Virtual office and GDPR — data protection in practice (2026)

Who is responsible for the data — you or the operator

Worth saying plainly, because it misleads people: outsourcing the back office lets a company concentrate on its operations, but it does not release it from responsibility for processing personal data. Outsourcing moves the work, not the responsibility for it.

Your company is the data controller. You decide why the data is collected and what happens to it. The virtual office operator acts on that data on your behalf and, in that role, is a processor. The split sounds formal, but the consequence is practical: if the operator fails, the controller's liability still sits with your company.

The GDPR only permits you to entrust data to a party offering sufficient guarantees of appropriate safeguards. Vetting the operator is therefore not caution or good practice — it is the controller's obligation, which means yours. It is the obligation people forget most often, because it looks like a courtesy towards a supplier.

The legal basis the operator actually relies on

The question sounds academic and settles something entirely practical: what you can demand and what you cannot. Processing rests on a legal basis rather than on goodwill, and in a virtual office two different bases run at the same time.

Neither of them is consent — and that is the most common misunderstanding here. The consequence is concrete: consent can be withdrawn at any moment, these two bases cannot. If an operator asks you to consent to processing that is necessary to perform the contract, it either misunderstands its own duties or is using consent as an umbrella for something else, such as marketing. Ask what exactly the consent covers.

Consent has one legitimate place in this relationship: purposes beyond the service and beyond the statute. A newsletter, sales material, passing data to a partner. You may refuse that consent and the service has to carry on.

Why the operator holds your data at all

Providing a registered address is an activity covered by anti-money-laundering law. The operator is an obliged institution and, before releasing the address, has a statutory duty to establish the identity of the client and of the beneficial owner. The ID document it asks for when you sign is not officiousness.

That particular data is not processed on your instruction — it is processed because a statute requires it. Different legal basis, different rules: you cannot withdraw it, and the operator cannot delete the records early even if you both wanted to. It keeps them for five years after the relationship ends. The same duty determines which documents it will ask for when you register a company at the address.

An operator that does not ask for an ID document is not protecting your privacy — it is breaking the law. That one is the risk, not the operator that asks.

What a service contract cannot replace

The address contract governs the service: what the operator does, for how much and for how long. Entrusting personal data takes a separate document, required by Article 28 GDPR, and it has to settle four things. The Nest virtual office contract terms are set out on the offer page.

Do you need a record of processing activities?

Most likely yes — and it surprises most sole traders, because Article 30 GDPR opens with an exception that reads like an exemption.

The exception says an organisation employing fewer than 250 people need not keep the record. It then takes that back with three conditions: the duty returns if the processing may result in a risk to the rights and freedoms of individuals, if it is not occasional, or if it covers special categories of data. The second condition swallows the exemption in practice — serving clients, issuing invoices and handling mail are continuous processing, not occasional.

What that means for a virtual office: using one does not create a new duty, it adds an entry to a record you should already keep. You log the mail handling entrusted to a processor — categories of data, purpose, retention period and recipient. GDPR documentation in a small company is usually two things: that record, and the processing agreements with suppliers who handle data on your behalf. The operator keeps its own record of categories of activities — that is its duty, not yours, and it does not replace yours.

Your privacy notice — who has to be told what

Article 13 GDPR requires you to tell the people whose data you collect what happens to it. A privacy notice is not a formality reserved for large companies: it applies to anyone with clients, suppliers or a contact form.

A virtual office enters at one specific point — the categories of recipients. If you entrust your mail to an operator, it is a recipient of the data contained in letters addressed to your company, and your privacy policy should say so. You do not have to name it; a category is enough, for example “providers of mail handling and registered address services”.

Your clients' privacy protection ends exactly where the precision of that wording ends. If your privacy policy mentions no processors at all while you use a virtual office, an accountant and a mail host, it does not match reality.

What the operator may do with your mail

Protection of correspondence neither begins nor ends with the GDPR. Confidentiality of communication is guaranteed by Article 49 of the Polish Constitution, and reading someone else's letter without authorisation is an offence under Article 267 of the Criminal Code — regardless of what the parties wrote into their contract.

Scanning is lawful because it happens on your instruction and on your behalf. Reading for any other purpose does not become lawful through any contractual clause.

Security around the mail is settled not at the level of declarations but at the level of how many people can reach it. Article 32 GDPR speaks of measures appropriate to the risk — for a paper letter from a public authority the appropriate measure is a narrow circle of people and control over handover, not technology. Data security starts here with a closed door, not with software.

The 72-hour clock is yours, not the operator's

This is the point you will not find in price lists or in most guides, and it decides whether you make it on a bad day. Handing a letter to the wrong person or losing one is a personal data breach — not an organisational hiccup, but an event with its own procedure.

The procedure is asymmetric, and that is the important part:

The conclusion is uncomfortable and simple: the operator decides when your clock starts. Until it calls, you have nothing to report — and when it calls a week later, explaining yourself to the authority and to the people whose data leaked falls to you. The text of Article 33 does not fix this. The contract does.

So the processing agreement should carry a deadline measured in hours rather than the phrase “without undue delay”. This is not an unreasonable demand or a favour from the operator: Article 28(3)(f) GDPR obliges the processor to assist the controller in meeting the duties under Articles 32 to 36, which includes Article 33. A deadline in the contract is simply that duty written concretely instead of vaguely.

Two things are worth knowing in advance so you do not lose time in the moment. A notification to the Polish authority is filed electronically only, through biznes.gov.pl, signed with a qualified signature or a Trusted Profile — if you have neither, arrange it before you need it. And if you cannot gather all the information within 72 hours, you file a preliminary notification and complete it later; missing the deadline is worse than an incomplete report.

What to ask before you entrust the data

An evasive answer to any of the seven questions below tells you more about an operator than all of its assurances about security put together. They concern the processing of personal data only — you ask about the service itself separately.

How this works at The Nest

We sign the processing agreement as standard, together with the address contract, rather than on request. Access to a letter from the moment it enters the building until it is handed to the client rests with reception alone — not an organisational detail but a security measure, because official and court correspondence contains data no one but the addressee should see.

Around two thousand items of mail a year pass through the address at Piękna 49, and most of them are registered letters. Reception takes in mail the same business day, and where a registered letter has been left for collection we pick it up at the post office on the client's behalf. The shorter the journey and the fewer hands on it, the fewer places where data protection could fail.

Data collected under anti-money-laundering law we keep for the five years the statute requires, and we say so before the contract is signed, not after. How the site itself processes data is set out in the privacy policy.