[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fAn1aaUopuCi3u7lSbWwB7jyARlIYQD5vmIdX8pCt5ZQ":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":65},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"1d34f1f7-e9d9-47ef-9815-cee63898a2ef","UODO (Poland) - DKN.5131.17.2025","uodo-poland-dkn-5131-17-2025-e7fd3f","Created page with \"{{DPAdecisionBOX |Jurisdiction=Poland |DPA-BG-Color=background-color:#ffffff; |DPAlogo=LogoPL.png |DPA_Abbrevation=UODO |DPA_With_Country=UODO (Poland) |Case_Number_Name=DKN.5131.17.2025 |ECLI= |Original_Source_Name_1=UODO |Original_Source_Link_1=https:\u002F\u002Forzeczenia.uodo.gov.pl\u002Fdocument\u002Furn:ndoc:gov:pl:uodo:2025:dkn_5131_17\u002Fcontent?query= |Original_Source_Language_1=Polish |Original_Source_Language__Code_1=PL |Original_Source_Name_2= |Original_Source_Link_2= |Original_...\" Show changes","Poland's Data Protection Authority (UODO) has fined a municipality PLN 7,700 (approximately €1,813) for failing to report a data breach. The municipality mistakenly published personal data of individuals who signed a petition, including names and addresses. Despite the municipality's claim of low risk, the UODO found a violation of Article 33 of GDPR, emphasizing the obligation to report breaches regardless of perceived risk.","Poland's UODO fines municipality PLN 7,700 for failing to report a data breach.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=UODO_(Poland)_-_DKN.5131.17.2025&diff=51876&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F7\u002F7b\u002FLogoPL.png","2026-06-16T08:52:39+00:00","2026-06-16T10:00:07.949033+00:00",7,[17],{"name":18,"type":19},"UODO","vendor","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":20,"icon":22,"name":23,"slug":24},null,"Policy","policy",[26,31,36,38],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":37},{"id":20,"icon":22,"name":23,"slug":24},{"category":39},{"id":40,"icon":22,"name":41,"slug":42},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18],{"controls":46,"vendors":64},[47],{"slug":48,"name":49,"problem":50,"products":51},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[52,58],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":53,"product_name":54,"url":56,"description":57},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":59,"product_name":60,"url":62,"description":63},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",[],{"slug":66,"title":67,"body":68,"framework_refs":69,"framework_notes":79},"polish-municipality-fined-for-failing-to-report-gdpr-data-breach","Polish Municipality Fined for Failing to Report GDPR Data Breach","A Polish municipality inadvertently published personal data — including names and addresses — of petition signatories, constituting a clear personal data breach under GDPR. Rather than reporting the incident to the supervisory authority within the mandatory 72-hour window, the municipality chose not to notify UODO, incorrectly self-assessing the risk as low. GDPR Article 33 requires breach notification regardless of the organization's own risk perception, and this case demonstrates that subjective risk assessments do not override legal obligations. The relatively modest fine underscores that even smaller public bodies face regulatory consequences for procedural non-compliance. This case serves as a reminder that breach reporting obligations are non-negotiable and that internal risk minimization reasoning is not a valid substitute for regulatory notification.",[70,71,72,73,74,75,76,77,78],"GDPR Article 33 – Notification of a personal data breach to the supervisory authority","GDPR Article 34 – Communication of a personal data breach to the data subject","GDPR Article 5(1)(f) – Integrity and confidentiality principle","NIST SP 800-61 Rev. 2 – Computer Security Incident Handling Guide","NIST Privacy Framework PR.PO-P1 – Policies and procedures for data handling","CIS Control 17 – Incident Response Management","CIS Control 3 – Data Protection","ISO\u002FIEC 27001:2022 Annex A 5.24 – Information security incident management planning and preparation","ITIL 4 – Incident Management Practice",{}]