Enforcement · Polish National Personal Data Protection Office (UODO) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Santander Bank Polska S. A.: Insufficient fulfilment of data breach notification obligations

€117,000 Fine
Santander Bank Polska S. A.
POLAND
Art. 34 GDPR
Data Breaches Notification Obligation Notified Body Reporting and Notification Obligations Article 19 GDPR - Notification of Rectification, Erasure or Restriction Integrity and Confidentiality Principle Insurance Processing Agreement Personal Data
Jan 19, 2022 Source

How it connects

Related across sources

Guidance Opinion 07/2025 regarding the European Commission Draft Implementing Decision pursuant to Regulation (EU) 2016/679 on the adequate protection of personal data by the European Patent Organisation EDPB Guidance Guidelines 01/2022 on data subject rights - Right of access EDPB Guidance EDPB Annual Report 2021 EDPB Guidance Guidelines 01/2021 EDPB Guidance Guidelines 10/2020 on restrictions under Article 23 GDPR EDPB Literature General Data Protection Regulation (GDPR) ambiguity, national diversity and data protection officer certification: Implementing Art. 39(1) GDPR in France, Italy, Luxembourg and Spain Journal of Data Protection Privacy

Full text

The Polish DPA has fined Santander Bank Polska S.A. EUR 118,000 for failing to notify data subjects of a data breach. A former employee of the bank managed to gain unauthorized access to a database for electronic services. Among other things, this allowed numerous Santander customers' data to be accessed. Due to the high risk for the data of the data subjects, the bank would have been obliged to inform them of the data breach. However, the bank deliberately refrained from doing so and continued to state that it would not comply with this obligation in the future. The DPA noted that this constituted a major intrusion for the data subjects, as they did not have the opportunity to take appropriate steps to protect their rights.

Industry: Finance, Insurance and Consulting

Original document at the source www.uodo.gov.pl

Similar Content