[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fBGSiul7mk-jS2oYuOLkq0ncAo0tCwWRFIXynB2bw6Lg":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"status":22,"created_at":23,"published_at":24,"article":25,"tags":29,"podcasts":48},"5ad834df-2be2-4206-b951-3a1f90989da3","slovenian-institution-fails-to-identify-breach-victims-or-honor-access-rights","ec2bf5b1-3eac-465d-b995-51851b069676","Slovenian Institution Fails to Identify Breach Victims or Honor Access Rights","A Slovenian public institution suffered a data breach and compounded the harm by failing to properly identify which individuals were affected and providing vague, non-committal responses to their GDPR Article 15 access requests. This violated multiple GDPR obligations — including transparency (Article 13), right of access (Article 15), security measures (Article 32), and breach notification to data subjects (Article 34). The case illustrates that a breach itself is only part of the problem; inadequate post-breach processes and poor data subject communication can independently constitute serious regulatory violations. Organizations must have pre-defined procedures for mapping affected individuals quickly and communicating with them clearly and promptly.","**Immediate actions:**\n- Establish a data breach response runbook that includes a step-by-step process for identifying all affected data subjects within 72 hours.\n- Audit current access request (DSAR) workflows to ensure they produce explicit, unambiguous confirmations of data involvement rather than generic responses.\n- Designate a responsible owner (e.g., DPO or Privacy Officer) to approve all breach-related communications to data subjects.\n\n**Long-term improvements:**\n- Maintain a continuously updated data inventory and record of processing activities (RoPA) so affected individuals can be identified rapidly during any incident.\n- Implement an access policy that clearly defines how data subject rights requests are handled, escalated, and documented in compliance with GDPR Article 15.\n- Conduct annual tabletop exercises simulating data breach scenarios, including the identification of affected data subjects and drafting of Article 34 notifications.\n\n**Detection & compliance measures:**\n- Deploy a case management system to track all DSARs and breach notifications with SLA timers to prevent missed deadlines.\n- Schedule quarterly GDPR compliance reviews covering Articles 13, 15, 32, and 34 obligations to catch procedural gaps before regulators do.",[12,13,14,15,16,17,18,19,20,21],"GDPR Article 13 – Transparency and information obligations","GDPR Article 15 – Right of access by the data subject","GDPR Article 32 – Security of processing","GDPR Article 34 – Communication of a personal data breach to the data subject","NIST SP 800-61 Rev. 2 – Computer Security Incident Handling Guide","NIST PR.IP-9 – Response plans are in place and managed","NIST RS.CO-3 – Information is shared consistent with response plans","CIS Control 17 – Incident Response Management","ISO\u002FIEC 27001:2022 Annex A 5.34 – Privacy and protection of PII","ITIL 4 – Incident Management Practice","published","2026-09-23T08:22:01.501661+00:00","2026-09-23T08:22:01.404+00:00",{"id":7,"url":26,"slug":27,"title":28},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=IP_(Slovenia)_-_0612-91\u002F2025\u002F40&diff=53164&oldid=52124","ip-slovenia-0612-91-2025-40-c05527","IP (Slovenia) - 0612-91\u002F2025\u002F40",[30,36,42],{"id":31,"name":32,"slug":33,"description":34,"color":35},"182e11d5-57c4-444e-8ec8-4682ad60261b","Incident Response","incident-response","Slow detection, poor containment, missing playbooks","#14b8a6",{"id":37,"name":38,"slug":39,"description":40,"color":41},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":43,"name":44,"slug":45,"description":46,"color":47},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[]]