Poland's Personal Data Protection Office (UODO) has imposed a substantial fine of 16,932,657 PLN on McDonald's Poland, along with an additional 183,858 PLN on its data processor, 24/7 Communication Sp. z o.o., for serious GDPR violations. The breach resulted in the unauthorized public disclosure of sensitive employee data, including names, PESEL numbers, and work schedules, via an online directory. Key shortcomings identified include: absence of risk assessments, inadequate vendor due diligence, non-enforcement of data processing agreements, unauthorized sub-processing, exclusion of the Data Protection Officer from key decisions, and failure to adhere to data minimization principles. The UODO also issued a reprimand for incomplete notifications to affected individuals.