# Allium UPI: Insufficient technical and organisational measures to ensure information security

- Type: Enforcement
- Source: Estonian Data Protection Authority (AKI)
- Date: 2025-09-05
- Original: https://www.enforcementtracker.com/ETid-2858
- Canonical: https://overview.legal/posts/48973
- Topics: Data Breaches, Security, Controllers, Personal Data, Processing Agreement, Law Enforcement, Supervisory Authorities, Minors, Data Controller

## Summary

The Estonian DPA has imposed a fine of EUR 3,000,000 on Allium UPI. The controller failed to implement adequate technical and organisational measures to ensure data security. This resulted in a data breach involving the personal data of 750,000 individuals, including children and other vulnerable groups.

## Full text

The Estonian DPA has imposed a fine of EUR 3,000,000 on Allium UPI. The controller failed to implement adequate technical and organisational measures to ensure data security. This resulted in a data breach involving the personal data of 750,000 individuals, including children and other vulnerable groups.

GDPR Articles: Unknown
Industry: Industry and Commerce

---
Generated by overview.legal · https://overview.legal/posts/48973 · 2026-08-22