Former Employees Retain Data Access, Costing Polish Sub-Processor GDPR Fine
Written by AI from the linked story. Not reviewed by an editor. How this works
The core failure in this case was the absence of a reliable offboarding process to revoke former employees' access to systems containing customer personal data. By allowing ex-staff to retain access through a shared application, the sub-processor directly violated GDPR principles of integrity, confidentiality, and accountability. This incident also highlights the controller's responsibility to actively oversee its processors — not merely sign data processing agreements and step back. Supply chain data governance is a two-way obligation: controllers must audit processor compliance, and processors must enforce internal controls rigorously. Regulators are increasingly holding the entire data processing chain accountable, meaning a weak link at the sub-processor level can trigger fines and reputational damage across the chain.
Tactical Insight
Immediate actions
- Audit all active user accounts against current employee records and immediately revoke access for any former staff.
- Enforce a formal, documented offboarding checklist that includes same-day revocation of application and data system access.
Long-term improvements
- Implement automated identity lifecycle management (ILM) tools that deprovision access automatically upon HR system termination events.
- Establish contractual audit rights and periodic compliance reviews for all data processors and sub-processors.
- Apply the principle of least privilege so employees only ever access the minimum personal data required for their role.
Detection & oversight measures
- Schedule quarterly access reviews (access recertification) across all systems handling personal data.
- Require sub-processors to submit regular evidence of access control audits as part of ongoing controller oversight obligations.