[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fh5Jzww1l26uf16c7UZZAvyRLQeDs3vHnc1jFnDI0dFo":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":65},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"06b7ff34-ece5-4d84-84a8-7c2774661dd5","IP (Slovenia) - 0609-41\u002F2026\u002F7","ip-slovenia-0609-41-2026-7-a3f4a5","← Older revision Revision as of 07:31, 12 August 2026 (One intermediate revision by the same user not shown) Line 12: Line 12: |Original_Source_Name_1=Praksa IP |Original_Source_Name_1=Praksa IP |Original_Source_Link_1=https:\u002F\u002Fwww.ip-rs.si\u002Fgo?u=%2Ffileadmin%2Fuser_upload%2Fzip%2FPonovna_uporaba%2F2026%2FJunij%2Fjunij-2026-zp-odlocbe.zip |Original_Source_Link_1=https:\u002F\u002Fwww.ip-rs.si\u002Fgo?u=%2Ffileadmin%2Fuser_upload%2Fzip%2FPonovna_uporaba%2F2026%2FJunij%2F0609-41-2026-7.docx |Original_Source_Language_1=Slovenian |Original_Source_Language_1=Slovenian |Original_Source_Language__Code_1=SL |Original_Source_Language__Code_1=SL Line 85: Line 85: === Facts === === Facts === A company (the controller) used a service provider (the processor) to store personal data, manage a database, and provide technical support and maintenance on its behalf. The processor processed the personal data of the controller's employees in the performance of its duties. A legal representative of the controller, who was responsible for ensuring that the controller complied with the GDPR, had not concluded a valid contract defining the contractual relationship with the processor, regulating the processing operations entrusted to it. A company (the controller) used a service provider (the processor) to store personal data, manage a database, and provide technical support and maintenance on its behalf. A legal representative of the controller, who was responsible for ensuring that the controller complied with the GDPR, had not concluded a valid contract defining the contractual relationship with the processor, regulating the processing operations entrusted to it.","Slovenia's Information Protection Authority (IP) has fined a company €1,282 for violating GDPR Article 28(3). The company, acting as a data controller, failed to establish a valid data processing agreement with its service provider, which managed employee personal data. The IP found that the controller's legal representative neglected to properly formalize the contractual relationship, leading to the fine.","Slovenian DPA fines company €1,282 for failing to sign a data processing agreement.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=IP_(Slovenia)_-_0609-41\u002F2026\u002F7&diff=52677&oldid=52671","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F7\u002F78\u002FLogoSI.png","2026-08-12T07:31:25+00:00","2026-08-12T08:00:17.441639+00:00",7,[17],{"name":18,"type":19},"IP (Slovenia)","vendor","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":20,"icon":22,"name":23,"slug":24},null,"Policy","policy",[26,31,36,38],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":37},{"id":20,"icon":22,"name":23,"slug":24},{"category":39},{"id":40,"icon":22,"name":41,"slug":42},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18],{"controls":46,"vendors":64},[47],{"slug":48,"name":49,"problem":50,"products":51},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[52,58],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":53,"product_name":54,"url":56,"description":57},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":59,"product_name":60,"url":62,"description":63},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",[],{"slug":66,"title":67,"body":68,"framework_refs":69,"framework_notes":78},"slovenia-fines-company-for-missing-gdpr-data-processing-agreement-with-service-provider","Slovenia Fines Company for Missing GDPR Data Processing Agreement with Service Provider","A Slovenian company was fined €1,282 after failing to establish a formal Data Processing Agreement (DPA) with a third-party service provider handling employee personal data, violating GDPR Article 28(3). The root cause was a lack of governance oversight by the data controller's legal representative, who neglected to formalize the contractual relationship before data processing began. This matters because Article 28(3) is a mandatory legal safeguard — without a DPA, data subjects lose contractual protections over how their personal data is handled by processors. Even smaller fines signal regulatory intent to enforce third-party data governance rigorously, and repeat failures could attract much larger penalties.",[70,71,72,73,74,75,76,77],"GDPR Article 28(3) — Data Processing Agreement requirements","GDPR Article 5(1)(f) — Integrity and confidentiality principle","NIST SP 800-53 SA-9 (External Information System Services)","NIST SP 800-53 CA-3 (System Interconnections)","CIS Control 15 — Service Provider Management","ISO\u002FIEC 27001:2022 Annex A 5.19 — Information security in supplier relationships","ISO\u002FIEC 27001:2022 Annex A 5.20 — Addressing information security within supplier agreements","ITIL Service Design — Supplier Management Practice",{}]