Polygraph Examination and GDPR — What Happens to Your Data?

When deciding to undergo a polygraph examination, you entrust someone with very personal information — not only answers to questions but also recordings of your body’s reactions. It’s natural to wonder: what happens to this data afterwards? We answer directly, because respecting your privacy is just as important as the examination’s accuracy.

Informational material, not a legal advice.

Short Answer

Your examination data is a special category of personal data under GDPR. We process it exclusively on the basis of your explicit, written consent, in the minimum necessary scope, for a limited period, and with enhanced protection. You can exercise your rights at any time.

Why is this a „special category of data”?

Article 9 GDPR provides enhanced protection for data related to health and biometric data. Physiological recordings — heart rate, breathing, skin conductance — require the highest caution because they touch on very intimate aspects. This is not „ordinary” contact information; it requires a special regime.

Consent as the basis for processing

The basis is explicit, voluntary consent given in writing before the examination. This is not a formality — consent defines the examination’s purpose, the scope of data, and your rights, including the right to interrupt the examination at any time. Without valid consent, the examination does not take place. The thread of voluntariness is also crucial in the context of employment, which we discuss in the article polygraph examination of employees.

Minimalization and purpose

In accordance with the principle of data minimization, we collect only what is necessary for the specific purpose of the examination. Questions relate to one, clearly defined issue, not „everything else.” This way, the scope of processed information remains as narrow as possible.

How long do we store data?

We store data only for a limited, predetermined period resulting from the examination’s purpose, and then we delete it. We determine and communicate the retention period before the examination, so there is no uncertainty. Recordings are secured against unauthorized access.

Your rights as the examined person

• Access to your data and information on how it is processed.
• Correction of data that is incorrect.
• Deletion of data and withdrawal of consent for further processing.
• Interrupting the examination at any time — the examination is entirely voluntary.

You remain the controller of your data. A reliable polygraph examiner does not make a secret of this — and the ability to clearly explain the principles of data protection is one of the signs of professionalism, which we discuss in the guide how to choose a good polygraph examiner.

GDPR in examinations for companies

In the context of corporate examinations, the principles are even more demanding. The examination must be voluntary, relate to a specific issue, and respect the rights of the employee — it cannot be a „test of loyalty” for the entire team. How we conduct such examinations in accordance with the law is described on the page polygraph for companies.

How we do it at 369 Agent

We maintain full discretion at every stage — from the pre-examination interview to the delivery of the report. We conduct private polygraph examinations throughout Poland, including with travel to the client, while ensuring the security of data in accordance with GDPR.

Consent and voluntariness — why they are not the same

Consent to data processing and the voluntariness of the examination are two related but distinct issues. Consent must be informed (you know what you’re agreeing to) and voluntary (no one is forcing you). In relationships with unequal parties — such as employer-employee — we particularly ensure that consent is real and not forced. It’s also worth remembering that consent can be withdrawn, and the examination can be interrupted at any time, without giving a reason.

Data security during storage

The declaration „we care about data” is not enough. In practice, this means limited access to recordings, securing files and storage devices, and deleting data after the retention period expires. Physiological recordings are sensitive material — we treat them as other special categories of data.

If the result were ever questioned, a reliable documentation and clear principles of data processing would work in your favor — about challenging the results, we write in the article can you challenge the result of a polygraph examination.

Who has access to the results?

Access to the recording and report is limited to the minimum necessary. In a private examination, the result goes only to the person who commissioned it; in a corporate examination — to the designated, authorized recipient, in accordance with the agreed purpose. We do not disclose data to third parties or use it for purposes other than those agreed upon before the examination. If you’re interested in additional security measures — such as encrypted delivery of the report — we’ll discuss this beforehand. Such transparency is not only a GDPR requirement but also an element of trust, without which a reliable examination makes no sense.

Conclusion

Polygraph examination involves data that is particularly protected, so GDPR principles are not a formality but a real safeguard of your rights. Voluntary consent, minimalization, limited retention, and a full set of rights for the examined person — this is the standard you have the right to expect. If something is unclear, ask before the examination; you have the right to do so.

Frequently Asked Questions