UODO (Poland) - DKN.5131.5.2025
Poland's UODO fines controller and processor for data breach due to inadequate security measures and oversight.
Poland's data protection authority (UODO) issued fines totaling €7,800 (PLN 33,500) following a January 2023 data breach where a work laptop was stolen from a parked car, exposing landowners' personal data including names, addresses, and ID numbers. The controller was fined €4,900 for failing to implement appropriate technical and organisational security measures and conduct adequate risk assessments, while the processor was fined €2,900 for insufficient security controls on external devices and failure to assist the controller with GDPR compliance. The DPA found violations of Articles 24, 25, 28, and 32 GDPR, determining that inadequate encryption and device protection measures directly enabled the breach.
AI summary of the linked source. Not reviewed by an editor. How this works
Run UODO (Poland)?
Get an email when a new story names UODO (Poland), usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA work laptop stolen from a parked car exposed landowners' names, addresses, and ID numbers because neither the data controller nor the processor had implemented adequate endpoint security measures such as full-disk encryption. The root failure was a lack of proper risk assessment and technical safeguards for portable devices holding personal data — a foundational GDPR requirement under Articles 24, 25, and 32. This case illustrates that physical theft remains a significant data breach vector and that 'appropriate technical measures' explicitly includes encryption of mobile devices. The dual fines against both controller and processor highlight that GDPR accountability extends across the entire data processing chain, and processors cannot simply defer security responsibilities to controllers.
What helps against this
How we list vendors- Cyber asset inventory
You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.
- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
- Encryption and key management
Stolen data stays unreadable, and the keys stay under your control.