IP (Slovenia) - 0612-91/2025/40
Slovenian DPA orders controller to identify data subjects affected by a breach and respond to access requests.
The Slovenian DPA has issued a decision against a controller following a data breach. The controller failed to implement an appropriate access policy and did not respond specifically to data subjects' requests about whether their data was affected by the breach. The DPA ordered the controller to take measures to identify affected individuals, properly respond to access and erasure requests, and document these actions.
AI summary of the linked source. Not reviewed by an editor. How this works
Run IP (Slovenia)?
Get an email when a new story names IP (Slovenia), usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe controller failed on two critical fronts: implementing an appropriate access policy that could have limited the breach's impact, and properly responding to data subjects' rights requests in the aftermath. Under GDPR, organisations are obligated not only to prevent breaches through sound access controls but also to transparently communicate with affected individuals when breaches do occur. Failing to confirm whether specific individuals' data was compromised directly undermines data subjects' rights to erasure and access. This case highlights that a data breach is not just a technical failure — it is also a test of an organisation's legal and procedural readiness to respond under the GDPR framework.
What helps against this
How we list vendors- Identity governance and single sign-on
People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.