[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fKWGtd8fqKxZfByvYMe9RMVmN4hv2qisBuC5FNTCVIWA":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":23,"status":24,"created_at":25,"published_at":26,"article":27,"tags":31,"podcasts":50,"controls":51},"25abe45a-1ce3-4a22-96cc-c853c88cd8db","slovenian-dpa-penalises-controller-for-breach-response-failures-and-poor-access-policy","2816da54-18ce-428d-a403-c293227ff6d1","Slovenian DPA Penalises Controller for Breach Response Failures and Poor Access Policy","The controller failed on two critical fronts: implementing an appropriate access policy that could have limited the breach's impact, and properly responding to data subjects' rights requests in the aftermath. Under GDPR, organisations are obligated not only to prevent breaches through sound access controls but also to transparently communicate with affected individuals when breaches do occur. Failing to confirm whether specific individuals' data was compromised directly undermines data subjects' rights to erasure and access. This case highlights that a data breach is not just a technical failure — it is also a test of an organisation's legal and procedural readiness to respond under the GDPR framework.","**Immediate actions:**\n- Audit and enforce least-privilege access policies across all systems holding personal data.\n- Establish a documented breach notification workflow that includes individual data subject communication procedures.\n\n**Incident response improvements:**\n- Create a dedicated process for identifying and cataloguing which specific individuals are affected during any data breach investigation.\n- Train incident response teams to handle data subject access and erasure requests that arise as a direct result of a breach.\n- Assign a responsible owner (e.g., DPO) to track and document all data subject rights requests during and after an incident.\n\n**Long-term compliance measures:**\n- Conduct regular GDPR readiness assessments covering both preventive controls and breach response obligations.\n- Maintain comprehensive records of processing activities (RoPA) to enable rapid identification of affected data subjects in a breach scenario.\n- Integrate data subject rights request handling into your incident response plan and test it through tabletop exercises.",[12,13,14,15,16,17,18,19,20,21,22],"GDPR Article 5(1)(f) – Integrity and confidentiality","GDPR Article 15 – Right of access by the data subject","GDPR Article 17 – Right to erasure","GDPR Article 33 – Notification of a personal data breach to the supervisory authority","GDPR Article 34 – Communication of a personal data breach to the data subject","NIST SP 800-53 AC-2 – Account Management","NIST SP 800-53 IR-6 – Incident Reporting","CIS Control 6 – Access Control Management","CIS Control 17 – Incident Response Management","ISO\u002FIEC 27001:2022 A.5.33 – Protection of records","ISO\u002FIEC 27001:2022 A.6.8 – Information security event reporting",{},"published","2026-06-30T14:20:41.044033+00:00","2026-06-30T14:20:40.746+00:00",{"id":7,"url":28,"slug":29,"title":30},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=IP_(Slovenia)_-_0612-91\u002F2025\u002F40&diff=52026&oldid=51985","ip-slovenia-0612-91-2025-40-5c2464","IP (Slovenia) - 0612-91\u002F2025\u002F40",[32,38,44],{"id":33,"name":34,"slug":35,"description":36,"color":37},"182e11d5-57c4-444e-8ec8-4682ad60261b","Incident Response","incident-response","Slow detection, poor containment, missing playbooks","#14b8a6",{"id":39,"name":40,"slug":41,"description":42,"color":43},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":45,"name":46,"slug":47,"description":48,"color":49},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",[],[52],{"slug":53,"name":54,"problem":55},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up."]