[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fiClL6PU25hhpxJaFvVVXa8sQWFA79gVgsR2jeia2_dY":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":21,"status":22,"created_at":23,"published_at":24,"article":25,"tags":29,"podcasts":48,"controls":49},"fa4c3eb5-1450-4704-8673-b355cccea539","polish-municipality-fined-for-failing-to-report-gdpr-data-breach","1d34f1f7-e9d9-47ef-9815-cee63898a2ef","Polish Municipality Fined for Failing to Report GDPR Data Breach","A Polish municipality inadvertently published personal data — including names and addresses — of petition signatories, constituting a clear personal data breach under GDPR. Rather than reporting the incident to the supervisory authority within the mandatory 72-hour window, the municipality chose not to notify UODO, incorrectly self-assessing the risk as low. GDPR Article 33 requires breach notification regardless of the organization's own risk perception, and this case demonstrates that subjective risk assessments do not override legal obligations. The relatively modest fine underscores that even smaller public bodies face regulatory consequences for procedural non-compliance. This case serves as a reminder that breach reporting obligations are non-negotiable and that internal risk minimization reasoning is not a valid substitute for regulatory notification.","**Immediate actions:**\n- Establish and document a GDPR breach response procedure that mandates supervisory authority notification within 72 hours of discovering any potential breach.\n- Assign a Data Protection Officer (DPO) or designated responsible person to make breach notification decisions, removing reliance on ad-hoc subjective risk judgments.\n\n**Long-term improvements:**\n- Conduct regular GDPR training for all staff involved in handling or publishing personal data, emphasizing mandatory reporting thresholds.\n- Implement a formal Data Breach Register to log all incidents — including near-misses — ensuring a consistent, auditable record for regulators.\n- Introduce a pre-publication review checklist requiring privacy impact checks before any document containing personal data is made publicly available.\n\n**Detection measures:**\n- Deploy automated scanning or content review tools on public-facing web portals to detect accidental exposure of personal data (e.g., names, addresses, national IDs).\n- Establish an internal incident triage process that triggers escalation to the DPO within 24 hours of any suspected data exposure event.",[12,13,14,15,16,17,18,19,20],"GDPR Article 33 – Notification of a personal data breach to the supervisory authority","GDPR Article 34 – Communication of a personal data breach to the data subject","GDPR Article 5(1)(f) – Integrity and confidentiality principle","NIST SP 800-61 Rev. 2 – Computer Security Incident Handling Guide","NIST Privacy Framework PR.PO-P1 – Policies and procedures for data handling","CIS Control 17 – Incident Response Management","CIS Control 3 – Data Protection","ISO\u002FIEC 27001:2022 Annex A 5.24 – Information security incident management planning and preparation","ITIL 4 – Incident Management Practice",{},"published","2026-06-16T19:22:51.07224+00:00","2026-06-16T19:22:50.95+00:00",{"id":7,"url":26,"slug":27,"title":28},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=UODO_(Poland)_-_DKN.5131.17.2025&diff=51876&oldid=0","uodo-poland-dkn-5131-17-2025-e7fd3f","UODO (Poland) - DKN.5131.17.2025",[30,36,42],{"id":31,"name":32,"slug":33,"description":34,"color":35},"182e11d5-57c4-444e-8ec8-4682ad60261b","Incident Response","incident-response","Slow detection, poor containment, missing playbooks","#14b8a6",{"id":37,"name":38,"slug":39,"description":40,"color":41},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":43,"name":44,"slug":45,"description":46,"color":47},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[50],{"slug":51,"name":52,"problem":53},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit."]