[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fRAts-evnRp3Wj8fpSgOJYrdUd30AZUJBM3-ZzMES4mw":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":121},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"2c91df7e-c7f7-4696-9878-d7ed27c07850","UODO (Poland) - DKN.5131.34.2023","uodo-poland-dkn-5131-34-2023-56603d","Created page with \"{{DPAdecisionBOX |Jurisdiction=Poland |DPA-BG-Color=background-color:#ffffff; |DPAlogo=LogoPL.png |DPA_Abbrevation=UODO |DPA_With_Country=UODO (Poland) |Case_Number_Name=DKN.5131.34.2023 |ECLI= |Original_Source_Name_1=UODO |Original_Source_Link_1=https:\u002F\u002Forzeczenia.uodo.gov.pl\u002Fdocument\u002Furn:ndoc:gov:pl:uodo:2023:dkn_5131_34\u002Fcontent?query= |Original_Source_Language_1=Polish |Original_Source_Language__Code_1=PL |Original_Source_Name_2= |Original_Source_Link_2= |Original_...\" New page {{DPAdecisionBOX |Jurisdiction=Poland |DPA-BG-Color=background-color:#ffffff; |DPAlogo=LogoPL.png |DPA_Abbrevation=UODO |DPA_With_Country=UODO (Poland) |Case_Number_Name=DKN.5131.34.2023 |ECLI= |Original_Source_Name_1=UODO |Original_Source_Link_1=https:\u002F\u002Forzeczenia.uodo.gov.pl\u002Fdocument\u002Furn:ndoc:gov:pl:uodo:2023:dkn_5131_34\u002Fcontent?query= |Original_Source_Language_1=Polish |Original_Source_Language__Code_1=PL |Original_Source_Name_2= |Original_Source_Link_2= |Original_Source_Language_2= |Original_Source_Language__Code_2= |Type=Investigation |Outcome=Violation Found |Date_Started=12.12.2023 |Date_Decided=13.06.2026 |Date_Published=26.06.2026 |Year=2026 |Fine=2,760 |Currency=EUR |GDPR_Article_1=Article 5(1)(f) GDPR |GDPR_Article_Link_1=Article 5 GDPR#1f |GDPR_Article_2=Article 5(2) GDPR |GDPR_Article_Link_2=Article 5 GDPR#2 |GDPR_Article_3=Article 24(1) GDPR |GDPR_Article_Link_3=Article 24 GDPR#1 |GDPR_Article_4=Article 25(1) GDPR |GDPR_Article_Link_4=Article 25 GDPR#1 |GDPR_Article_5=Article 32(1) GDPR |GDPR_Article_Link_5=Article 32 GDPR#1 |GDPR_Article_6=Article 32(2) GDPR |GDPR_Article_Link_6=Article 32 GDPR#2 |GDPR_Article_7= |GDPR_Article_Link_7= |GDPR_Article_8= |GDPR_Article_Link_8= |EU_Law_Name_1= |EU_Law_Link_1= |EU_Law_Name_2= |EU_Law_Link_2= |National_Law_Name_1= |National_Law_Link_1= |National_Law_Name_2= |National_Law_Link_2= |Party_Name_1= |Party_Link_1= |Party_Name_2= |Party_Link_2= |Appeal_To_Body= |Appeal_To_Case_Number_Name= |Appeal_To_Status=Unknown |Appeal_To_Link= |Initial_Contributor=av | }} The DPA fined an accounting and tax consulting company € 2,760 for failure to implement technical and organisational measures following a data breach that lead to unauthorised access to personal data processed via email. == English Summary == === Facts === An unauthorised entity gained access to an email account belonging to an employee at an accounting, bookkeeping and tax consulting company (the controller). The account contained personal data of clients, their employees, and their children (the data subjects), including their names, dates of birth, salary information, and tax declarations. The controller notified the supervisory authority of a data breach in January 2021. The DPA initiated administrative proceedings regarding possible GDPR violations in December 2023. The controller argued that no personal data breach within the meaning of [[Article 4 GDPR#12|Article 4(12) GDPR]] had occurred as the unauthorised entity had only accessed and not obtained the personal data in question. === Holding === The DPA held that the controller had violated Articles 5(1)(f) and 5(2), 24(1), 25(1), 32(1), and 32(2) GDPR and issued it a fine of € 2,760. First, it pointed out that mere unauthorised access to personal data processed via email constitutes a data breach under [[Article 4 GDPR#12|Article 4(12) GDPR]]. Second, the DPA held that the controller had failed to implement appropriate technical and organisational measures to ensure the security of this personal data – it had only taken measures to comply with the aforementioned provisions of the GDPR after the data breach had been notified to the DPA. The controller had not previously conducted a risk assessment. In addition, it had failed to regularly test, measure, and evaluate the effectiveness of the technical and organisational measures implemented. Finally, the DPA found that the processing posed a high risk to the rights and freedoms of data subjects: it affected a large number of individuals and concerned a broad scope of personal data. When determining the amount of the fine, the DPA took into account that there was a clear imbalance between the data subjects and the controller – the data subjects were required to provide personal data to the controller to fulfil obligations under labour law, social security law, and tax law and could not independently control the data. Consequently, the DPA considered the GDPR infringements to be of significant gravity. == Comment == ''Share your comments here!'' == Further Resources == ''Share blogs or news articles here!'' == English Machine Translation of the Decision == The decision below is a machine translation of the Polish original. Please refer to the Polish original for more details. The personal data concerned by the infringement of the provisions of Article 24(1), Article 25(1), Article 32(1) and (2) and Article 5(1)(f) and Article 5(2) of Regulation 2016\u002F679 do not belong to the special categories of personal data referred to in Article 9 of Regulation 2016\u002F679, or to the data listed in Article 10 of Regulation 2016\u002F679, but their wide scope (i.e. at least: first name and last name, parents’ first names, date of birth, bank account number, address of residence or stay, PESEL identification number, e-mail address, data concerning earnings, series and number of ID card, telephone number, image, data contained in passports, employment certificates, PCC-3 forms and personal questionnaires) is associated with a high risk of violation of the rights and freedoms of natural persons affected by the infringement. It should be emphasized in particular that the breach affected the PESEL identification number, the unauthorized disclosure of which (in combination with the name and surname) may have a real and negative impact on the protection of the rights and freedoms of an individual. The PESEL identification number, an eleven-digit numerical symbol that uniquely identifies an individual, containing, among other things, date of birth and gender, and therefore closely linked to the individual's private sphere and also subject, as a national identification number, to exceptional protection under Article 87 of Regulation 2016\u002F679, is data of a special nature and requires such special protection.","Poland's data protection authority (UODO) has fined an accounting and tax consulting company €2,760 for failing to implement adequate technical and organizational measures following a data breach. The breach involved unauthorized access to an employee's email account, exposing sensitive personal data of clients and their families. The DPA ruled that mere unauthorized access constitutes a data breach and that the company's security measures were insufficient, only being implemented after the breach was reported.","Poland's UODO fines accounting firm €2,760 for data breach due to inadequate security.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=UODO_(Poland)_-_DKN.5131.34.2023&diff=52008&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F7\u002F7b\u002FLogoPL.png","2026-06-29T12:50:21+00:00","2026-06-29T14:00:20.101066+00:00",7,[17],{"name":18,"type":19},"email","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":20,"icon":22,"name":23,"slug":24},null,"Policy","policy",[26,31,36,38],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":37},{"id":20,"icon":22,"name":23,"slug":24},{"category":39},{"id":40,"icon":22,"name":41,"slug":42},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[],{"controls":46,"vendors":120},[47,76,94],{"slug":48,"name":49,"problem":50,"products":51},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[52,60,68],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":56,"product_name":57,"url":58,"description":59},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"slug":77,"name":78,"problem":79,"products":80},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[81,86],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":82,"product_name":83,"url":84,"description":85},"intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":95,"name":96,"problem":97,"products":98},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[99,104,112],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":100,"product_name":101,"url":102,"description":103},"defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",[],{"slug":122,"title":123,"body":124,"framework_refs":125,"framework_notes":137},"polish-accounting-firm-fined-after-email-breach-exposes-client-data","Polish Accounting Firm Fined After Email Breach Exposes Client Data","An accounting and tax consulting firm in Poland was fined €2,760 by UODO after an unauthorized party gained access to an employee's email account, exposing sensitive personal data belonging to clients and their families. The core failure was the absence of adequate technical and organizational security measures — such as multi-factor authentication and proper access controls — prior to the breach occurring. Critically, the DPA ruled that the mere act of unauthorized access constitutes a reportable data breach, regardless of whether data was exfiltrated or misused. The company's reactive approach — only tightening security after the breach was reported — demonstrated a lack of proactive GDPR compliance. This case underscores that organizations handling sensitive financial and personal data have a legal obligation to implement proportionate safeguards before incidents occur, not in response to them.",[126,127,128,129,130,131,132,133,134,135,136],"GDPR Article 5(1)(f) — Integrity and confidentiality principle","GDPR Article 25 — Data protection by design and by default","GDPR Article 32 — Security of processing","GDPR Article 33 — Notification of a personal data breach to the supervisory authority","NIST SP 800-53 AC-2 — Account Management","NIST SP 800-53 IA-5 — Authenticator Management (MFA)","CIS Control 5 — Account Management","CIS Control 6 — Access Control Management","CIS Control 13 — Network Monitoring and Defense","ISO\u002FIEC 27001:2022 — A.5.15 Access Control","ISO\u002FIEC 27001:2022 — A.8.5 Secure Authentication",{}]