IP (Slovenia) - 0609-41/2026/7
Slovenian DPA fines company €1,282 for failing to sign a data processing agreement.
Slovenia's Information Protection Authority (IP) has fined a company €1,282 for violating GDPR Article 28(3). The company, acting as a data controller, failed to establish a valid data processing agreement with its service provider, which managed employee personal data. The IP found that the controller's legal representative neglected to properly formalize the contractual relationship, leading to the fine.
AI summary of the linked source. Not reviewed by an editor. How this works
Run IP (Slovenia)?
Get an email when a new story names IP (Slovenia), usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA Slovenian company was fined €1,282 after failing to establish a formal Data Processing Agreement (DPA) with a third-party service provider handling employee personal data, violating GDPR Article 28(3). The root cause was a lack of governance oversight by the data controller's legal representative, who neglected to formalize the contractual relationship before data processing began. This matters because Article 28(3) is a mandatory legal safeguard — without a DPA, data subjects lose contractual protections over how their personal data is handled by processors. Even smaller fines signal regulatory intent to enforce third-party data governance rigorously, and repeat failures could attract much larger penalties.
What helps against this
How we list vendors- Compliance automation (GRC)
Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.