APD/GBA (Belgium) - DOS-2026-00228
Belgium's DPA warns a company for accidental data disclosure and failure to respond to data subject requests.
Run APD/GBA?
Get an email when a reviewed story names APD/GBA, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Belgium's Data Protection Authority (APD/GBA) issued a warning to a company for accidentally disclosing a data subject's personal information, including name, address, and license plate number, to a third party via email. The company also failed to respond to the data subject's requests regarding the disclosure and the origin of their work email address. The DPA cited violations of GDPR Articles 5(1)(f), 24, 32, and 12(3).
The lesson from this incident
Full lessonA company in Belgium accidentally sent a data subject's personal information — including name, home address, and license plate number — to an unintended third party via email, violating GDPR's core data security and integrity principles. Compounding the breach, the company failed to respond in a timely manner to the data subject's requests for information, breaching GDPR Article 12(3)'s response obligations. This case highlights how human error in email handling, combined with poor internal processes for managing data subject requests, can result in regulatory action. It matters because even seemingly minor disclosure incidents carry significant legal and reputational consequences when organisations lack proper controls and accountability mechanisms.
What helps against this
How we list vendors- Identity governance and single sign-on
People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.
- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.
- Encryption and key management
Stolen data stays unreadable, and the keys stay under your control.