About the IAPP

Marcin Lewoszewski is a legal advisor and a partner of Kobylańska Lewoszewski Mednis law firm in Warsaw, specializing in data protection. Before joining the firm, he worked for over seven years as part of the TMT team with one of the leading international law firms based in Warsaw. Earlier, for two years, he worked for the Polish Data Protection Authority (GIODO). He is recognised by Chambers and Partners as one of the leading data privacy lawyers in Poland (Band 3).

Currently, he represents before the court a party to the proceedings ended with the imposition of the first financial penalty in Poland by the Polish Data Protection Authority on a controller whose activity is based on the processing of data from publicly available registers (Bisnode vs the DPA case).

In 2016 and 2020 he was selected by the International Association of Privacy Professionals as the IAPP KnowledgeNET Poland co-chair.

He is the author of several dozen articles about personal data protection - he published, among others, in the Polish edition of Harvard Business Review, in Rzeczpospolita, Dziennik Gazeta Prawna, and abroad - in BNA Bloomberg, IAPP PrivacyTracker or DataGuidance. He is the co-author of the chapter in the book on Polish regulations on the protection of personal data "The Law Reviews: The Privacy, Data Protection and Cybersecurity". He was quoted many times by the professional press in Poland and abroad, including the opinion-forming Politico. Regardless of his work in the office, he is the editor-in-chief of the quarterly Information in Public Administration, published by C.H. Beck.

For years, Marcin has been advising clients whose personal data is their most valuable asset. Recently, he has been helping the Polish computer game producer operating globally in adapting business processes to the requirements of the General Data Protection Regulation. To a similar extent, he supported one of the largest CRO entities in Poland. He also advised a large capital group operating on the financial market in connection with breaches of personal data protection. He assisted one of the largest corporations in the world in the process of accepting binding corporate rules (BCR) in proceedings before the Polish data protection authority.