Travel & Hospitality Compliance in Poland

Poland is open to online travel businesses, and identity rules for the sector come from border, passenger-data and consumer law rather than financial crime law. The principal authorities are the Ministry of Sport and Tourism, the voivodeship marshals who keep the tour operator register, the Border Guard and the President of the Personal Data Protection Office (UODO).

The biggest obstacle for a new entrant is not identity verification but licensing and data discipline: tour operators must register and fund insolvency protection before selling, and accommodation providers that collect more guest data than they need run straight into data minimisation rules.

1. Who regulates this sector

The Office of Competition and Consumer Protection (UOKiK) enforces general consumer law against online travel sellers, and the Civil Aviation Authority supervises air carriers.

2. Licensing and authorisation

Tour operators and linked travel arrangements

Organising package travel or facilitating linked travel arrangements is regulated business activity that requires entry in the register of tour operators and traders facilitating linked travel arrangements, kept by the marshal of the voivodeship where the business has its seat (Act of 24 November 2017 on Package Travel and Linked Travel Arrangements, Art. 22 and 23). A trader with no seat or branch in Poland chooses the marshal. The same Act applies its insolvency rules to traders established outside the EU that sell to, or direct their activity at, Polish customers (Art. 8(1)).

Registered traders must hold insolvency protection (a bank or insurance guarantee or a trust account), pay contributions to the Tourist Guarantee Fund, and keep a list of contracts in, or report it monthly to, the UFG system (Art. 7 and 9). From 1 July 2026 the list records the contract subject, prices, destinations, charter flights, ICAO airport codes and whether prepayments are taken; it records the number of travellers, not their identities.

Accommodation

A hotel, motel, guesthouse, campsite or hostel must be assigned a type and category by the voivodeship marshal before it starts providing services, and other accommodation (including rooms let by farmers) must be notified to the municipal register (Act of 29 August 1997 on Hotel Services and the Services of Tour Leaders and Tourist Guides, Art. 35 to 39). There is no national licence for accommodation booking websites.

Currency exchange

Currency exchange (działalność kantorowa) is regulated activity that requires entry in the register of currency exchange activity kept by the President of the National Bank of Poland, with clean criminal records for owners, managers and beneficial owners (Act of 27 July 2002, Foreign Exchange Law, Art. 11, 12 and 15). Banks are outside these rules.

3. Identity framework (AML rules do not apply)

Accommodation providers, tour operators, travel agents and online travel platforms are not obliged institutions under Art. 2(1) of the Act of 1 March 2018 on Counteracting Money Laundering and Terrorist Financing. Two travel-adjacent activities are covered: currency exchange businesses (Art. 2(1)(11)) and traders that accept or make cash payments for goods of EUR 10,000 or more, in one or linked operations (Art. 2(1)(23)). Because point 23 refers to goods, selling accommodation or trips does not bring a travel business into scope. A travel business that runs a currency exchange counter is an obliged institution for that activity and must apply customer due diligence, report to the General Inspector of Financial Information (GIIF) and keep records.

For everyone else, identity in travel is governed by three separate frameworks:

Border and carrier law

Air, sea and scheduled international coach carriers must ensure foreigners hold a valid travel document and any required visa before carrying them to the border (Act on Foreigners, Art. 459).

Passenger data

Airlines send passenger name record (PNR) data to the Border Guard's Passenger Information Unit for flights to or from Poland (PNR Act, Art. 5 and 6).

Residence registration

Guests register their own stay with the municipality; the duty sits with the person, not with the host (Population Records Act, Art. 27 and 41).

Sanctions screening is a general obligation: EU restrictive measures apply directly to every business, and the Minister of the Interior and Administration keeps a national list under the Act of 13 April 2022.

4. Identity verification and onboarding

Accepted documents

A Polish identity card proves identity and citizenship and is valid for crossing borders within the EU and EEA (Act of 6 August 2010 on Identity Cards, Art. 4). Its electronic layer holds the holder's data, facial image and fingerprints (Art. 12a). The mObywatel document in the government app has the same effect wherever a law requires identity to be established from an identity document, but it is not valid for crossing a border (Act of 26 May 2023 on the mObywatel Application, Art. 7(4) and (5)). A person shown or sent a mobile document can confirm it by checking its data, the ministry's electronic seal or the user's signature (Art. 9). Foreigners identify themselves with a passport or, for EU, EEA and Swiss citizens, a national identity card.

When identity must be checked

No Polish statute requires a hotel, rental host or travel agent to verify a guest's identity. Hotels may still choose to check identity for security or payment reasons, but that choice must rest on a GDPR legal basis and collect only the data needed. Retaining another person's Polish identity card without a legal basis is a petty offence punishable by restriction of liberty or a fine (Identity Cards Act, Art. 79(2)), which rules out holding ID cards as a deposit.

Residence registration

Polish citizens register a stay away from home only after three months (Population Records Act, Art. 25(4) and 27). EU, EEA and Swiss citizens register within 30 days; other foreigners register by the fourth day after arrival, but all foreigners are exempt if their stay does not exceed 30 days (Art. 41 and 42(2)). Registration can be done electronically with a qualified, trusted or personal signature (Art. 28).

5. Digital channels: what's different

Bottom line: the rules are channel-neutral for guests and travellers, but online accommodation listings are the one area where a digital-only obligation is arriving: platforms will need to show and check an accommodation registration number.

Online sale of package travel

The Package Travel Act defines a point of sale to include websites and similar online sales facilities (Art. 4), so a booking site or app that combines services into a package is a tour operator with the same registration, insolvency protection and contract-list duties as a high-street agency. Non-EU sellers directing offers at Poland are caught by Art. 8(1).

Short-term rental platforms

Regulation (EU) 2024/1028 on short-term rental data has applied since 20 May 2026. Where a member state runs a registration procedure, platforms must collect and display each unit's registration number, check it, and send activity data to authorities. Poland's implementing law [Passed by the Sejm, before the Senate] creates the Central Register of Tourist Accommodation (CWTON), gives every unit an identification number that must appear in listings, and makes short-term rental of up to 30 days a hotel service. Until it is enacted, Poland has no registration number for platforms to check.

Contactless check-in

No Polish rule specifies how online check-in must work, so the design is set by GDPR: data minimisation, a clear legal basis and explicit consent for any facial matching.

6. Data protection and biometrics

The GDPR applies directly, supplemented by the Act of 10 May 2018 on the Protection of Personal Data, which makes the President of UODO the supervisory authority. For travel businesses the practical points are specific:

• No legal duty to collect ID data. Because no Polish statute requires hotels or agents to record identity documents, copying or scanning them must be justified as necessary for a stated purpose under GDPR Art. 6 and 5(1)(c); "just in case" copies are hard to defend.
• Biometric check-in. Facial matching to identify a guest processes biometric data, which GDPR Art. 9 prohibits unless an exception applies. In a commercial check-in the realistic exception is explicit consent, which requires a genuine non-biometric alternative.
• Passenger data. Airlines must tell passengers at booking or ticketing that PNR data is sent to the Border Guard and explain their rights (PNR Act, Art. 9).
• Retention. The Border Guard keeps PNR data for 5 years for non-EU flights and 3 years for intra-EU flights, and masks directly identifying data after 6 months (PNR Act, Art. 32 and 33). Businesses set their own retention for guest data, which must be limited to the purpose.

7. Sector-specific obligations

Passenger name records

An air carrier operating a flight that crosses the border and takes off or lands in Poland sends the PNR data it collects to the Passenger Information Unit, a Border Guard unit, 48 to 24 hours before departure and again once boarding closes (PNR Act, Art. 5 and 6). Since the amendment in force on 10 September 2025, data on intra-EU flights may be processed only during a declared terrorism alert or for flights designated by the interior minister or approved for a specific case (Art. 4a).

Border checks and the Entry/Exit System

The EU Entry/Exit System (EES), which records biometric entry and exit data of non-EU short-stay travellers at the external border, started operations on 12 October 2025 (Commission Implementing Decision (EU) 2025/1544) with a 180-day progressive roll-out under Regulation (EU) 2025/1534. Carriers bringing foreigners by air, sea or scheduled international coach must check travel documents and visas (Act on Foreigners, Art. 459) and must return travellers refused entry (Art. 460).

Insolvency protection and traveller funds

Tour operators must finance the Tourist Guarantee Fund and keep their insolvency protection current, filing it with the marshal at least 14 days before the previous guarantee expires (Package Travel Act, Art. 7). Since 1 January 2026 protection may be split across several guarantees, with one guarantor named to handle traveller claims (Art. 7(2a)).

8. Risk indicators and red flags

Identity and fraud indicators in travel

• Document mismatch: travel document data that does not match the booking name or visa, the core carrier risk under the Act on Foreigners.
• Unregistered package seller: a site selling packages to Polish customers that does not appear in the tour operator register.
• Missing registration number: short-term rental listings without a unit number once the national register applies.
• Cash-heavy currency exchange: large or repeated cash exchanges, which bring AML duties at the exchange counter.
• Forged mobile ID: an mObywatel screen shown without verification of its data or electronic seal.
• Over-collection: front desks photographing or keeping ID cards, which creates data breach and petty offence exposure.

9. Enforcement and penalties

Tour operators can also be struck off the register and barred for 3 years for gross failures to pay Tourist Guarantee Fund contributions or keep the contract list, on the UFG's request (Package Travel Act, Art. 30(7) and 31). Data protection breaches fall under the GDPR's turnover-based fines.

10. Recent changes and what to watch

• October 2026: short-term rental law [Passed by the Sejm, before the Senate]. Hosts will need a CWTON entry and a unit number shown on listings; most provisions are set to apply 14 days after publication, and municipal and building-level bans from 1 January 2028.
• 11 August 2026: package travel vouchers [In force]. Operators may offer a one-year voucher instead of a refund when unavoidable circumstances cancel a trip, with the traveller's consent (Dz.U. 2026 poz. 1006).
• 1 July 2026: expanded contract list [In force]. New data fields, monthly reporting to the UFG and strike-off for persistent failures (Dz.U. 2025 poz. 1806).
• 20 May 2026: EU short-term rental data regulation [Applies, national register pending]. Platform duties bite in Poland once the national registration procedure exists.
• 12 October 2025: Entry/Exit System [In force]. Biometric registration of non-EU travellers at Poland's external borders.
• 10 September 2025: PNR amendment [In force]. Intra-EU flight data processed only on threat-based designation; shorter retention.
• ETIAS: travel authorisation for visa-exempt travellers [Adopted, start date not yet set]. No Commission decision fixing its start date has been published (as of October 2026).

11. What this means for identity verification

For accommodation and travel sellers, identity verification is a business choice, not a statutory duty, so every check must be justified by purpose: fraud prevention, payment security or a safety policy. Read and record only the fields needed, avoid keeping document images by default, and never hold a Polish ID card. Accept the mObywatel document as equivalent to the card, and verify it through its data or electronic seal rather than by looking at the screen.

Facial matching at check-in requires explicit consent and a non-biometric alternative. Platforms listing short-term rentals should prepare to capture and validate Polish unit registration numbers once the CWTON law is enacted. Carriers remain the one group with hard document-checking duties, backed by per-passenger fines. A travel business that runs currency exchange must treat that counter as a full AML-obliged activity.