[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f7WAZ2PmDIMa4HMrAryEEDaCp_2bgKkfqJrUVa5iyp1Y":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":129},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"8b916618-fa7e-43f7-b03f-84c55892e09b","APD\u002FGBA (Belgium) - DOS-2026-00228","apd-gba-belgium-dos-2026-00228-6f6fbe","Created page with \"{{DPAdecisionBOX |Jurisdiction=Belgium |DPA-BG-Color= |DPAlogo=LogoBE.png |DPA_Abbrevation=APD\u002FGBA |DPA_With_Country=APD\u002FGBA (Belgium) |Case_Number_Name=DOS-2026-00228 |ECLI= |Original_Source_Name_1=Gegevensbeschermingsautoriteit |Original_Source_Link_1=https:\u002F\u002Fwww.gegevensbeschermingsautoriteit.be\u002Fpublications\u002Fwaarschuwing-nr.-267-2026.pdf |Original_Source_Language_1=French |Original_Source_Language__Code_1=FR |Original_Source_Name_2= |Original_Source_Link_2= |Ori...\" New page {{DPAdecisionBOX |Jurisdiction=Belgium |DPA-BG-Color= |DPAlogo=LogoBE.png |DPA_Abbrevation=APD\u002FGBA |DPA_With_Country=APD\u002FGBA (Belgium) |Case_Number_Name=DOS-2026-00228 |ECLI= |Original_Source_Name_1=Gegevensbeschermingsautoriteit |Original_Source_Link_1=https:\u002F\u002Fwww.gegevensbeschermingsautoriteit.be\u002Fpublications\u002Fwaarschuwing-nr.-267-2026.pdf |Original_Source_Language_1=French |Original_Source_Language__Code_1=FR |Original_Source_Name_2= |Original_Source_Link_2= |Original_Source_Language_2= |Original_Source_Language__Code_2= |Type=Complaint |Outcome= |Date_Started= |Date_Decided=06.10.2026 |Date_Published= |Year=2026 |Fine= |Currency= |GDPR_Article_1=Article 5(1)(f) GDPR |GDPR_Article_Link_1=Article 5 GDPR#1f |GDPR_Article_2=Article 5(2) GDPR |GDPR_Article_Link_2=Article 5 GDPR#2 |GDPR_Article_3=Article 12(3) GDPR |GDPR_Article_Link_3=Article 12 GDPR#3 |GDPR_Article_4=Article 24 GDPR |GDPR_Article_Link_4=Article 24 GDPR |GDPR_Article_5=Article 32 GDPR |GDPR_Article_Link_5=Article 32 GDPR |GDPR_Article_6= |GDPR_Article_Link_6= |GDPR_Article_7= |GDPR_Article_Link_7= |EU_Law_Name_1= |EU_Law_Link_1= |EU_Law_Name_2= |EU_Law_Link_2= |National_Law_Name_1= |National_Law_Link_1= |National_Law_Name_2= |National_Law_Link_2= |Party_Name_1= |Party_Link_1= |Party_Name_2= |Party_Link_2= |Appeal_To_Body= |Appeal_To_Case_Number_Name= |Appeal_To_Status= |Appeal_To_Link= |Initial_Contributor=lh | }} The DPA warned a company in a prima facie decision that accidentally sending emails relating to debt collection cases concerning a data subject to a third party in the cc field, and the failure to respond to the data subject’s request to exercise their rights, likely infringes [[Article 12 GDPR|Article 12(3) GDPR]] and [[Article 32 GDPR|Article 32 GDPR]]. == English Summary == === Facts === A company (controller) sent a data subject an email with a formal notice attached to it. The email was sent to the data subject’s work email address, with a third-party email address listed as recipient in the cc field. The data subject asked the controller for the identity of the third party. The controller answered that the request would be addressed as soon as possible. On another occasion, the controller sent the data subject an email with a payment notice via the data subject’s work email address. Again, the third-party email address was listed as recipient. The data subject asked again for the disclosure of the third party’s identity, and, for an explanation as to where the controller has obtained the data subject’s work email address from. The controller did not respond. The controller sent another two emails with a reminder concerning non-compliance with a payment plan and a pre-seizure statement of account to the data subject and, again, to the third-party email address. The controller started an internal investigation into the matter and deleted the third-party email address. In the course of the communication, amongst other data, the data subject’s name, home address and car licence plate number were revealed to the third party. The data subject lodged a complaint with the DPA on the grounds of improper use of their work email address and the disclosure of their personal data to the third-party recipient. Moreover, they requested information regarding the third party involved in their communication, the erasure of their work email address and that none of their personal data be transmitted to the third party. The controller demonstrated that the data subject has initiated contact with them via their work email address. The disclosure of the data subject’s data to the third party resulted from an erroneous manual data entry that led to the data subject being associated with the third-party email address in the controller’s debtor record. The controller’s failure to respond to the data subject’s request resulted from heavy workload of their employees. === Holding === The decision by the DPA constitutes a prima facie decision as part of the preliminary proceedings prior to the decision on the merits, and not a decision on the merits itself. As far as the disclosure of the data subject’s data to the third person was concerned, the DPA reminded the controller of their obligation to comply with the principles of data integrity and confidentiality pursuant to [[Article 5 GDPR|Article 5(1)(f) GDPR]]. Moreover, the controller must implement appropriate technical and organisational measures to ensure data integrity and confidentiality ([[Article 24 GDPR|Article 24 GDPR]], [[Article 32 GDPR|Article 32(1) GDPR]]), and to demonstrate accountability ([[Article 5 GDPR|Article 5(2) GDPR]]). The fact that the third-party email address was linked to the data subject’s communication, and was only removed from the record after the investigation of the controller was launched, which occurred after the data subject notified the controller on several occasions, was not in line with the provisions of the GDPR mentioned above. When it comes to the controller’s compliance with the data subject’s requests to exercise their rights, the DPA found that the controller’s failure to respond did not appear to be consistent with [[Article 12 GDPR|Article 12(3) GDPR]]. Under this article, the controller must inform the data subject of measures taken in response to requests pursuant to [[Article 15 GDPR|Article 15 GDPR]] – [[Article 22 GDPR|Article 22 GDPR]]. As far as the use of the data subject’s work email address is concerned, the data subject initiated contact with the controller via that address, and the controller eventually erased the email address from its system. Therefore, the basis of the complaint has been resolved in that regard, according to the DPA. The DPA issued a warning pursuant to [[Article 58 GDPR|Article 58(2) GDPR]] that the controller is likely to violate [[Article 12 GDPR|Article 12(3) GDPR]] and [[Article 32 GDPR|Article 32 GDPR]] on the grounds of failure to follow up on the data subject’s request and because the controller revealed the personal data to a third party. == Comment == ''Share your comments here!'' == Further Resources == ''Share blogs or news articles here!'' == English Machine Translation of the Decision == The decision below is a machine translation of the French original. Please refer to the French original for more details. 1\u002F8 Litigation Division Decision 267\u002F2026 of October 6, 2026 Case Number: DOS-2026-00228 Subject: Complaint regarding a data breach in email correspondence Having regard to Regulation (EU) 2016\u002F679 of the European Parliament and of the Council of April 27, 2016 on the data protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95\u002F46\u002FEC (General Data Protection Regulation), hereinafter “GDPR”; Having regard to the Act of December 3, 2017, establishing the Data Protection Authority, hereinafter “LCA”; Having regard to the internal regulations of procedure of the Data Protection Authority, as approved by the Executive Committee on April 25, 2024, and published in the Belgian Official Gazette on May 31, 2024; Having regard to the case file; The Litigation Chamber of the Data Protection Authority (hereinafter “DPA”) has issued the following decision regarding: The complainant: X, […], hereinafter “the complainant” The defendant: Y, whose principal place of business is located at […], registered under corporate number […], represented by Attorney Frédéric Dechamps, hereinafter referred to as “the defendant” Decision 267\u002F2026 — 2\u002F8 I. Facts and Proceedings 1. The subject matter of the complaint concerns a personal data breach in the context of an email exchange and the failure to follow up on a request to exercise a right. 2. On June 13, 2024, the complainant received a formal notice via email from the defendant at her work email address, with a third-party email address listed as a recipient. On the same day, the complainant asked the defendant for the identity of this third party, and the defendant confirmed receipt of her email and informed her that her request would be addressed as soon as possible. 3. On April 21, 2025, the defendant sent a payment notice from Parking Agency Z to the plaintiff, once again with the same third-party email address in the email’s carbon copy. 4. On April 22, 2025, the complainant asked the defendant to explain how the defendant had obtained her work email address, as well as to inform her of the identity of the third party who is a recipient of the communications she sends. On the same day, the defendant acknowledged receipt of the complainant’s request, but did not respond to it. 5. On July 8, 2025, and January 16, 2026, the defendant sent two emails to the complainant containing, respectively, a reminder regarding non-compliance with a repayment plan and a pre-seizure statement of account, again with the same third party’s email address in copy. 6. In her complaint filed with the Data Protection Authority (hereinafter “the DPA”) on January 16, 2026, the complainant asserts that the defendant improperly used her work email address, which had not been previously disclosed to her, and that her personal data had been disclosed to a third party (the third-party recipient referred to above) in violation of her right to data protection. The complainant requests information regarding the third party involved in her communications with the respondent, the erasure of her work email address, and that none of her personal data be transmitted to the third parties in question. 7. On February 16, 2026, the complaint was declared admissible by the First-Line Service (SPL) of the DPA on the basis of articles 58 and 60 of the LCA, and the complainant was notified in accordance with Article 61 of the LCA. 8. On the same day, the Litigation Chamber was seized of the case pursuant to Article 92, 1° of the LCA. Decision 267\u002F2026 — 3\u002F8 9. On March 19, 2026, in accordance with Article 95, § 2 of the LCA, the Litigation Chamber informed the parties that the case was pending, of the content of the complaint, and of the possibility of reviewing and copying the case file at the clerk’s office of the Litigation Chamber. The defendant was also informed of its right to submit observations to the Litigation Chamber. 10. On April 2, 2026, the Litigation Chamber received remarks from the defendant, which were communicated to the complainant. 11. Regarding the complainant’s allegation concerning the use of her work email address, the defendant demonstrates that the complainant had initiated contact with the defendant via email using that same work email address on March 14, 2024. Consequently, the defendant considered this to be a deliberate use of that email address in the context of communications regarding debt collection cases involving the complainant. In addition, the defendant demonstrates that it removed the complainant’s work email address complainant’s professional email address from its system. 12. As for the allegation regarding the disclosure of the complainant’s data to a third party, the defendant argues that this resulted from a human error in data entry. It explains that a manual entry led to the incorrect association of the third-party email address with the complainant’s debtor record. The defendant adds that it deleted the aforementioned email address from the complainant’s debtor record as soon as its internal investigation began. 13. Finally, the defendant acknowledges that it did not respond to the complainant’s requests made pursuant to articles 15 through 22 of the GDPR on June 13, 2024, and April 22, 2025. The defendant asserts that this omission was unintentional and resulted from the heavy workload of its employees. II. Rationale II.1. Regarding the disclosure of emails to a third party 14. The Litigation Chamber reminds the defendant, as the controller, of its obligation to ensure compliance with the principles of data integrity and confidentiality set forth in Article 5(1)(f) of the GDPR. The defendant must also be in able to demonstrate compliance with this principle by implementing appropriate technical and organizational measures (principle of accountability—Articles 5.2 and 24 of the GDPR). These measures must be reviewed and updated as necessary. 15. Article 32.1 of the GDPR, which reflects the principle of data integrity and confidentiality set forth in Article 5.1.f of that regulation, provides as follows: Decision 267\u002F2026 — 4\u002F8 “Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of the processing, as well as the risks, including their likelihood and severity, to the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including, among other things, as necessary: […] b) measures to ensure the confidentiality, integrity, availability, and resilience of processing systems and services; […] d) a procedure to regularly test, analyze, and evaluate the effectiveness of the technical and organizational measures on a regular basis to ensure the security of the processing.” 16. In the present case, it appears from the record that on June 13, 2024, April 21, 2025, July 8, 2025, and January 16, 2026, the defendant sent emails to the complainant, cc’ing a third party as a recipient on these emails. These emails contained the complainant’s personal data, including her name, her home address, and her car’s license plate number. 17. The defendant explained to the Litigation Chamber in its letter dated April 2, 2026, that this was a human error (see point 13 above). The defendant argues that two email addresses were incorrectly linked in the complainant’s debtor record for the complainant dated November 8, 2023, resulting, in its words, “from a human data entry error that was accidental and devoid of any intentionality on the part of the administrator.” 18. The defendant adds that it deleted the third party’s email address upon receipt of the complaint and before any action was taken by the DPA. 19. The Litigation Chamber notes that the data of a third party—specifically specifically their email address, were included in the complainant’s debtor record in 2023 and were not removed from that record until following the initiation of an within the defendant’s organization, i.e., no earlier than January 16, 2026, the date of the last email that included the third party’s email address in the cc field. 20. The Dispute Resolution Chamber further notes that the complainant notified the defendant of this issue on several occasions, namely in her emails dated June 13, 2024, and April 22, 2025 (see points 2 and 4 above). 21. Finally, the third party’s email address was copied on four emails, dated June 13, 2024, April 21, 2025, July 8, 2025, and January 16, 2026 (see points 2, 3, and 5 above). 22. In the view of the Litigation Chamber, these various elements do not appear to be compatible with Articles 5.1(f), 5.2, 24, and 32 of the GDPR, which enshrine, in particular, Decision 267\u002F2026 — 5\u002F8 the principle of accountability, which requires the controller to implement the technical and organizational measures necessary to ensure that the processing complies with the GDPR, including security measures appropriate for sending emails relating to debt collection cases and to be able to demonstrate this. II.2. Regarding the response to a request to exercise a right 23. The Appeals Chamber recalls that Article 12.3 of the GDPR provides that “The controller shall provide the data subject with information on the measures taken in response to a request made pursuant to Articles 15 through 22, as soon as possible and in any event within one month of receiving the request. If necessary, this period may be extended by two months, taking into account the complexity and the number of requests. The controller shall inform the data subject of this extension and the reasons for the delay within one month of receiving of the request. When the data subject submits the request electronically, the information shall be provided electronically whenever possible, unless the data subject requests otherwise.” 24. The Litigation Chamber notes that on two occasions, namely on June 13, 2024, and April 22, 2025, the complainant contacted the defendant to exercise her rights in accordance with articles 15 through 22 of the GDPR. However, the defendant failed to respond to her, which it acknowledges in its email dated April 2, 2026 (see point 14 above). 25. In the view of the Litigation Chamber, this failure to respond does not appear to be consistent with article 12(3) of the GDPR, which requires the controller to inform the data subject data subject—in this case, the complainant—of the measures taken in response to her requests made pursuant to Articles 15 through 22 of the GDPR. II.3. Regarding the use of the complainant’s work email address 26. The complainant alleges that the defendant improperly used her work email address in the course of its email communications and requests the erasure of this email address. 27. The Litigation Chamber notes that, as evident from the defendant’s submissions dated April 2, 2026, the complainant initiated contact via email with the defendant using her work email address on March 14, 2024. Consequently, the defendant considered this to be a deliberate use of that email address in the context of the communications in question (see point 12 above). Furthermore, the defendant carried out an erasure of the complainant’s email address from its system. Decision 267\u002F2026 — 6\u002F8 28. It therefore appears that the subject matter of the complaint regarding the use of the complainant’s professional email address and the failure to comply with her request for erasure has ceased to exist as a result of the measures taken by the defendant, the controller. 29. Consequently, the Litigation Chamber decides to dismiss the portion of the complaint relating to the grievance concerning the use of the complainant’s work email address, based on of the grounds for dismissal based on discretion (B.6) set forth in its policy on the dismissal of complaints. 30. Pursuant to Article 95, § 1, 4° of the LCA and Article 58.2.a) of the GDPR, the has the authority to notify a data controller or processor that the proposed processing operations are likely to violate the provisions of the GDPR. The Litigation Chamber therefore considers that the defendant is likely to violate Articles 12.3 and 32 of the GDPR, due to the failure to follow up on a request to exercise a right and the disclosure of personal data to a third party, which therefore justifies the issuance of a warning so that the defendant ensures, in the future, that it responds to a request to exercise a right in a timely manner and implements measures to ensure the security of the processing. 32. The purpose of this warning decision is to remind the defendant, as the data controller, of its obligation to comply with the aforementioned provisions of the GDPR, so that it may comply with these provisions in the future in connection with the processing operations at issue in this case. 33. This decision is a prima facie decision issued by the Litigation Chamber in accordance with Article 95 of the LCA based on the complaint filed by the complainant, 2 as part of the “preliminary proceedings prior to the decision on the merits” and not a decision on the merits by the Litigation Chamber within the meaning of article 100 of the LCA. 34. Should the case proceed to a decision on the merits, pursuant to Article 98, paragraphs 2 and 3, in conjunction with Article 99 of the LCA, the Litigation Chamber will invite the parties to file their arguments and to include in the record all documents they deem relevant. If applicable, this decision is definitively suspended. 35. For the sake of completeness, the Litigation Chamber finally emphasizes that processing of the case on the merits may lead to the imposition of the measures mentioned in Article 100 of the LCA. 1See point B.6 of the Litigation Chamber’s policy on dismissing cases without further action. 2Section 3, Subsection 2 of the LCA (Articles 94 through 97, inclusive). 3“Art. 100. § 1. The Litigation Chamber has the authority to: 1° dismiss the complaint; Decision 267\u002F2026 — 7\u002F8 III. Publication of the Decision 36. Given the importance of transparency regarding the decision-making process of the Litigation Chamber, this decision is published on the website of the Data Protection Authority. However, it is not necessary for this purpose that the identifying information of the parties be directly mentioned. FOR THESE REASONS, the Litigation Chamber of the Data Protection Authority decides, subject to the defendant’s filing of a motion for a ruling on the merits regarding processing, in accordance with Articles 98 et seq. of the LCA: - pursuant to Article 58.2.a) of the GDPR and Article 95, §1, 4° of the LCA, to issue a warning against the defendant so that the latter ensures, in the future, compliance with Article 12.3 of the GDPR, in that it properly responds to future requests to exercise rights within the time limit by the GDPR, as well as articles 5.1(f), 5.2, 24, and 32 of the GDPR, in that it adopts measures to ensure the security of processing, thereby preventing accidental emails from being sent to third parties in the future. - Furthermore, to dismiss this complaint pursuant to Article 95, §1, 3° of the LCA . The Litigation Chamber notes that if the defendant disagrees with the content of this prima facie decision and believes it can present factual and\u002For legal arguments that could lead to a different decision, it may, first, submit to the Litigation Chamber a request for processing of the merits of the case via the email address litigationchamber@apd-gba.be, within 30 days of notification of the 2° dismiss the case; 3° suspend the ruling; 4° propose a settlement; 5° issue warnings and reprimands; 6° order compliance with the data subject’s requests to exercise their rights; 7° order that the data subject be informed of the security issue; 8° order the suspension, restriction of processing, or temporary or permanent prohibition of processing; 9° order that the processing be brought into compliance; 10° order the rectification, restriction, or erasure of data and the notification thereof to the recipients of the data; 11° order the revocation of the accreditation of certification bodies; 12° impose periodic penalty payments; 13° impose administrative fines; 14° order the suspension of cross-border data flows to another State or an international organization; 15. forward the case file to the Office of the Public Prosecutor in Brussels, which shall be informed of the action taken on the case; 16. decide on a case-by-case basis whether to publish its decisions on the website of the Data Protection Authority.\" Decision 267\u002F2026 — 8\u002F8 this decision. Where applicable, the enforcement of this decision is suspended during the aforementioned period. Furthermore, the defendant may file an appeal against this decision in accordance with Article 108, §1 of the LCA, within 30 days of its notification, with the of Public Procurement (Brussels Court of Appeal), with the Data Protection Authority as the defendant. Such an appeal may be filed by means of a joint petition, which must 4 contain the information listed in article 1034ter of the Judicial Code. The joint petition must be filed with the clerk’s office of the Court of Public Procurement in accordance with Article 1034quinquies of the Code of Civil Procedure, or via the Justice Department’s e-Deposit computer system (Art. 32ter of the Code of Civil Procedure). D IRKV AN D ER K ELEN (presiding) Director of the Litigation Chamber 4. “The petition must contain, on pain of nullity: 1° the day, month, and year; 2° the last name, first name, and address of the petitioner, as well as, where applicable, their capacity and national registry number or enterprise registration number; 3° the last name, first name, address, and, where applicable, the capacity of the person to be summoned; 4° the subject matter and a summary of the grounds for the petition; 5° the name of the judge before whom the petition is filed; 6° the signature of the petitioner or his or her Lawyer.\" 5\"The petition, together with its annex, shall be sent, in as many copies as there are parties to the case, by certified mail to the clerk of the court or filed with the court clerk’s office.\"","Belgium's Data Protection Authority (APD\u002FGBA) issued a warning to a company for accidentally disclosing a data subject's personal information, including name, address, and license plate number, to a third party via email. The company also failed to respond to the data subject's requests regarding the disclosure and the origin of their work email address. The DPA cited violations of GDPR Articles 5(1)(f), 24, 32, and 12(3).","Belgium's DPA warns a company for accidental data disclosure and failure to respond to data subject requests.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=APD\u002FGBA_(Belgium)_-_DOS-2026-00228&diff=53366&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F44\u002FLogoBE.png","2026-10-12T09:33:52+00:00","2026-10-12T10:00:18.166649+00:00",7,[17],{"name":18,"type":19},"APD\u002FGBA","vendor","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":20,"icon":22,"name":23,"slug":24},null,"Policy","policy",[26,31,36,41],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":37},{"id":38,"icon":22,"name":39,"slug":40},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":42},{"id":20,"icon":22,"name":23,"slug":24},[],[18],{"controls":46,"vendors":128},[47,76,102],{"slug":48,"name":49,"problem":50,"products":51},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[52,60,68],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":56,"product_name":57,"url":58,"description":59},"sailpoint","SailPoint","\u002Fvendor-logos\u002Fsailpoint.png","human-fabric","SailPoint Human Fabric","https:\u002F\u002Fwww.sailpoint.com\u002Fproducts\u002Fhuman-fabric","Identity governance platform, the successor to Identity Security Cloud: lifecycle management, access requests and continuous access reviews.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":77,"name":78,"problem":79,"products":80},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[81,86,94],{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":82,"product_name":83,"url":84,"description":85},"purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"slug":103,"name":104,"problem":105,"products":106},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[107,115,123],{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","luna-hsm","Thales Luna HSM","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fhardware-security-modules","Hardware security modules for protecting cryptographic keys.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"utimaco","Utimaco","\u002Fvendor-logos\u002Futimaco.png","utimaco-hsm","Utimaco General Purpose HSM","https:\u002F\u002Futimaco.com\u002Fdata-protection\u002Fgp-hsm","Hardware security modules for key generation, storage and cryptographic operations.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":124,"product_name":125,"url":126,"description":127},"ciphertrust","CipherTrust Data Security Platform","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fdata-security-platform","Data discovery, encryption and central key management across on-premises and cloud.",[],{"slug":130,"title":131,"body":132,"framework_refs":133,"framework_notes":144},"belgian-dpa-fines-company-for-accidental-personal-data-disclosure-via-email","Belgian DPA Fines Company for Accidental Personal Data Disclosure via Email","A company in Belgium accidentally sent a data subject's personal information — including name, home address, and license plate number — to an unintended third party via email, violating GDPR's core data security and integrity principles. Compounding the breach, the company failed to respond in a timely manner to the data subject's requests for information, breaching GDPR Article 12(3)'s response obligations. This case highlights how human error in email handling, combined with poor internal processes for managing data subject requests, can result in regulatory action. It matters because even seemingly minor disclosure incidents carry significant legal and reputational consequences when organisations lack proper controls and accountability mechanisms.",[134,135,136,137,138,139,140,141,142,143],"GDPR Article 5(1)(f) — Integrity and confidentiality","GDPR Article 12(3) — Timely response to data subject requests","GDPR Article 24 — Responsibility of the controller","GDPR Article 32 — Security of processing","NIST SP 800-53 SI-12 — Information Management and Retention","NIST SP 800-53 IR-6 — Incident Reporting","CIS Control 3 — Data Protection","CIS Control 14 — Security Awareness and Skills Training","ISO\u002FIEC 27001 Annex A.8.2 — Information Classification","ISO\u002FIEC 27001 Annex A.6.1.3 — Contact with Authorities",{}]