Enforcement · Polish National Personal Data Protection Office (UODO) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.
Housing association: Insufficient fulfilment of data breach notification obligations
The Polish DPA has imposed a fine of EUR 321 on a housing association.
Full text
The Polish DPA has imposed a fine of EUR 321 on a housing association. The controller had suffered a data breach involving the theft of documents, including a copy of a notarial deed. During its investigation, the DPA found that the controller had both failed to report the data breach to the DPA in a timely manner and to notify the data subjects affected by the incident. Further, the DPA found that the controller had not adequately checked if the processor provided sufficient guarantees to implement appropriate technical and organisational measures to ensure data protection.
Industry: Real Estate
How it connects
Related across sources
Guidelines 01/2021 Examples regarding Personal Data Breach Notification Guidelines ·EDPB Jan 3, 2022 Notification Obligation Data Breaches Personal Data
art 33 Notification of a personal data breach to the supervisory authority Apr 27, 2016 Data Breaches Notification Obligation Notified Body Reporting and Notification Obligations
Guidelines 10/2020 restrictions under Article 23 GDPR Guidelines ·EDPB Oct 13, 2021 GDPR Subject-Matter and Objectives Right to Restriction Data Portability
Opinion 14/2019 draft Standard Contractual Clauses submitted by the DK SA (Article 28(8) GDPR) Opinion ·EDPB Jul 12, 2019 International Transfer Controllers Processors
Opinion 28/2022 Europrivacy criteria of certification regarding their approval by the Board as European Data Protection Seal pursuant to Article 42.5 (GDPR) Opinion ·EDPB Oct 10, 2022 Certification Notified Body Reporting and Notification Obligations Accountability
14/2021 Cypriot court backs DPA fines of €40,000 each on football clubs and €25,000 on processor On 26 July 2021, a journalist informed the Cypriot DPA of a security vulnerability on an online platform. This online platform hosted ticket purchase sites of two Cypriot football… Administrative Court of Cyprus May 12, 2026 Controllers Processors Supervisory Authorities