Aleksander Elmerych

A government proposal to amend the National Cybersecurity System Act (CSA) has been published after many weeks of public statements. The proposal is somewhat similar to the proposal for an amendment to the act of last year, which was discussed in our previous international newsletter. However, it contains a range of new solutions not announced to the public before.  Although a very short timeframe has been set, many comments have been submitted regarding the proposed bill, from business organizations and elsewhere. Government officials have said that the proposal has been submitted to the Government National Security and Defence Committee (KRMBNSO).

Even last year, plans were announced to amend the Act of 5 July 2018 on the National Cybersecurity System (CSA), and the first draft of the bill was submitted for public consultations on 7 September 2020. Since then, the envisaged amendment has been revised repeatedly in the course of legislative work, and the final version of the bill – of 4 March 2021 – is now being reviewed by the Council of Ministers. Although it does not affect the crucial issues regulated in the act, there is a lot of interest in the amendment to the CSA on the part of business, and not only firms on the IT market. The proposed changes are briefly summarized below, while it is still not certain that the proposed changes will be enacted due to the lengthy period of work on the bill.

Withholding tax is tax levied at a fixed rate on certain types of revenue generated in Poland by foreign firms, i.e. firms that do not have their registered seat or management board in Poland. This tax is paid by the Polish firms when they pay the fee. The question is whether the fee paid by Polish firms that use cloud computing services of foreign providers is subject to withholding tax.

The implementation of the NIS Directive in the Member States led to additional obligations for certain digital service providers, including in areas such as ensuring cybersecurity or incident reporting. After four years, the existing regulations were found to be insufficient, and a proposal for NIS Directive 2 was published, expanding the group of entities concerned and placing new obligations upon them.