UODO (Poland) - DKN.5131.17.2025

A Polish municipality inadvertently published personal data — including names and addresses — of petition signatories, constituting a clear personal data breach under GDPR. Rather than reporting the incident to the supervisory authority within the mandatory 72-hour window, the municipality chose not to notify UODO, incorrectly self-assessing the risk as low. GDPR Article 33 requires breach notification regardless of the organization's own risk perception, and this case demonstrates that subjective risk assessments do not override legal obligations. The relatively modest fine underscores that even smaller public bodies face regulatory consequences for procedural non-compliance. This case serves as a reminder that breach reporting obligations are non-negotiable and that internal risk minimization reasoning is not a valid substitute for regulatory notification.