# Housing association: Insufficient fulfilment of data breach notification obligations

- Type: Enforcement
- Source: Polish National Personal Data Protection Office (UODO)
- Date: 2023-02-07
- Original: https://www.enforcementtracker.com/ETid-1732
- Canonical: https://overview.legal/posts/47847
- Topics: Data Breaches, Notification Obligation, Article 19 GDPR - Notification of Rectification, Erasure or Restriction, Notified Body Reporting and Notification Obligations, Controllers, Processors, Processing Agreement, Law Enforcement, Supervisory Authorities, Personal Data

## Summary

The Polish DPA has imposed a fine of EUR 321 on a housing association. The controller had suffered a data breach involving the theft of documents, including a copy of a notarial deed. During its investigation, the DPA found that the controller had both failed to report the data breach to the DPA in a timely manner and to notify the data subjects affected by the incident. Further, the DPA found that the controller had not adequately checked if the processor provided sufficient guarantees to imple

## Full text

The Polish DPA has imposed a fine of EUR 321 on a housing association. The controller had suffered a data breach involving the theft of documents, including a copy of a notarial deed. During its investigation, the DPA found that the controller had both failed to report the data breach to the DPA in a timely manner and to notify the data subjects affected by the incident. Further, the DPA found that the controller had not adequately checked if the processor provided sufficient guarantees to implement appropriate technical and organisational measures to ensure data protection.

GDPR Articles: Art. 5 (1) a) GDPR, Art. 28 (1), (3), (9) GDPR, Art. 33 (1) GDPR, Art. 34 (1), (2) GDPR
Industry: Real Estate

---
Generated by overview.legal · https://overview.legal/posts/47847 · 2026-08-22