protecting “cyber automation“, namely “Tines” and “Strike Ready”, can be named.

The former organization offers a code-less platform for automating workflow processes. It integrates with many technical tools for enterprises (e.g. Okta, Slack). Tines can automate tasks such as responding to phishing (a fraud method in which a criminal impersonates another person or institution to obtain confidential information), enrich security reports, and receive alerts.

The second organization, “Strike Ready”, develops digital cyber awareness and response analytics to analyze and resolve security incidents. The company can help security teams be more efficient and effective by autonomously prioritizing alerts, conducting vulnerability testing, and responding to attacks.

„API protection”

This is an activity to ensure the visibility of APIs to prevent malicious activity.

In the last few years, the use of an application programming interface (API) has grown rapidly in all industries over the past years. This comes with security risks that require new safeguards. The threats related to the API include:

1. Code injection
2. Faulty authentication process
3. Overexposure of data
4. No usage limits.

Companies are emerging, some developing solutions to secure API development, including vulnerability testing and ensuring proper configuration, while others monitor and respond to API abuse such as code injection and unauthorized access.

In the context of this protection, companies “Noname” and “Traceable” can be mentioned

Traceable discovers, secures and monitors APIs. Their product protects against known threats (eg SQL injection, Cross-Site Scripting) and also provides visibility into API activity to identify, investigate and solve the threat.

Noname, on the other hand, offers a suite of API security tools. The API security platform can locate corporate APIs, identify suspicious activity, and block attacks in real time. It can also test the integrity of APIs before production.

„Cyber insurance”

It is cyber risk management and financial securing of cyber costs.

Over the past 3 years, the impact of hacking on an affected company has become increasingly costly. Experts in the analysed report cited estimate that the theft of 10 million records could cost the company $ 100 million.

The above problem has created a niche that is efficiently filled by companies offering risk analysis tools, companies and insurers that are trying to solve the main challenges hampering market development, i.e. the lack of historical data on which to base risk models and the possibility of incurring significant sludge.

The organizations “Cowbell Cyber” and “Cyber Cube” specialize in this field.

The former uses data analytics and cybersecurity monitoring to offer cyber insurance. When defining the range, the company takes into account factors such as cybersecurity attitude and knowledge of the so-called “Dark web”. It also offers services such as cyber awareness training to reduce a company’s cyber risk.

The activity of the second organization consists in providing insurance companies with cybersecurity analysis and data enabling the determination of insurance risk. By compiling cybersecurity datasets and developing risk models, CyberCube provides insight into the development of cybersecurity insurance products.

„Shift left security”

This type of protection is dedicated to reducing the vulnerability of the application development stage.

When it comes to software development, security considerations are often the last step before going live. Building software without security considerations can at best lead to delays and inefficiencies, and at worst, create serious security holes.

There are many points in the software lifecycle at which security measures can be added, which can reduce the likelihood of security vulnerabilities and the time it takes to deploy more secure applications. Specialized companies have been established that approach these points of software development with solutions that reduce risk.

These organizations include, among others “Cycode” and “BlueBracket”.

The “Cycode” company secures the software development process from source code to cloud configuration. The company provides tools such as code fingerprinting, misconfiguration scanning and enforcement of security policies to reduce security risks in the software life cycle.

The second organization, “BluBracket”, protects the software code by assessing its risk and tracking its usage. By tracking sensitive code, highlighting misconfigurations and scanning code repositories for threats such as encrypted secrets or multiple owners, BluBracket brings security to the software development process.

„Secure data sharing”

This is an activity to protect the privacy of data shared with third parties or used for analysis.

In order to use existing data (e.g. to identify new medical treatments, develop customer personal information in retail, etc.), companies may seek to share, aggregate and analyze sensitive information, which may be a potential target for hackers. The protective elements of encrypted data have historically been at the expense of analysis and collaboration. However, new techniques have been developed to increase the usability of the data while maintaining its security.

Privacy preserving computation (PPC) is as follows:

1. Trusted Runtime
2. homomorphic encryption
3. differentiated privacy
4. secure multilateral computing

Examples of organizations specializing in the above-mentioned activities are “Cape Privacy” and “TripleBlind”.

Cape Privacy enables scientists to share and work with encrypted data. The product allows organizations to train AI models on encrypted data so that they can be shared without compromising privacy and security.

“TripleBlind” provides a solution for sharing and analyzing encrypted data. The platform offered by this organization allows companies to encrypt their data and algorithms to support secure data analysis and sharing.

„Auto security”

This type of cyber-protection is about defending connected vehicles against wireless and proximity attacks. Modern technologically advanced vehicles not only have access to the Internet, but also very often store various types of data. As a result, vehicles are becoming data centers on wheels that open up new opportunities for hackers.

Organizations that protect such vehicles against cyber-attacks are, for example, “Upstream” and “C2A”.

The first organization, monitors vehicles to identify and respond to cyber attacks and abuse. The company’s platform analyzes automotive data to detect and respond to cyber threats. The second organization, on the other hand, provides a tool to monitor the vehicle’s internal systems.

The company’s goal is to support car suppliers and manufacturers by offering security capabilities that identify attacks on vehicle systems (e.g. powertrain, ADAS).

„Post-quantum cryptography”

The above can be understood as:

1. cryptography based on the so-called “Trusses” – based on the abstract structures of mathematics.
2. Kodac-based cryptography – uses error correction codes that allow you to check the reading of the transmitted data for errors and correct them in real time.
3. multidimensional cryptography – based on solving multivariate equations. These equations are difficult to solve by brute force.

This type of protection is worked out, among others, by “ISARA” and “QuSecure”.

Isara offers tools to protect against future quantum attacks. In particular, ‘Isara’ allows companies to view and manage their crypto assets or infrastructure with a single tool that can support the transition to quantum safe algorithms.

On the other hand, “QuSecure” also provides solutions to avoid attacks using quantum computing by using quantum-safe algorithms. “QuSecure” provides solutions for key management and data security at rest.

Amendment of the Polish Act on Cybersecurity

The ongoing revolution of tools to combat cyber-attacks causes changes in cybersecurity law in such a way as to create legal instruments for public institutions to define legal rules for assessing which activities on data are illegal and, consequently, qualified as hacking. In addition, national regulations on IT service providers provide an opportunity to specify the criteria for cooperation between entities providing solutions in this respect.

A good example of such a law-making reaction is the amendment to the Polish act on cybersecurity. The most important change introduced by the amendment to the Cybersecurity Act is the introduction of non-technical supplier assessment criteria, such as a criterion aimed at analyzing a given supplier in order to check whether this supplier is under the control of a country outside the EU or NATO or not. If, in relation to a given supplier, a high risk of remaining under the above-mentioned control is detected, such supplier is excluded from procurements. The following changes in the Polish law from the perspective of cybersecurity regulations also include:

– rebuilding the cooperation model within the national cybersecurity system. Sectoral cybersecurity teams and cybersecurity service providers will be replaced by sectoral CSIRTs and SOCs (operational security centers), respectively, with only slightly changed tasks.

– the addition of a new type of entity – ISAC – which is to allow small and specialized entities to join the national cybersecurity system.

– strengthening the position of the government representative responsible for cyber security by providing him with specific powers in the field of issuing critical incident warnings together with the recommendation of specific behaviors. The said government representative will also be able to issue recommendations aimed at strengthening the level of cybersecurity of information systems of the entities of the national cybersecurity system. In turn, these entities will be required to take into account these recommendations during the risk management process. It will be up to these entities to decide whether to follow these recommendations.

– the establishment of the Polish National Cybersecurity Certification System under which cybersecurity certificates will be issued.

– The minister responsible for computerization will prepare programs on the basis of which it will be possible to conduct certification. Ultimately, these programs will be adopted by ordinance of the Council of Ministers.

– The supervisory authority will audit entities belonging to the national cybersecurity certification system. In the scope of certificates referring to the “high” trust level, it will also approve each issued certificate. This solution is intended to be a guarantee that the assessment of compliance to the highest level of security will be carried out in accordance with the best standards in this field.

– Defining procedures for accreditation of conformity assessment bodies and procedures for issuing certificates.

– Defining the obligations of the entities of the national cybersecurity certification system.

Legislation process of Polish Cyber Security Act:

https://legislacja.rcl.gov.pl/projekt/12337950/katalog/12716624#12716624

Draft amendment to the Act with justification:

https://legislacja.rcl.gov.pl/docs//2/12337950/12716624/12716625/dokument493122.pdf

Link to the website where the analysed Report can be downloaded: https://www.cbinsights.com/research/report/cyber-defenders-2021/

Artykuł Global trends of IT methods created by private providers of counteracting cyber-attacks (like Identity orchestration) – Change of Polish cybersecurity law important for foreign suppliers of IT equipment to the public sector and public utility institutions in Poland due to global threats pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.

On 29 July 2021 KIEŁTYKA GŁADKOWSKI KG LEGAL took part in the webinar ‘Cell and gene data innovation and multi-stakeholder data transfer’ (Plan, capture and set the infrastructure for data sharing across the value chain, to optimize commercial strategy), organized by Reuters Events in participation and partnership with Salesforce. The scope of the webinar is within life science and digital health specialization that constitutes one of the core specializations of our law firm.

Some of the panelists included:

Augusto Penjasoff – Business Partner, Global Cell Therapy IT Head in BMS (Bristol Myers Squibb),

Curt Fitzgerald – Director- Service Delivery- C&GT in Novartis,

Gary Gabriel – Global Advisor for Healthcare and Life Sciences in Tableau,

Neary Detrick – Senior Director, Data Management & Analytics in Bluebird Bio,

and Beth Hayes as a moderator- healthcare and lifesciences business consulting – Pharma Lead, Industry Transformation (Salesforce).

The mission of Salesforce company (a partner and a participant of the webinar) is to empower companies to connect with the customers, providers of services and patients in the new and reimagined way. Salesforce serves leading organizations across the industry, including pioneers in CGT (cell and gene therapy).

Important question posed during the webinar concerned personalized medicine.

The response is that the latter is the future of the medicine (so-called a Medicine 2.0). A deliberation about personalized medicine is not a discussion about future in about 10 or 15 years. It drives a magnificent impact across the industry. There was also discussed the question of the difference between the traditional medicine and personalized medicine.

The difference is that personalized medicine does not fit well with the normal (classical) paradigms of traditional medicines. It is an entirely new, and innovative paradigm of medicine. The new paradigm, way of thinking about medicine and therapy differs from the traditionally conceived and understood medicine in the so-called mindset (considering the entirely new technology as abovementioned cell and gene therapy- CGT). In the medicine 2.0 framework the disease is not treated, but the patient is treated, taking into account all the factors that would not normally be considered.

Cell and gene therapy challenges appear and arise because this type of therapy (revolutionary new and technically highly advanced) succeeded in the medical market. Thus, the challenges are the signs of the therapy’s development.

During the registration process organizers posed a question about the main challenge in the panelists’ CGT (cell and gene therapy) strategy. The results are as follows:

27% data standardisation and interoperability challenges

27% general, overall operational readiness

15%- cross- stakeholder agreements and alignment on data sharing and ownership

13% pre-commercialization, clinical data challenges

13% other

8% post- commercialization and long-term monitoring data challenges

The panelists commented on these results as follows.

Neary Detrick emphasized that her experience is the traditional pharma related with data. In the traditional paradigm of medicine the data about patient which is not related with the disease is not important and significant. Nowadays in the contemporary personalized medicine when the commercial and manufacturing sphere are much more associated and connected to each other (because the patient has become a part of the product) the information about the patient, his data, are crucial. Thus the data standardisation and the data circulation are one of the priorities in the Bluebird Bio strategy.

Gary Gabriel expressed the view that Tableau’s perspective is directed at the patient and the patient’s point of view. They are, in Tableau, focused on the data from the dashboards, visualization and patients’ statistics. They look at how the patients’ data is organized and standardized and how the present data can help in the prospective perspective of patient’s health and therapy.

Curt Fitzgerald suggested that the challenges depends on what moment you are at your journey and growth (small, medium or large). Data challenges in Novartis are for example gene data. From the operationalization perspective, one of the biggest challenges nowadays are the productization of the information flow across the stakeholders. That’s why if the stakeholders do not have a good operationalization system which operates and delivers data to other stakeholders (in one alignment), the whole CGT strategy will collapse regardless of whether the entity is small, medium or large. This challenge is universal.

Augusto Penjasoff noted that the key challenge is a mindset. Because the change of mindset changes the perspective and entire strategy.

The panelists also discussed the stages of data development and digital strategy.

Gary Gabriel expressed the opinion that in his opinion the scalability can be a useful tool to answer the question how to reach more patients, because these therapies are new and expensive. Considering that fact some relevant and tough question arise: What is the so-called information readiness and how to explain these therapies to the patients (and even for well-educated people as physicists). We can use, for instance, data indicators (to educate more patients and more providers) and use more dashboards and indicator.

The participation in the webinar will allow the lawyers within life sciences desk of KIELTYKA GLADKOWSKI KG LEGAL to provide tailor made legal services and assistance to the clients operating in cell and gene data innovation, also having regard to our participation at EuroBiotech Congress in November 2021: https://www.eurobiotech.krakow.pl/gb/

Artykuł KIEŁTYKA GŁADKOWSKI KG LEGAL TOOK PART IN CELL AND GENE DATA INNOVATION AND MULTI-STAKEHOLDER DATA TRANSFER WEBINAR pochodzi z serwisu KIELTYKA GLADKOWSKI LEGAL | CROSS BORDER POLISH LAW FIRM RANKED IN THE LEGAL 500 EMEA SINCE 2019.