[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$faDg4tj1I7hMv7HAbPw0V0pf8gpmv6rVJPzrmIfO02JM":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":124},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"ab1bd0c9-00f5-42a9-80b1-354f3ee0f136","UODO (Poland) - DKN.5131.7.2022","uodo-poland-dkn-5131-7-2022-18d2eb","← Older revision Revision as of 08:56, 30 June 2026 Line 73: Line 73: }} }} The DPA fined a sub-processor €2,415 for failure to implement technical and organisational measures to guarantee the security of processing: former employees of the sub-processor still had access to customers’ personal data that was shared in an app. The DPA fined a sub-processor €2,415 for failure to implement technical and organisational measures to guarantee the security of processing: former employees of the sub-processor still had access to customers’ personal data that was shared on an app. == English Summary == == English Summary ==","Poland's Data Protection Authority (UODO) fined a sub-processor €2,415 for failing to implement adequate technical and organizational measures. Former employees retained access to customer personal data shared via an app, violating GDPR principles of integrity, confidentiality, and accountability. The controller also received a reprimand for insufficient oversight of its processors.","Poland's DPA fined a sub-processor €2,415 for data security violations.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=UODO_(Poland)_-_DKN.5131.7.2022&diff=52014&oldid=52004","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F7\u002F7b\u002FLogoPL.png","2026-06-30T08:56:25+00:00","2026-06-30T10:00:19.20701+00:00",7,[17],{"name":18,"type":19},"UODO","vendor","3f0f8451-91df-4b6c-9a73-ef3b2509b7f1",{"id":20,"icon":22,"name":23,"slug":24},null,"GDPR","gdpr",[26,31,33,38],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":32},{"id":20,"icon":22,"name":23,"slug":24},{"category":34},{"id":35,"icon":22,"name":36,"slug":37},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":39},{"id":40,"icon":22,"name":41,"slug":42},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",[],[18],{"controls":46,"vendors":123},[47,76,97],{"slug":48,"name":49,"problem":50,"products":51},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[52,60,68],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":56,"product_name":57,"url":58,"description":59},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"omada","Omada","\u002Fvendor-logos\u002Fomada.png","omada-identity-cloud","Omada Identity Cloud","https:\u002F\u002Fomadaidentity.com\u002Fproducts\u002Fomada-identity-cloud\u002F","Identity governance and administration delivered as a service.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"sailpoint","SailPoint","\u002Fvendor-logos\u002Fsailpoint.png","human-fabric","SailPoint Human Fabric","https:\u002F\u002Fwww.sailpoint.com\u002Fproducts\u002Fhuman-fabric","Identity governance platform, the successor to Identity Security Cloud: lifecycle management, access requests and continuous access reviews.",{"slug":77,"name":78,"problem":79,"products":80},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[81,89],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":98,"name":99,"problem":100,"products":101},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[102,110,115],{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":111,"product_name":112,"url":113,"description":114},"purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",[],{"slug":125,"title":126,"body":127,"framework_refs":128,"framework_notes":140},"former-employees-retain-data-access-costing-polish-sub-processor-gdpr-fine","Former Employees Retain Data Access, Costing Polish Sub-Processor GDPR Fine","The core failure in this case was the absence of a reliable offboarding process to revoke former employees' access to systems containing customer personal data. By allowing ex-staff to retain access through a shared application, the sub-processor directly violated GDPR principles of integrity, confidentiality, and accountability. This incident also highlights the controller's responsibility to actively oversee its processors — not merely sign data processing agreements and step back. Supply chain data governance is a two-way obligation: controllers must audit processor compliance, and processors must enforce internal controls rigorously. Regulators are increasingly holding the entire data processing chain accountable, meaning a weak link at the sub-processor level can trigger fines and reputational damage across the chain.",[129,130,131,132,133,134,135,136,137,138,139],"GDPR Article 5(1)(f) — Integrity and confidentiality principle","GDPR Article 24 — Responsibility of the controller","GDPR Article 28 — Processor obligations and controller oversight","GDPR Article 32 — Security of processing (technical and organisational measures)","CIS Control 5 — Account Management","CIS Control 6 — Access Control Management","NIST SP 800-53 AC-2 — Account Management","NIST SP 800-53 PS-4 — Personnel Termination","NIST SP 800-53 AC-6 — Least Privilege","ISO\u002FIEC 27001:2022 A.5.18 — Access rights","ITIL — Identity and Access Management Practice",{}]