# KEPIDES: Insufficient technical and organisational measures to ensure information security

- Type: Enforcement
- Source: Cypriot Data Protection Commissioner
- Date: 2021-03-03
- Original: https://www.enforcementtracker.com/ETid-580
- Canonical: https://overview.legal/posts/46695
- Topics: Anonymization, Controllers, Security, Personal Data, Processing Agreement, Supervisory Authorities, Data Controller, Law Enforcement

## Summary

The Cypriot DPA imposed a fine of EUR 6,000 against KEPIDES (real estate company). The controller had submitted a list of buyers of the properties it manages to a parliamentary committee. However, the controller had failed to anonymize the list, as a result of which the names of the data subjects were transmitted.

## Full text

The Cypriot DPA imposed a fine of EUR 6,000 against KEPIDES (real estate company). The controller had submitted a list of buyers of the properties it manages to a parliamentary committee. However, the controller had failed to anonymize the list, as a result of which the names of the data subjects were transmitted.

GDPR Articles: Art. 32 (4)
Industry: Real Estate

---
Generated by overview.legal · https://overview.legal/posts/46695 · 2026-08-22