2026 02 10 14 29 11

Consultation on Phishing Campaigns

Introduction to the Consultation

• The speaker introduces themselves as a lawyer, aiming to assist with information regarding conducting tests safely. They request a description of the project and its target audience.

Project Overview

• The lawyer emphasizes that they do not need the company's name but are interested in understanding the business area and scope of testing.

• The discussion begins about a phishing campaign proposal for a transport company, specifying a minimum of 15 participants for the test.

Technical Aspects of Phishing Tests

• The speaker clarifies that they want email addresses from 15 individuals to send phishing emails and track engagement metrics like clicks.

• Questions arise about whether the phishing attack will allow recipients to respond or if it will simply direct them to a blank page.

Security Considerations

• The lawyer explains that there is no guarantee against responses from participants, which raises concerns about potential information leaks.

• Emphasis is placed on data protection laws and ensuring proper agreements are in place with the logistics company before proceeding with tests.

Legal Agreements and Documentation

• It’s suggested that having an agreement outlining work scope, deadlines, payment details, and expected outcomes is crucial for legal protection.

• A one-page contract could suffice initially; however, as business scales, more detailed contracts may be necessary for professional credibility.

Confidentiality Measures

• Discussion includes establishing confidentiality agreements (NDAs), especially if sensitive information might be shared during interactions related to the phishing campaign.

• Recommendations include using readily available NDA templates or generating them through AI tools to ensure compliance without excessive complexity.

Key Considerations for Pilot Agreements

Importance of Mutual Obligations in Contracts

• A basic pilot agreement should ideally be mutual, ensuring both parties have obligations, not just one side.

• Emphasizing the need for a balanced contract can lead to better outcomes when engaging with language models (LLMs).

Financial Implications and Penalties

• The penalty clause in the agreement should reflect the scale of information that can be gained; it must be reasonable compared to the compensation received.

• For example, if a test project pays 3,000 PLN, having a penalty exceeding 20,000 PLN may not be justified given the limited data access.

Data Protection Regulations Overview

• The discussion shifts to data protection laws (RODO), highlighting that companies are responsible for compliance when handling personal data.

Roles in Data Processing

Administrator vs. Processor

• There are two key roles: the data administrator (who collects and processes personal data) and the processor (who handles data on behalf of the administrator).

• An example is provided where a lawyer acts as an administrator while delegating tasks to another professional who becomes a processor.

Responsibilities and Agreements

• A formal agreement is necessary between administrators and processors detailing responsibilities regarding data security and processing protocols.

Compliance with RODO

Documentation Requirements

• Administrators must maintain documentation proving compliance with RODO regulations, including templates for processing agreements.

Security Measures

• Processors are required to implement security measures equivalent to those used by administrators; they must also report any potential data breaches within specified timeframes.

RODO Compliance and Responsibilities

Administrator's Decision-Making Timeline

• Administrators have a maximum of 72 hours to decide whether to inform the data protection authority about personal data breaches.

• If individuals whose data is processed request removal from the process, the administrator must be informed to take appropriate action.

Security Audits and Data Processing

• Administrators have the right to conduct security audits on their processors, assessing how data is secured.

• Processors may be asked for documentation proving compliance with RODO (General Data Protection Regulation) standards, including security measures in place.

Data Minimization Obligations

• It is crucial for processors not to over-process personal data; unnecessary retention should be avoided. Emails and other communications should be deleted after a set period (e.g., 30 days).

• In case of a data breach or claims against the processor, they must know how to respond appropriately according to RODO guidelines.

Contractual Agreements and Responsibilities

• A processing agreement must exist between the processor and administrator detailing responsibilities and obligations under RODO. This includes ensuring confidentiality through NDAs or similar agreements.

• The agreement should also outline compensation terms for services rendered by the processor. Additionally, it may include clauses regarding advance notice for audits or changes in procedures.

Marketing Considerations

• For businesses starting out, obtaining consent for marketing communications (like newsletters) is essential when engaging clients via email or other means. Consent can be integrated into contracts or through checkboxes on websites/forms.

• When communicating with clients, it's advisable to confirm their willingness to receive periodic updates about services offered, ensuring compliance with consent requirements under RODO regulations.

Understanding Personal Data and Privacy Policies

The Scope of Personal Data

• Personal data encompasses not only individuals like Jan Kowalski but also entrepreneurs and their employees, highlighting the broad definition of personal data in legal contexts.

Importance of Privacy Policies

• It is essential for clients to receive a privacy policy during initial communications, even at the offer stage, as it serves as a minimum requirement for transparency.

Accessibility of Privacy Information

• The privacy policy should be easily accessible to clients, potentially linked in emails or footers, ensuring that all parties are informed about how their data will be processed.

Legal Processing of Data

• With proper notification through a privacy policy, clients can legally process and retain various documents such as invoices and accounting records for a specified duration.

Digitalization of Agreements

• Implementing an online system where clients select service packages (basic, premium, gold), agree to terms including the privacy policy before payment enhances operational efficiency while ensuring compliance with regulations.

Regulatory Compliance Across Europe

Uniformity in Regulations

• The same documentation can facilitate business operations across the European Union due to uniform regulations regarding data processing.

Preparing for Market Expansion

• Translating necessary documents into different languages allows businesses to scale into new markets within the EU without significant legal hurdles.

Handling Emergencies in Business Operations

Legal Obligations During Failures

• In case of technical failures affecting campaigns, there is an obligation to fulfill commitments diligently; failure may lead to liability depending on circumstances.

Responsibility Limits

• Liability is limited based on damages caused; if services fail due to unforeseen events or negligence, compensation may be required only for direct losses incurred by the client.

Professionalism in Service Delivery

• Maintaining professionalism is crucial; if obligations are unmet due to negligence or misinformation provided by service providers, they may be held accountable for associated costs.

Discussion on Business Strategies and Taxation

Insights on Attack Scenarios in Business Context

• The speaker discusses the potential for repeated attacks in a business context, emphasizing that expectations may not always align with reality, particularly regarding timing.

• A distinction is made between pilot tests and full campaigns, highlighting that the latter involves more participants and complexity, despite scale being less significant than service scope.

• The importance of user interaction is stressed; moving beyond simple email communication to gather sensitive information can increase risks for businesses.

Legal Considerations and Documentation

• When dealing with sensitive data (e.g., financial information), stronger legal agreements are necessary to protect against liability and ensure clarity in responsibilities.

• Clear documentation outlining attack steps and timelines is crucial to avoid misunderstandings about actions taken during campaigns.

Business Registration Dilemmas

• The conversation shifts to the implications of operating under registered versus unregistered business activities, noting perceptions from clients based on registration status.

• The speaker questions whether it’s beneficial for a young entrepreneur (18 years old) to operate without formal registration or pursue employment contracts instead.

Tax Implications for Young Entrepreneurs

• There’s an acknowledgment of young entrepreneurs' awareness of tax reduction strategies; suggestions include working under short-term contracts exempt from income tax until age 26.

• Emphasis is placed on the simplicity of contract work as a viable option compared to registering a business, which comes with additional obligations.

Funding Opportunities for Registered Businesses

• Discussion includes potential funding opportunities available upon registering a business, such as grants or loans that could support startup costs significantly.

• It’s noted that once registered, obtaining funding becomes more challenging due to regulatory requirements; thus, careful consideration before registration is advised.

This structured summary captures key discussions around business strategies, legal considerations, taxation implications for young entrepreneurs, and funding opportunities while providing clear timestamps for reference.

Obligations and Opportunities in Client Transactions

Client Invoice Requirements

• The speaker emphasizes the obligation to issue an invoice when requested by a client, highlighting the importance of compliance with this requirement.

Personal Context and Weather Discussion

• The speaker apologizes for not using a camera due to technical issues and shares personal health concerns, indicating they are currently unwell.

• A brief discussion about regional weather conditions is included, noting temperatures ranging from -3 to +3 degrees Celsius in Kraków.

Tax Identification Number (NIP)

• There is a clarification regarding the necessity of obtaining a tax identification number (NIP), suggesting that it may not be immediately required depending on business activities.

Freelancing as a Viable Option

• The speaker suggests that for younger individuals, freelancing or contracting could be beneficial in the short term until their business grows.

• They recommend exploring potential funding options available through employment offices when considering starting a business.

Business Establishment Process

• It typically takes about one month to six weeks to secure funding for starting a business after registering for unemployment benefits and completing necessary training.

• After establishing a business, there are financial incentives such as lower taxes available for up to two and a half years, particularly advantageous for those under 26 who are still studying.