Polish DPA Fines Controller for GDPR Failures After Email Data Breach

A Polish data controller was fined €2,760 after unauthorized access to personal data processed via email exposed systemic failures in their data protection practices. The root cause was the absence of adequate technical and organizational measures — including no prior risk assessment and no testing of existing security controls — all required under GDPR. This case illustrates that GDPR compliance is not a one-time checkbox but an ongoing obligation to assess, implement, and validate protective measures. Regulators will hold organizations accountable not just for the breach itself, but for the failure to proactively manage risk before an incident occurs.

Tactical Insight

Immediate actions

Conduct a formal risk assessment for all systems processing personal data, including email platforms, to identify and document current vulnerabilities.
Enforce access controls on email accounts handling personal data, such as multi-factor authentication and least-privilege permissions.

Long-term improvements

Establish a recurring schedule (at least annually) to test, review, and update technical and organizational security measures as required by GDPR Article 32.
Implement a Data Protection Impact Assessment (DPIA) process for any processing activities that present a high risk to individuals' rights and freedoms.
Document all security measures and risk assessments to demonstrate accountability and readiness during regulatory audits.

Detection & Response measures

Deploy email security monitoring tools (e.g., DLP, anomaly detection) to identify unauthorized access or data exfiltration attempts in real time.
Establish and rehearse a GDPR-compliant breach notification procedure to ensure timely reporting to the supervisory authority within the 72-hour window.