[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fjQmEIPFEsXT1XiPxGtTix-DwcrLCzvZbueKzvBc6sQI":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":77},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"2816da54-18ce-428d-a403-c293227ff6d1","IP (Slovenia) - 0612-91\u002F2025\u002F40","ip-slovenia-0612-91-2025-40-5c2464","Wiki maintenance (fixed links) ← Older revision Revision as of 13:33, 30 June 2026 Line 10: Line 10: |ECLI= |ECLI= |Original_Source_Name_1= data subject |Original_Source_Name_1= IP |Original_Source_Link_1= |Original_Source_Link_1=https:\u002F\u002Fwww.ip-rs.si\u002Fvarstvo-osebnih-podatkov\u002Fpraksa-ip |Original_Source_Language_1=SL |Original_Source_Language_1=Slovenian |Original_Source_Language__Code_1= |Original_Source_Language__Code_1=SL |Type=Investigation |Type=Investigation","The Slovenian DPA has issued a decision against a controller following a data breach. The controller failed to implement an appropriate access policy and did not respond specifically to data subjects' requests about whether their data was affected by the breach. The DPA ordered the controller to take measures to identify affected individuals, properly respond to access and erasure requests, and document these actions.","Slovenian DPA orders controller to identify data subjects affected by a breach and respond to access requests.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=IP_(Slovenia)_-_0612-91\u002F2025\u002F40&diff=52026&oldid=51985","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F7\u002F78\u002FLogoSI.png","2026-06-30T13:33:48+00:00","2026-06-30T14:00:17.065605+00:00",7,[17],{"name":18,"type":19},"IP (Slovenia)","vendor","3f0f8451-91df-4b6c-9a73-ef3b2509b7f1",{"id":20,"icon":22,"name":23,"slug":24},null,"GDPR","gdpr",[26,31,33,38],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":32},{"id":20,"icon":22,"name":23,"slug":24},{"category":34},{"id":35,"icon":22,"name":36,"slug":37},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":39},{"id":40,"icon":22,"name":41,"slug":42},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18],{"controls":46,"vendors":76},[47],{"slug":48,"name":49,"problem":50,"products":51},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[52,60,68],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":56,"product_name":57,"url":58,"description":59},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"sailpoint","SailPoint","\u002Fvendor-logos\u002Fsailpoint.png","human-fabric","SailPoint Human Fabric","https:\u002F\u002Fwww.sailpoint.com\u002Fproducts\u002Fhuman-fabric","Identity governance platform, the successor to Identity Security Cloud: lifecycle management, access requests and continuous access reviews.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",[],{"slug":78,"title":79,"body":80,"framework_refs":81,"framework_notes":93},"slovenian-dpa-penalises-controller-for-breach-response-failures-and-poor-access-policy","Slovenian DPA Penalises Controller for Breach Response Failures and Poor Access Policy","The controller failed on two critical fronts: implementing an appropriate access policy that could have limited the breach's impact, and properly responding to data subjects' rights requests in the aftermath. Under GDPR, organisations are obligated not only to prevent breaches through sound access controls but also to transparently communicate with affected individuals when breaches do occur. Failing to confirm whether specific individuals' data was compromised directly undermines data subjects' rights to erasure and access. This case highlights that a data breach is not just a technical failure — it is also a test of an organisation's legal and procedural readiness to respond under the GDPR framework.",[82,83,84,85,86,87,88,89,90,91,92],"GDPR Article 5(1)(f) – Integrity and confidentiality","GDPR Article 15 – Right of access by the data subject","GDPR Article 17 – Right to erasure","GDPR Article 33 – Notification of a personal data breach to the supervisory authority","GDPR Article 34 – Communication of a personal data breach to the data subject","NIST SP 800-53 AC-2 – Account Management","NIST SP 800-53 IR-6 – Incident Reporting","CIS Control 6 – Access Control Management","CIS Control 17 – Incident Response Management","ISO\u002FIEC 27001:2022 A.5.33 – Protection of records","ISO\u002FIEC 27001:2022 A.6.8 – Information security event reporting",{}]