UODO (Poland) - DKN.5131.7.2022
Poland's DPA fined a sub-processor €2,415 for data security violations.
Poland's Data Protection Authority (UODO) fined a sub-processor €2,415 for failing to implement adequate technical and organizational measures. Former employees retained access to customer personal data shared via an app, violating GDPR principles of integrity, confidentiality, and accountability. The controller also received a reprimand for insufficient oversight of its processors.
AI summary of the linked source. Not reviewed by an editor. How this works
Run UODO?
Get an email when a new story names UODO, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe core failure in this case was the absence of a reliable offboarding process to revoke former employees' access to systems containing customer personal data. By allowing ex-staff to retain access through a shared application, the sub-processor directly violated GDPR principles of integrity, confidentiality, and accountability. This incident also highlights the controller's responsibility to actively oversee its processors — not merely sign data processing agreements and step back. Supply chain data governance is a two-way obligation: controllers must audit processor compliance, and processors must enforce internal controls rigorously. Regulators are increasingly holding the entire data processing chain accountable, meaning a weak link at the sub-processor level can trigger fines and reputational damage across the chain.
What helps against this
How we list vendors- Identity governance and single sign-on
People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.
- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.