News · GDPRhub EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

ANSPDCP (Romania) - Fine against MYCONNECTOR PLATFORM S.R.L

Personal Data Data Breaches Notification Obligation Identification Controllers
Oct 20, 2026 Source gdprhub.eu

Full text

Machine translation of the decision, via GDPRhub — not the official text.

A provider of a virtual, hybrid and in-person events platform was fined RON 31,451 (€6,000) under Article 32 GDPR after a cyberattack exposed personal data stored on a testing server, where real data had been used instead of mock data. English Summary. Facts. MyConnector Platform SRL (the controller) used real personal data in a testing environment while developing and testing its application. In this context, a cyberattack that targeted the controller’s testing server allowed an unauthorised third party to access that personal data, including contact and identification details of users. Following the incident, the controller notified the Romanian DPA of the personal data breach under Article 33 GDPR, which led the authority to launch an investigation. Holding. First, the Romanian DPA found that the controller infringed Article 32 GDPR#1b and Article 32 GDPR#2 by failing to implement appropriate technical and organisational measures to ensure the confidentiality and integrity of person

How it connects

Related across sources

C-340/21 VB v Natsionalna agentsia za prihodite C-340/21 (VB v Natsionalna agentsia) CJEU Dec 14, 2023 Data Breaches Integrity and Confidentiality Principle Notification Obligation
C-687/21 BL v MediaMarktSaturn Hagen-Iserlohn GmbH In Case C-687/21, the Court of Justice of the European Union interpreted Articles 5, 24, 32, and 82 of the GDPR in response to a preliminary ruling request from the Amtsgericht… CJEU ·Third Chamber Jan 25, 2024 Liability Integrity and Confidentiality Principle Personal Data
C-60/22 UZ v Bundesrepublik Deutschland In Case C-60/22, the CJEU (Fifth Chamber) ruled on a preliminary reference from the Verwaltungsgericht Wiesbaden concerning UZ, a third-country national, and the Bundesrepublik… CJEU ·Fifth Chamber May 4, 2023 Right to Restriction Controllers Personal Data
AEPD · PS-00028-2026 The DPA received a data breach notification from the Spanish Cycling Federation (the controller), after a technical error allowed a legitimate user to manipulate the browser URL… PS-00028-2026 ·Spain Oct 20, 2026 Controllers Identification Incident Response
Guidelines 9/2022 personal data breach notification under GDPR Guidelines ·EDPB Apr 4, 2023 Notification Obligation Data Breaches Personal Data
S 5 SF 65/24 DS SG Nürnberg: MOVEit zero-day cyberattack via processor did not breach Art. 32 GDPR The data subject (a child born in 2018), represented by her parents, was insured with the controller (a statutory health insurance provider) and participated in its digital bonus… Social Court Nuremberg Jun 10, 2026 Processors Controllers Integrity and Confidentiality Principle
Related documents