[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fREFSG6wxDQ7mQSPgS2sOypnWwPAuKFaBRr9sfZnzgX4":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49,"controls":50},"f7f8f7a6-da30-4e23-8695-3132895cb637","belgian-dpa-fines-company-for-accidental-personal-data-disclosure-via-email","8b916618-fa7e-43f7-b03f-84c55892e09b","Belgian DPA Fines Company for Accidental Personal Data Disclosure via Email","A company in Belgium accidentally sent a data subject's personal information — including name, home address, and license plate number — to an unintended third party via email, violating GDPR's core data security and integrity principles. Compounding the breach, the company failed to respond in a timely manner to the data subject's requests for information, breaching GDPR Article 12(3)'s response obligations. This case highlights how human error in email handling, combined with poor internal processes for managing data subject requests, can result in regulatory action. It matters because even seemingly minor disclosure incidents carry significant legal and reputational consequences when organisations lack proper controls and accountability mechanisms.","**Immediate actions:**\n- Implement email Data Loss Prevention (DLP) tools to flag or block outbound emails containing personal identifiers such as names, addresses, or vehicle registration numbers.\n- Establish a formal data subject request (DSR) tracking system to ensure all access, erasure, and information requests are acknowledged and resolved within GDPR's one-month deadline.\n\n**Process & Policy improvements:**\n- Require staff to use recipient verification steps (e.g., double-entry confirmation) before sending emails containing personal data.\n- Create and maintain a documented procedure for handling accidental data disclosures, including immediate notification workflows and breach assessment templates.\n- Define clear ownership roles for responding to data subject requests so no request goes unassigned or unanswered.\n\n**Training & Culture:**\n- Conduct regular security awareness training focused on safe email handling, recognising personal data, and the legal obligations under GDPR.\n- Run periodic simulated 'accidental disclosure' drills to test staff readiness and reinforce correct behaviours around sensitive data handling.",[12,13,14,15,16,17,18,19,20,21],"GDPR Article 5(1)(f) — Integrity and confidentiality","GDPR Article 12(3) — Timely response to data subject requests","GDPR Article 24 — Responsibility of the controller","GDPR Article 32 — Security of processing","NIST SP 800-53 SI-12 — Information Management and Retention","NIST SP 800-53 IR-6 — Incident Reporting","CIS Control 3 — Data Protection","CIS Control 14 — Security Awareness and Skills Training","ISO\u002FIEC 27001 Annex A.8.2 — Information Classification","ISO\u002FIEC 27001 Annex A.6.1.3 — Contact with Authorities",{},"published","2026-10-12T10:20:36.952621+00:00","2026-10-12T10:20:36.922+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=APD\u002FGBA_(Belgium)_-_DOS-2026-00228&diff=53366&oldid=0","apd-gba-belgium-dos-2026-00228-6f6fbe","APD\u002FGBA (Belgium) - DOS-2026-00228",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":38,"name":39,"slug":40,"description":41,"color":42},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":44,"name":45,"slug":46,"description":47,"color":48},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[51,55,59],{"slug":52,"name":53,"problem":54},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",{"slug":56,"name":57,"problem":58},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",{"slug":60,"name":61,"problem":62},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control."]