Former Employees Retain Data Access After Departure, Triggering GDPR Fine
Written by AI from the linked story. Not reviewed by an editor. How this works
A Polish sub-processor failed to revoke application access for former employees, allowing them to continue viewing customer personal data after their employment ended. This constitutes both an access control failure and a breach of GDPR Article 32, which mandates appropriate technical and organizational measures to protect personal data. Compounding the issue, the data controller failed to verify that the processor had adequate safeguards in place and did not establish sufficiently robust data protection agreements. This case illustrates that GDPR accountability extends across the entire processor chain — controllers cannot delegate responsibility without active oversight. Offboarding procedures and processor audits are not optional compliance niceties; they are legally required safeguards.
Tactical Insight
Immediate actions
- Audit all active application accounts and immediately revoke access for any former or inactive employees.
- Review all data processing agreements (DPAs) with sub-processors to ensure they meet GDPR Article 28 requirements.
Long-term improvements
- Integrate automated account deprovisioning into the HR offboarding workflow so access is revoked on the employee's last working day.
- Establish a formal processor compliance review program that includes periodic audits of sub-processors' technical and organizational measures.
- Implement role-based access control (RBAC) with least-privilege principles to minimize data exposure across all applications.
Detection & monitoring measures
- Deploy user activity monitoring on applications containing personal data to flag access by accounts that should no longer be active.
- Schedule quarterly access reviews to identify and remediate orphaned or excessive user accounts across all systems handling personal data.