[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fy2P2VyyJFHswYZBgnBwPAyBsf54kxMkoxVmTDgYNr70":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":134},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"5823d5fe-97ef-4ccc-9be6-56e02752cc27","UODO (Poland) - DKN.5131.7.2022","uodo-poland-dkn-5131-7-2022-f09db3","← Older revision Revision as of 17:23, 30 June 2026 Line 73: Line 73: }} }} The DPA fined a sub-processor €2,415 for failure to implement technical and organisational measures to guarantee the security of processing: former employees of the sub-processor still had access to customers’ personal data that was shared on an app. The DPA fined a sub-processor €2,415 for a failure to implement technical and organisational measures to guarantee the security of processing: former employees of the sub-processor still had access to customers’ personal data that was shared on an app. == English Summary == == English Summary ==","Poland's Data Protection Authority (UODO) fined a sub-processor €2,415 for failing to implement adequate technical and organizational measures to secure personal data. Former employees retained access to customer data shared via an app, constituting a data breach. The DPA also found the controller liable for not verifying processor compliance and for inadequate data protection agreements.","Poland's DPA fined a sub-processor €2,415 for data security failures.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=UODO_(Poland)_-_DKN.5131.7.2022&diff=52031&oldid=52014","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F7\u002F7b\u002FLogoPL.png","2026-06-30T17:23:10+00:00","2026-06-30T18:00:16.864748+00:00",7,[17],{"name":18,"type":19},"UODO","vendor","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":20,"icon":22,"name":23,"slug":24},null,"Policy","policy",[26,31,36,38],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":37},{"id":20,"icon":22,"name":23,"slug":24},{"category":39},{"id":40,"icon":22,"name":41,"slug":42},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18],{"controls":46,"vendors":133},[47,75,104],{"slug":48,"name":49,"problem":50,"products":51},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[52,59,67],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":48,"product_name":56,"url":57,"description":58},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"slug":76,"name":77,"problem":78,"products":79},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[80,88,96],{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"sailpoint","SailPoint","\u002Fvendor-logos\u002Fsailpoint.png","human-fabric","SailPoint Human Fabric","https:\u002F\u002Fwww.sailpoint.com\u002Fproducts\u002Fhuman-fabric","Identity governance platform, the successor to Identity Security Cloud: lifecycle management, access requests and continuous access reviews.",{"slug":105,"name":106,"problem":107,"products":108},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",[109,117,125],{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"upguard","UpGuard","\u002Fvendor-logos\u002Fupguard.png","upguard-vendor-risk","UpGuard Vendor Risk","https:\u002F\u002Fwww.upguard.com\u002Fproduct\u002Fvendor-risk","Supplier security questionnaires, ratings and continuous monitoring.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"onetrust","OneTrust","\u002Fvendor-logos\u002Fonetrust.png","third-party-management","OneTrust Third-Party Management","https:\u002F\u002Fwww.onetrust.com\u002Fsolutions\u002Fthird-party-management\u002F","Supplier inventory, risk assessments and monitoring across privacy and security.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"securityscorecard","SecurityScorecard","\u002Fvendor-logos\u002Fsecurityscorecard.png","security-ratings","SecurityScorecard Ratings","https:\u002F\u002Fsecurityscorecard.com\u002Fsolutions\u002Fuse-cases\u002Fsecurity-ratings\u002F","Outside-in security ratings and monitoring of suppliers.",[],{"slug":135,"title":136,"body":137,"framework_refs":138,"framework_notes":149},"former-employees-retain-data-access-after-departure-triggering-gdpr-fine","Former Employees Retain Data Access After Departure, Triggering GDPR Fine","A Polish sub-processor failed to revoke application access for former employees, allowing them to continue viewing customer personal data after their employment ended. This constitutes both an access control failure and a breach of GDPR Article 32, which mandates appropriate technical and organizational measures to protect personal data. Compounding the issue, the data controller failed to verify that the processor had adequate safeguards in place and did not establish sufficiently robust data protection agreements. This case illustrates that GDPR accountability extends across the entire processor chain — controllers cannot delegate responsibility without active oversight. Offboarding procedures and processor audits are not optional compliance niceties; they are legally required safeguards.",[139,140,141,142,143,144,145,146,147,148],"GDPR Article 5(1)(f) – Integrity and confidentiality principle","GDPR Article 28 – Processor obligations and data processing agreements","GDPR Article 32 – Security of processing","CIS Control 5 – Account Management","CIS Control 6 – Access Control Management","NIST SP 800-53 AC-2 – Account Management","NIST SP 800-53 PS-4 – Personnel Termination","NIST SP 800-53 CA-2 – Control Assessments (for processor audits)","ISO\u002FIEC 27001:2022 A.5.18 – Access rights","ISO\u002FIEC 27001:2022 A.6.5 – Responsibilities after termination or change of employment",{}]