“I have a company database with phone numbers, so I can call” – that assumption was already questionable before, and since 10 November 2024 it has simply been wrong in Poland. On that day the Electronic Communications Law of 12 July 2024 (Prawo komunikacji elektronicznej, PKE) came into force, regulating marketing by phone, email and text message in a single provision. Below: what Article 398 says exactly, whom it applies to, what it leaves open and what company data can be used for instead.

Disclaimer: this is an overview of the wording of the law, not legal advice. Where the Act leaves something open, we say so clearly. Quotations are our translations of the Polish text. Please have your campaign reviewed by a lawyer.

What the provision says

Article 398(1) prohibits using automated calling systems and telecommunications terminal equipment – “in particular when using interpersonal communications services” – to send commercial information, including direct marketing, to a subscriber or end user “unless they have given prior consent”. The full text of the Act is available in the Polish Internet System of Legal Acts.

Five things follow from the wording of Articles 398 and 400:

  • One provision for phone and electronic messages. The ban covers the use of automated calling systems and telecommunications terminal equipment, “in particular when using interpersonal communications services” – i.e. a phone call, text message, email or messaging app message.
  • It concerns commercial information. The Act refers to the definition in the Act on Providing Services by Electronic Means: any information intended directly or indirectly to promote the goods, services or image of a business.
  • Consent must be prior – given before the commercial information is sent.
  • Consent can be given by providing an address – paragraph 2 allows this where the subscriber or end user provides an electronic address identifying them for the purpose of receiving commercial information at that address.
  • Data protection rules apply accordingly to obtaining consent (Article 400). In practice this means the requirements familiar from the GDPR: consent that is freely given, specific, informed, revocable and that the sender can demonstrate.

Paragraph 3 adds that commercial information may not be sent at the expense of the subscriber or end user.

Why this also applies to B2B

The Act defines an end user as an “entity using a publicly available electronic communications service (…) to meet its own needs”, and a subscriber as a user who is party to a contract with a service provider. Article 398 does not contain the word “consumer” – the provision does not distinguish between private individuals and businesses. A limited liability company with a contract for a company phone number falls within the definition of a subscriber just like a private person.

Previously, marketing was governed by two provisions: Article 172 of the Telecommunications Law and Article 10 of the Act on Providing Services by Electronic Means. The act introducing the PKE (Journal of Laws 2024 item 1222) repealed Article 10 and the whole 2004 Telecommunications Law; Article 398 took their place. Older guides that cite “Article 10 of the e-services act” describe the law as it stood before 10 November 2024.

What the provision leaves open

Three questions come up in every conversation about B2B. The Act does not answer them directly, and we have not found official guidance from the President of UKE on these specific issues (as of 11 October 2026). So we describe what follows from the text itself.

  • A company’s general address (biuro@, kontakt@). The provision does not distinguish between named and general addresses. The protected party is the subscriber or end user, which includes a company. The Act does not list publishing an address on a website as consent; paragraph 2 speaks of providing an address “for the purpose of receiving commercial information”.
  • Contact to ask for consent. The Act requires prior consent and makes no exception for a first message or call. Under Article 172 of the Telecommunications Law, the President of UOKiK stated that a business wishing to present offers by phone “must already have” the other party’s consent “before the first call” (announcement of 14.11.2017). Whether and how the authorities will carry this approach over to Article 398 and to relations between businesses is not settled.
  • Where commercial information begins. The definition excludes, among other things, information enabling communication with a specific person and information about goods and services that does not serve to achieve a commercial effect. Where an enquiry ends and promotion begins is assessed case by case.

Penalties for breaches

  • Administrative fine. Under Article 446(5), for failing to comply with the obligation to obtain consent referred to in Article 398, the President of the Office of Electronic Communications imposes a fine of up to 3% of the penalised entity’s revenue in the previous calendar year or up to PLN 1,000,000, “whichever is higher”.
  • Petty offence. Article 448 provides that anyone who sends commercial information by means of electronic communication without the prior consent of the subscriber or end user is liable to a fine; prosecution takes place at the request of the injured party.
  • Act of unfair competition. Under Article 398(4), conduct covered by the ban is an act of unfair competition within the meaning of the Act of 16 April 1993; claims are heard by the civil courts.
  • GDPR. If the addressee is a natural person, data protection law also applies; the supervisory authority in Poland is the President of the Personal Data Protection Office (UODO).

What is allowed without consent

Article 398 concerns the method of contact, not the mere possession of data. Company data can be used for many tasks that do not involve sending commercial information by phone or electronically:

  • Postal correspondence. Article 398 mentions automated calling systems and telecommunications terminal equipment; it does not mention a letter, catalogue or invitation sent by traditional post. For natural persons running a business the GDPR applies – including the right to object to direct marketing (Article 21(2) and (3) GDPR).
  • Visits and meetings. Planning sales reps’ routes, taking part in trade fairs, personal contact at the company’s premises.
  • Completing and cleaning your CRM. Adding the NIP, address or industry to companies that are already your customers.
  • Market analysis. How many companies in an industry operate in a county, where to open a branch, how to divide sales regions.
  • Contact that is not commercial information. The ban concerns commercial information only. A reply to someone’s enquiry, matters relating to the performance of a contract or a request for quotation to a potential supplier do not, as a rule, promote the sender’s goods or services. The line can be thin – a message called an “enquiry” that in fact praises your own offer may be regarded as commercial information.

How to collect consent

  1. A form on your own website with a clear, separate consent field for commercial contact through the chosen channel.
  2. A letter with a code or website address where an interested company leaves its contact details itself.
  3. Trade fairs and meetings – consent collected in person, ideally in writing or in an electronic form.
  4. A consent register. Date, wording of the clause, channel and source – without this it is hard to demonstrate consent.

What this means when buying a company database

No purchased database contains your consents. Consent given to a data vendor – even if it exists – relates to whom and for what purpose it was given; it is you who must be able to show that it also covers your messages. Treat offers of a “mailing database with the right to send” with great caution and ask for proof of consent.

That is why we describe our Polish company database as data for postal correspondence, preparing visits, CRM enrichment and market analysis. Phone and email are in the export where the company has published them – as information about the company, not as permission to contact it. More on how to assess a data offer: How to buy a company database; on the legal framework of our data: Data sources and methodology.

Frequently asked questions

Can I call a company in Poland with an offer without consent?

Article 398(1) of the Polish Electronic Communications Law prohibits using telecommunications terminal equipment to send commercial information, including direct marketing, to a subscriber or end user unless they have given prior consent. The provision does not distinguish between consumers and businesses, so you should not call a company with an offer without its prior consent.

Can I send an offer to an address like biuro@firma.pl without consent?

The Act has no separate rule for general addresses: it speaks of a “subscriber or end user”, and an end user is any “entity” using the service – including a company. We know of no official position that would exempt such addresses from the ban, so we assume that an offer sent without prior consent is risky in that case too. The GDPR is a separate matter: a company’s general address is usually not personal data, but that does not affect the application of Article 398.

Can I call or write just to ask for consent?

The provision does not settle this expressly, and the interpretation is not established. It does, however, require “prior” consent, and under the previous rules the President of the Polish Office of Competition and Consumer Protection (UOKiK) challenged obtaining consent only during the first sales call. It is safer to collect consent differently: through a form on your own website, at trade fairs or by letter.

Does a sales letter sent by post require consent?

Article 398 mentions automated calling systems and telecommunications terminal equipment; it does not mention traditional postal items. That does not mean there are no rules: if the addressee is a natural person running a business, the GDPR applies – you need a legal basis, must fulfil the information obligation and must respect objections.

What is the penalty for marketing without consent?

Under Article 446(5) of the Electronic Communications Law, the President of the Office of Electronic Communications (UKE) imposes a fine of up to 3% of the penalised entity’s revenue in the previous calendar year or up to PLN 1,000,000 – whichever is higher. Article 448 also provides for a fine for a petty offence (prosecuted at the request of the injured party), and Article 398(4) treats such conduct as an act of unfair competition.

Legal status: 11 October 2026. Quotations translated from the Polish text of the Electronic Communications Law of 12 July 2024 (Journal of Laws 2024 item 1221 as amended) and the Act of 18 July 2002 on Providing Services by Electronic Means, as published in the Internet System of Legal Acts.