UODO (Poland) - DKN.5131.7.2022
Poland's UODO reprimands controller and processors, fines sub-processor €2,415 for GDPR violations.
Poland's Data Protection Authority (UODO) has issued a reprimand to a data controller for violating GDPR principles of integrity, confidentiality, and accountability. The controller also failed to implement adequate technical and organizational measures and properly vet subprocessors. Additionally, two processors and a sub-processor were reprimanded for failing to implement appropriate security measures. The sub-processor was largely responsible for the data breach, having used an app to process personal data without authorization and failing to ensure continued access controls after employment termination. The sub-processor was fined €2,415.
AI summary of the linked source. Not reviewed by an editor. How this works
Run UODO?
Get an email when a new story names UODO, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA data breach occurred because a sub-processor used an unauthorized application to process personal data and failed to revoke access controls after an employee's termination — two fundamental security failures. The root data controller compounded the risk by not properly vetting or monitoring its subprocessors, violating GDPR principles of integrity, confidentiality, and accountability. This case illustrates how third-party and supply chain relationships can become the weakest link in a data protection chain. Organizations cannot outsource accountability: they remain legally responsible for ensuring that every processor and sub-processor in the chain applies adequate technical and organizational safeguards.
What helps against this
How we list vendors- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Identity governance and single sign-on
People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.
- Third-party risk management (TPRM)
You know which suppliers could hurt you, and you hear quickly when one of them is breached.