# Data Breaches — legal context bundle

> Curated from overview.legal on 2026-10-13. Canonical page: https://overview.legal/topics/data-breaches
> Sources are cited per item. Verify against the official texts before relying on them.

Security incidents involving unauthorized access to personal data

## Overview

## Legal Framework

The GDPR defines the concept of a personal data breach in [Article 4(12)](/laws/gdpr/art-4#par-12):

> "'personal data breach' means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;"
> — [GDPR Art. 4(12)](/laws/gdpr/art-4#par-12)

This definition is deliberately broad. It captures not only external cyberattacks but also accidental loss of devices, misdirected emails, and internal misconfigurations — any security failure affecting personal data, whether intentional or not.

Two articles govern the operational response. [Article 33](/laws/gdpr/art-33) imposes a dual notification duty: the controller must notify the competent supervisory authority, and the processor must notify the controller. The controller's notification to the authority must occur without undue delay and, where feasible, within 72 hours of becoming aware of the breach. If the 72-hour window is missed, the notification must include reasons for the delay. The notification must describe the nature of the breach, the likely consequences, and the measures taken or proposed. Where full information is not yet available, it may be provided in phases. [Article 33(5)](/laws/gdpr/art-33#par-5) additionally requires controllers to document all breaches — the facts, effects, and remedial actions — regardless of whether notification was required.

[Article 34](/laws/gdpr/art-34) creates a separate, higher threshold: where the breach is likely to result in a **high risk** to the rights and freedoms of natural persons, the controller must communicate directly to affected data subjects without undue delay. The communication must be in clear and plain language. Three exemptions exist: effective encryption rendering data unintelligible, subsequent measures eliminating the high risk, or disproportionate effort (in which case a public communication suffices).

## Key Developments

The Court of Justice has repeatedly confirmed the broad scope of the breach concept. In *TR v Land Hessen*, the Court recited the full Article 33 framework, underscoring that the 72-hour clock starts when the controller becomes aware of the breach — not when the incident is fully investigated.

> "Article 33 of that regulation provides: '1. In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority'"
> — [TR v Land Hessen ¶6](/posts/132245#seg-6)

Enforcement confirms that delayed or absent notifications attract sanctions. The Polish DPA fined WARTA S.A. approximately €18,930 after the insurer failed to report a breach — an agent had emailed an insurance policy to an unauthorized addressee — until administrative proceedings were already initiated:

> "Despite the letter requesting explanations, the controller did not report the data breach nor did it inform the data subjects about the incident."
> — [WARTA S.A. §2](/posts/46616#seg-2)

The Irish DPC, in the Permanent TSB decision, tied the "without undue delay" standard to the moment of awareness and referenced EDPB Guidelines 9/2022 for interpretive guidance on what constitutes undue delay in practice.

## Status of the Debate

This topic is **contested in court**. While the core notification architecture under Articles 33 and 34 is well established, several boundary questions remain actively litigated: what precisely triggers "awareness" for the 72-hour clock, how to calibrate the distinction between "risk" (Article 33 threshold) and "high risk" (Article 34 threshold), and whether particular technical measures — such as pseudonymisation without encryption — satisfy the Article 34(3)(a) exemption. Courts have not yet produced a definitive split, but the interpretive latitude in risk assessment means that supervisory authorities continue to diverge in enforcement intensity. Resolution will likely come through EDPB consistency opinions under [Article 70(1)(g)](/laws/gdpr/art-70#par-1-pnt-g), which tasks the Board with issuing guidance on breach determination and undue delay, or through preliminary references clarifying the risk thresholds.

## Practical Guidance

- **Establish an internal breach detection and reporting pipeline** so that "awareness" under [Article 33(1)](/laws/gdpr/art-33#par-1) is triggered promptly — the 72-hour clock starts when the controller has a reasonable degree of certainty that a breach has occurred, not when investigation concludes.
- **Implement a phased notification protocol**: initial notification within 72 hours with known facts, followed by supplementary information under [Article 33(4)](/laws/gdpr/art-33) as details emerge.
- **Conduct a documented risk assessment** for every breach to determine whether the Article 33 "risk" threshold is met (excusing authority notification) and whether the Article 34 "high risk" threshold triggers data-subject communication.
- **Apply encryption or equivalent technical measures** to personal data at rest and in transit — this is the most reliable path to the Article 34(3)(a) exemption from direct data-subject notification.
- **Maintain an internal breach register** per [Article 33(5)](/laws/gdpr/art-33#par-5) documenting facts, effects, and remedial actions for every incident, regardless of whether external notification was required — supervisory authorities will request it during audits.

## Legislation (full text of key provisions)

### Infringements entailing a personal data breach

*Source: NIS2, nis2-art-35-en, 2022-12-14 — https://overview.legal/posts/96467*

### Notification of a personal data breach to the supervisory authority

*Source: GDPR, gdpr-art-33-en, 2016-04-27 — https://overview.legal/posts/90633*

### Communication of a personal data breach to the data subject

*Source: GDPR, gdpr-art-34-en, 2016-04-27 — https://overview.legal/posts/90649*

### Definitions

*Source: ePrivacy Directive, eprivacy-art-2-en, 2002-07-12 — https://overview.legal/posts/132169*

DefinitionsSave as otherwise provided, the definitions in Directive 95/46/EC and in Directive 2002/21/EC of the European Parliament and of the Council of 7 March 2002 on a common regulatory framework for electronic communications networks and services (Framework Directive) ( 8 ) shall apply.The following definitions shall also apply:‘user’ means any natural person using a publicly available electronic communications service, for private or business purposes, without necessarily having subscribed to this service;‘traffic data’ means any data processed for the purpose of the conveyance of a communication on an electronic communications network or for the billing thereof; ▼M2 ‘location data’ means any data processed in an electronic communications network or by an electronic communications service, indicating the geographic position of the terminal equipment of a user of a publicly available electronic communications service; ▼B ‘communication’ means any information exchanged or conveyed between a finite number of parties by means of a publicly available electronic communications service. This does not include any information conveyed as part of a broadcasting service to the public over an electronic communications network except to the extent that the information can be related to the identifiable subscriber or user receiving the information; ▼M2 ————— ▼B ‘consent’ by a user or subscriber corresponds to the data subject's consent in Directive 95/46/EC;‘value added service’ means any service which requires the processing of traffic data or location data other than traffic data beyond what is necessary for the transmission of a communication or the billing thereof;‘electronic mail’ means any text, voice, sound or image message sent over a public communications network which can be stored in the network or in the recipient's terminal equipment until it is collected by the recipient; ▼M2 ‘personal data breach’ means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed in connection with the provision of a publicly available electronic communications service in the Community.

### Recital 86 — data breach notification to data subjects

*Source: GDPR, gdpr-rec-86-en, 2016-04-27 — https://overview.legal/posts/91687*

The controller should communicate to the data subject a personal data breach, without undue delay, where that personal data breach is likely to result in a high risk to the rights and freedoms of the natural person in order to allow him or her to take the necessary precautions. The communication should describe the nature of the personal data breach as well as recommendations for the natural person concerned to mitigate potential adverse effects. Such communications to data subjects should be made as soon as reasonably feasible and in close cooperation with the supervisory authority, respecting guidance provided by it or by other relevant authorities such as law-enforcement authorities. For example, the need to mitigate an immediate risk of damage would call for prompt communication with data subjects whereas the need to implement appropriate measures against continuing or similar personal data breaches may justify more time for communication.

### Recital 85 — personal data breach notification requirements

*Source: GDPR, gdpr-rec-85-en, 2016-04-27 — https://overview.legal/posts/91685*

A personal data breach may, if not addressed in an appropriate and timely manner, result in physical, material or non-material damage to natural persons such as loss of control over their personal data or limitation of their rights, discrimination, identity theft or fraud, financial loss, unauthorised reversal of pseudonymisation, damage to reputation, loss of confidentiality of personal data protected by professional secrecy or any other significant economic or social disadvantage to the natural person concerned. Therefore, as soon as the controller becomes aware that a personal data breach has occurred, the controller should notify the personal data breach to the supervisory authority without undue delay and, where feasible, not later than 72 hours after having become aware of it, unless the controller is able to demonstrate, in accordance with the accountability principle, that the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where such notification cannot be achieved within 72 hours, the reasons for the delay should accompany the notification and information may be provided in phases without undue further delay.

### Recital 88 — personal data breach notification rules

*Source: GDPR, gdpr-rec-88-en, 2016-04-27 — https://overview.legal/posts/91691*

In setting detailed rules concerning the format and procedures applicable to the notification of personal data breaches, due consideration should be given to the circumstances of that breach, including whether or not personal data had been protected by appropriate technical protection measures, effectively limiting the likelihood of identity fraud or other forms of misuse. Moreover, such rules and procedures should take into account the legitimate interests of law-enforcement authorities where early disclosure could unnecessarily hamper the investigation of the circumstances of a personal data breach.

### Recital 87 — personal data breach notification requirements

*Source: GDPR, gdpr-rec-87-en, 2016-04-27 — https://overview.legal/posts/91689*

It should be ascertained whether all appropriate technological protection and organisational measures have been implemented to establish immediately whether a personal data breach has taken place and to inform promptly the supervisory authority and the data subject. The fact that the notification was made without undue delay should be established taking into account in particular the nature and gravity of the personal data breach and its consequences and adverse effects for the data subject. Such notification may result in an intervention of the supervisory authority in accordance with its tasks and powers laid down in this Regulation.

### Recital 108 — cross authority cooperation on data breaches

*Source: NIS2, nis2-rec-108-en, 2022-12-14 — https://overview.legal/posts/96744*

Personal data are in many cases compromised as a result of incidents. In that context, the competent authorities should cooperate and exchange information about all relevant matters with the authorities referred to in Regulation (EU) 2016/679 and Directive 2002/58/EC.

### Recital 49 — network and information security processing

*Source: GDPR, gdpr-rec-49-en, 2016-04-27 — https://overview.legal/posts/91613*

The processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring network and information security, i.e. the ability of a network or an information system to resist, at a given level of confidence, accidental events or unlawful or malicious actions that compromise the availability, authenticity, integrity and confidentiality of stored or transmitted personal data, and the security of the related services offered by, or accessible via, those networks and systems, by public authorities, by computer emergency response teams (CERTs), computer security incident response teams (CSIRTs), by providers of electronic communications networks and services and by providers of security technologies and services, constitutes a legitimate interest of the data controller concerned. This could, for example, include preventing unauthorised access to electronic communications networks and malicious code distribution and stopping ‘denial of service’ attacks and damage to computer and electronic communication systems.

## Case law

### Cypriot court backs DPA fines of €40,000 each on football clubs and €25,000 on processor

*Source: Administrative Court of Cyprus, 2026-05-12 — https://overview.legal/posts/353978 — original: https://gdprhub.eu/index.php?title=ΔΔΚ_-_14/2021*

Facts — On 26 July 2021, a journalist informed the Cypriot DPA of a security vulnerability on an online platform. This online platform hosted ticket purchase sites of two Cypriot football clubs, OMONIA and APOEL (the controllers). This flaw in the system allowed a user to identify, through a reserved-seat icon, the name and ID number of the fan who had reserved the seat. By using that information, the user could then download the fan card, including the fan’s photograph. The DPA ordered the controllers to submit a personal data breach notification in accordance with Article 33 GDPR. In addition, it asked them to provide information on whether a penetration test had been carried out on the platform and to submit their contracts with the platform provider which acted as the processor of this data. Both controllers submitted the Personal Data Breach Notification Form and the requested documents. The DPA fined each controller €40.000 and the processor €25.000 for the violations of Article 24(1) GDPR, Article 25 GDPR and Article 32(1) GDPR. The controllers and the processor appealed the decision, mainly disputing their responsibility for the required security measures, their respective roles under the GDPR, and the proportionality of the fines. One of the controllers challenged only part of that fine. Holding — The court held that, by submitting the breach notification form, the controllers had accepted both that there had been a personal data breach under Article 33 GDPR and that they acted as controllers for the purposes of the GDPR. The court further held that the platform provider acted as a processor under the relevant contracts and was therefore bound by Articles 28 and 32 GDPR. The court upheld the DPA’s finding that the controllers and the processor had infringed the GDPR. It rejected one of the controllers’ arguments that it had no duty to carry out a penetration test before the platform was launched. The court held that Article 24 GDPR, Article 25 GDPR and Article 32 GDPR impose a continuing obligation on controllers and processors to ensure a level of security appropriate to the risk. Since Article 32 GDPR lists security measures only by way of example, their duties were not limited to the measures expressly mentioned in that provision. The court also held that the processor’s prior internal checks did not change the outcome, as the duty to implement appropriate security measures is ongoing. However, the court annulled the administrative fines, insofar as challenged, because their amount had not been determined in accordance with the principle of proportionality. In particular, the court noted that one controller had been fined €40,000 although the infringement affected 3,652 persons, while the other controller received the same fine despite the fact that only up to 100 persons were affected. By contrast, the processor, which was involved in both infringements, received a lower fine of €25,000. The court held that the DPA had failed to respect the principle of proportionality when imposing the fines, given that the underlying facts were essentially the same and that liability under the GDPR is shared between controllers and processors.

### VB v Natsionalna agentsia za prihodite

*Source: CJEU, C-340/21, 2023-12-14 — https://overview.legal/posts/51485 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0340*

Data breach alone does not establish inadequate security measures. Burden on controller to prove adequacy.

### Cyprus court upholds €5,000 DPA fine on Pancyprian Judo Federation for Article 31 GDPR

*Source: ADMINISTRATIVE COURT OF CYPRUS, 2026-05-20 — https://overview.legal/posts/353976 — original: https://gdprhub.eu/index.php?title=ΔΔΚ_-_1421/2022*

Facts — On 3 November 2021, a data subject filed a complaint with the Cypriot DPA against an individual who managed a club affiliated with the Pancyprian Judo Federation. The complaint concerned the unauthorised publication of photos and other material, including material depicting the data subject’s minor child, in the context of under-18 Pancyprian judo matches held under the federation’s auspices. It also referred to an earlier lawyer’s letter concerning an alleged personal data breach, which the federation had forwarded to its member clubs. On 13 December 2021, the DPA requested various information from the federation. The federation did not respond. The DPA then sent a reminder on 25 January 2022, but the federation again failed to respond. Subsequently, on 30 March 2022 the DPA issued a prima facie decision finding a breach of Article 31 GDPR due to the federation’s lack of cooperation and invited the federation to submit its position. The federation did not respond to this either. On 11 May 2022, the DPA issued the contested decision, finding that the federation had failed to cooperate with it despite repeated requests. It imposed a €5,000 fine for breach of Article 31 GDPR. The federation appealed against the decision, arguing that it was based on an incorrect application of the GDPR and contained legal and factual errors. Holding — The court noted that, for Article 31 GDPR, Article 58 GDPR and Article 83 GDPR to apply, the federation had to qualify as either a controller or a processor. The court found that the federation did not fall within the definition of processor under Article 4(8) GDPR. It noted that the DPA did not appear to have treated it as such. The court then examined whether the federation could be considered a controller under Article 4(7) GDPR. It held that the contested decision did not clearly explain why the DPA had classified the federation as a controller. The court inferred that the DPA may have reached this conclusion due the fact that the federation had forwarded to its member clubs a lawyer’s letter concerning an alleged personal data breach in the past. However, the court rejected this reasoning. It held that the federation had merely forwarded the letter and had not given any instructions regarding the purposes or means of processing personal data. The DPA had not investigated whether the federation, either alone or jointly with its members, determined the purposes or means of the processing. Nor could such involvement be presumed merely because the federation had registered member clubs. The court concluded that, since the federation did not qualify as either a controller or a processor, Article 31 GDPR, Article 58(2) GDPR and Article 83 GDPR did not apply. It annulled the contested decision and ordered the DPA to pay €2,000 plus VAT in costs to the federation.

### TR v Land Hessen

*Source: Court of Justice of the European Union, C-768/21, 2024-09-26 — https://overview.legal/posts/132245 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0768*

In Case C-768/21, the Court of Justice of the European Union (First Chamber) ruled on a preliminary reference from the Verwaltungsgericht Wiesbaden concerning TR's challenge of the Hessischer Beauftragte für Datenschutz und Informationsfreiheit (HBDI) for declining to exercise corrective powers against Sparkasse X following a personal data breach complaint. The Court clarified the limits of supervisory authorities' discretion under GDPR Articles 57(1) and 58(2), holding that while authorities retain discretion in selecting corrective measures, they are legally obliged to exercise those powers when an infringement is established, and complainants have a right to an effective remedy under Article 77 even where no enforcement action was taken. No fine was imposed in this proceeding, as the ruling addressed the supervisory authority's enforcement obligations rather than penalizing a controller.

### Digi Távközlési és Szolgáltató Kft. v Nemzeti Adatvédelmi és Információszabadság Hatóság

*Source: Court of Justice of the European Union, C-77/21, 2022-10-20 — https://overview.legal/posts/132306 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0077*

In this preliminary ruling, the CJEU interpreted Articles 5(1)(b) and 5(1)(e) GDPR in proceedings between Digi Távközlési és Szolgáltató Kft. and the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) concerning a personal data breach. The Court held that creating a new database from an existing one for testing and error-correction purposes constitutes further processing requiring compatibility assessment under the purpose limitation principle, and that the storage limitation principle applies such that data must be deleted once the testing purpose is fulfilled. No fine was imposed at the EU level, as the matter was remitted to the referring Hungarian court.

### JU and SO v Scalable Capital GmbH

*Source: Court of Justice of the European Union, C-182/22, 2024-06-20 — https://overview.legal/posts/132254 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0182*

In Joined Cases C-182/22 and C-189/22, the Court of Justice of the European Union (Third Chamber) ruled on a preliminary reference from the Amtsgericht München concerning the interpretation of Article 82 GDPR in proceedings brought by data subjects JU and SO against Scalable Capital GmbH following the theft of their personal data from the company's trading application. The core issue was whether Article 82 GDPR permits compensation for non-material damage that is minimal or symbolic, and whether such compensation can serve a punitive function. The Court held that Article 82 GDPR does not preclude the awarding of minimal compensation for non-material damage, such as distress following a personal data breach, provided the damage is genuine and actually arose from the infringement, but clarified that compensation under the GDPR must be purely reparative and cannot have a punitive character.

### SG Nürnberg: MOVEit zero-day cyberattack via processor did not breach Art. 32 GDPR

*Source: Social Court Nuremberg, 2026-06-10 — https://overview.legal/posts/122874 — original: https://gdprhub.eu/index.php?title=SG_Nürnberg_-_S_5_SF_65/24_DS*

Facts — The data subject (a child born in 2018), represented by her parents, was insured with the controller (a statutory health insurance provider) and participated in its digital bonus programme. The bonus programme was managed via an app. To handle the information technology operations of this programme, the controller hired the processor (an IT service provider), establishing a data processing agreement under Article 28 GDPR alongside specific information security guidelines. To provide these services, the processor utilised "MOVEit Transfer," a market-leading file transfer software developed by Progress Software Corp. On 31 May 2023, the software developer publicly announced a critical, previously unknown "zero-day" vulnerability in the software (later assigned CVE-2023-34362). At that exact moment, no security patch was available. On the very same day, 31 May 2023, the processor – alongside thousands of other companies worldwide – became the victim of a global cyberattack carried out by the hacker group "Clop." The hackers exploited this zero-day vulnerability to install a "web-shell" backdoor (typically named human2.aspx), bypassing authentication to exfiltrate database records. The compromised data included the data subject's first and last name, health insurance number, bonus points balance, and a bank account number (IBAN) belonging to her mother. No medical, health, or social security data was exfiltrated. On 1 June 2023, the developer released a security patch, which the processor installed immediately. On 2 June 2023, the German Federal Office for Information Security (BSI) issued a formal IT security warning (No. 2023-240133-1100, Version 1.1). The BSI classified the IT threat level as "3 / Orange" (business-critical), confirming active exploitation with data exfiltration. The BSI recommended immediately blocking all HTTP and HTTPS traffic to MOVEit environments, checking for specific Indicators of Compromise (IoCs) in the web server directories, and applying the newly released patch before reconnecting systems to the network. On 16 June 2023, the processor informed the controller about the incident. On 17 June 2023, the controller issued a public press release confirming that its external service provider for the bonus programme had been targeted on 31 May 2023. The release stated that the security vulnerability had been closed, that there was never any connection to the controller's internal IT systems, and that relevant supervisory authorities had been notified. The controller subsequently notified the data subject's parents. On 27 March 2024, the data subject, via legal counsel, sent a formal warning letter to the controller demanding an injunction, a declaration of liability for all potential future damages, and non-material damages of at least €3,000. Following the controller's refusal, the data subject filed a lawsuit with the Nuremberg Social Court (Sozialgericht Nürnberg), later expanding the claim to the processor as a joint defendant. Holding — The Court dismissed the lawsuit as partly inadmissible and otherwise unfounded, establishing the following legal principles: First, the Court held that a successful third-party cyberattack does not establish an irrebuttable presumption that a controller or processor failed to implement appropriate security measures under Article 32(1) GDPR and Article 5(1)(f) GDPR. To escape liability under Article 82(3) GDPR, an operator must prove they implemented robust baseline security controls (such as multi-factor authentication, encryption, and lockout policies) and applied a security patch immediately upon its release by the vendor, even if this occurred before formal alerts were issued by national IT security authorities. Second, the Court held that a claim for non-material damages under Article 82(1) GDPR based on the fear or distress of future data misuse cannot be established if the data subject is a minor who has no subjective knowledge or cognitive awareness of the data breach. Furthermore, if the compromised financial data (such as an IBAN) does not belong to the data subject personally, there is no direct risk of financial harm to them, rendering the alleged fear of financial damage unfounded. Third, the Court held that an injunction claim is inadmissible due to a lack of specificity if it merely demands that a controller stop making personal data accessible to third parties without implementing "state-of-the-art" security measures, without specifying the concrete technical or organisational measures the controller is required to take. Fourth, the Court held that a declaratory claim for potential future material damages is inadmissible under national procedural law (§ 55(1) SGG) if there is no realistic probability of future financial harm, particularly because the compromised bank account belonged to a third party (the mother) and the software vulnerability was immediately patched.

### US Split - Us I-2709/2025-11

*Source: Administrative court Split, 2026-05-05 — https://overview.legal/posts/593256 — original: https://gdprhub.eu/index.php?title=US_Split_-_Us_I-2709/2025-11*

Facts — INA, a petrol station chain in Croatia, appealed, AZOP's, the DPA's, €5000 fine. The fine was based on AZOP's decision that INA, as a controller, did not take all necessary measures to prevent unauthorised access and visibility of the real-time CCTV feeds to all customers. INA disputed this decision, claiming legitimate grounds for such data processing, stressing that projecting real-time CCTV feeds in petrol station shops to customers is an accepted and normal practice in the industry and by the consumers themselves. Holding — The Court upheld the DPA's decision regardless, on two crucial grounds: the lack of compliance with the cumulative requirements to fulfil Art 6 GDPR and Art 32 (1 and 2) GDPR. Firstly, the Court sided with the DPA, stating INA, did not meet two of the three cumulative conditions, in depicting a legitimate interest for the purpose of ensuring a timely response by employees and deterring perpetrators of criminal and infringing acts. Therefore, the Court accepted the reasoning that, the requirement of necessity is not met, as the timely reaction by employees and a rapid response in the event of a harmful incident, can be achieved even without customers having real-time access to the video surveillance system. As Art 6(1)(f) prescribes that three conditions must be met cumulatively for the data controller to be able to demonstrate its legitimate interest for a lawful basis, the prescribed conditions are not cumulatively met. Secondly, the Court highlights that the screen's placement in the premises of the retail shop of the petrol station itself, with clear visibility for all, is contrary to Art 32(1) and (2) GDPR. The Court stresses INA failed to take necessary protection measures in accordance with existing and foreseeable risks of unauthorized disclosure of personal data. This becomes especially relevant, as the the controller allows customers, as unauthorised persons, access to the live feed in real time, exposing the personal data to risks such as copying, recording, or other unauthorised use of the video surveillance footage, or the sharing of such footage with third parties in any way.

### BL v MediaMarktSaturn Hagen-Iserlohn GmbH

*Source: Court of Justice of the European Union, C-687/21, 2024-01-25 — https://overview.legal/posts/132272 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0687*

In Case C-687/21, the Court of Justice of the European Union interpreted Articles 5, 24, 32, and 82 of the GDPR in response to a preliminary ruling request from the Amtsgericht Hagen in proceedings between data subject BL and MediaMarktSaturn Hagen-Iserlohn GmbH concerning alleged non-material damage from personal data transmitted to an unauthorized third party due to employee error. The Court held that a controller's infringement of GDPR security obligations through employee error can give rise to a right to compensation under Article 82, that the severity of the infringement may be relevant to assessing both the appropriateness of protective measures and the existence of damage, and that the concept of non-material damage should be interpreted broadly without requiring a minimum threshold of severity. No fine was imposed, as the ruling addresses interpretation of GDPR provisions rather than administrative penalties.

### A v Patērētāju tiesību aizsardzības centrs

*Source: Court of Justice of the European Union, C-507/23, 2024-10-04 — https://overview.legal/posts/132162 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0507*

The Court of Justice of the European Union issued a preliminary ruling on a reference from the Latvian Supreme Court in Case C-507/23, involving an individual ("A") and the Patērētāju tiesību aizsardzības centrs (Consumer Rights Protection Centre, Latvia) regarding compensation for non-material damage allegedly suffered from unlawful processing of personal data under Article 82(1) GDPR. The Court addressed whether apologies can constitute compensation for non-material damage and whether the controller's attitude and motivation may be considered in assessing the form and level of compensation. No fine was imposed, as the ruling clarifies interpretive questions of EU law for the referring national court.

### CJEU - C‑313/23, C‑316/23 and C‑332/23 - Inspektorat kam Visshia sadeben savet

*Source: Court of Justice of the European Union, 2025-04-30 — https://overview.legal/posts/158459 — original: https://gdprhub.eu/index.php?title=CJEU_-_C‑313/23,_C‑316/23_and_C‑332/23_-_Inspektorat_kam_Visshia_sadeben_savet*

Facts — Following the expiration of the prescribed time limit for submission of annual declarations of assets of judges, public prosecutors and investigating magistrates and their families, the Inspectorate at the Bulgarian Supreme Judicial Council requested the Sofia District Court to lift the banking secrecy of several judges and public prosecutors, as well as their families. The Inspectorate is comprised of an Inspector General and a panel of ten Inspectors. At the time, the terms of office of the Inspectorate members had been expired for two years and there was no provision in national law limiting the permissible extent of the extention of their duties . The referring Court was unsure as to whether the continuation of the performance of their duties by the Inspectorate past the expiry of their term undermines the independence of the Office under EU law and unsure as to the interplay between the provisions in the Bulgarian Constitution and the GDPR, and referred the following questions: (1) Must the second subparagraph of Article 19(1) TEU, read in conjunction with the second paragraph of Article 47 of [the Charter], be interpreted as meaning that it is per se or under certain conditions an infringement of the obligation incumbent on Member States to provide effective remedies sufficient to ensure independent judicial review for the functions of an authority which can impose disciplinary penalties on judges and has powers to collect data relating to their assets and liabilities to be indefinitely extended after the constitutionally stipulated term of office of that body comes to an end? If such an extension is permissible, under what conditions is that the case? (2) Must Article 2(2)(a) of [the GDPR] be interpreted as meaning that the disclosure of data covered by banking secrecy for the purposes of verifying assets and liabilities of judges and public prosecutors which are subsequently made public constitutes an activity which falls outside the scope of [EU] law? Is the answer different where that activity also includes the disclosure of data relating to family members of those judges and public prosecutors who are not judges or public prosecutors themselves? (3) If the answer to the second question is that [EU] law is applicable, must Article 4(7) of [the GDPR] be interpreted as meaning that a judicial authority which allows another State authority to access data concerning the account balances of judges and public prosecutors and their family members determines the purposes or means of the processing of personal data and is therefore a “controller” for the purposes of the processing of personal data? (4) If the answer to the second question is that [EU] law is applicable and the third question is answered in the negative, must Article 51 of [the GDPR] be interpreted as meaning that a judicial authority which allows another State authority to access data concerning the account balances of judges and public prosecutors and their family members is responsible for monitoring the application of that regulation and must therefore be classified as a “supervisory authority” in relation to those data? (5) If the answer to the second question is that [EU] law is applicable and either the third or the fourth questions are answered in the affirmative, must Article 32(1)(b) of [the GDPR] and Article 57(1)(a) of that regulation be interpreted as meaning that a judicial authority which allows another State authority to access data concerning the account balances of judges and public prosecutors and their families, is obliged, in the presence of [information] concerning a personal data breach committed in the past by the authority to which such access is to be granted, to obtain information on the data protection measures taken and to take into account the appropriateness of those measures in its decision to permit access? (6) If the answer to the second question is that [EU] law is applicable, and irrespective of the answers to the third and fourth questions, must Article 79(1) of [the GDPR], read in conjunction with Article 47 of [the Charter], be interpreted as meaning that, where the national law of a Member State provides that certain categories of data may be disclosed only after permission to do so has been granted by a court, the court so competent must of its own motion grant legal protection to the persons whose data are to be disclosed, by requiring the authority which has applied for access to the data in question and which is known to have committed a personal data breach in the past to provide information on the measures taken pursuant to Article 33(3)(d) of [the GDPR] and their effective application? Holding — Question 1: The Court ruled that that Article 19(1) TEU, read in light of Article 47 of the Charter must be interpreted as meaning that the principle of judicial independence precludes a Member State’s allowing the office holders of judicial body authorised to scrutinize the activities of judges, magistrates and public prosecutors to continue to perform their functions beyond their term where such extension does not have an explicit basis in national law which governs the exercise of such authority and where the extension is not limited in time. Question 2: The Court held that Article 2 of the GDPR must be interpreted as meaning that disclosures to judicial bodies of personal data concerning judges, public prosecutors and investigating magistrates, as well as their family members, with the view of verifying submitted declarations and are published constitutes processing within the material scope of the GDPR. The Court noted that it had previously found (Commission v Poland C-204/21) that neither the fact that information which is the subject of national provisions relates to judges nor the fact that information might have certain links with the performance of their duties is, in itself, sufficient to remove those national provisions from the scope of the GDPR. Although the proper administration of justice and rules relating to the performance and conduct of judges come within the competence of Member States, the processing in question does not fall within that category, nor is it an activity intended to safeguard national security, the Court found. Accordingly, the Court held that the processing in question comes under the material scope of the GDPR. Question 3: The Court held that Article 4(7) of the GDPR must be interpreted as meaning that a court competent to authorise disclosure by a bank to a judicial authority data relating to the bank accounts of judges, public prosecutors and magistrates, and their family members, cannot be classified as a controller under that provision. The Court reasoned that the national legislation determines the scope of such processing, the purpose of the processing and designates the body which is competent to carry it out. The national court, the Court found, confines itself to considering whether the conditions laid down in the national law are met. As such, the Court concluded that the national court determines neither the purposes nor the means and thus cannot be regarded as the controller under the GDPR. It is the designated body, in this case the Inspectorate, which is the controller. Question 4 The Court held that Article 51 of the GDPR must be interpreted as meaning that a court competent to authorise disclosure of personal data to another judicial body does not constitute a supervisory authority in the meaning of that provision. The Court reasoned that the national court has not been designated under Bulgarian law as a supervisory authority, as envisaged in Article 51(1) GDPR. Member States are also obliged to notify the Commission of such provisions adopted or amended pursuant to Chapter VI GDPR. No such notification had been made as to the designation of the national court as supervisory authority. Question 5: As the Court answered both questions 2 & 3 in the negative, no response to question 5 was necessary. Question 6: The Court held that Article 79(1) GDPR, read in light of Article 47 of the Charter, must be interpreted as meaning that a court competent to authorise disclosure of personal data to another judicial body is not required to ensure, of its own volition, the security of the personal data to be disclosed in accordance with the GDPR. This is the case even where the receiving body has, in the past, infringed those provisions of the GDPR. In reaching this conclusion, the Court highlighted the difference between supervisory authorities and their powers under the GDPR and the position of national courts. The Court also highlighted that it is the obligation of the Member State to ensure that practical arrangements have been made for the exercise of the remedies in Articles 77(1), 78(1) & 79(1).

### GP v juris GmbH

*Source: Court of Justice of the European Union, C-741/21, 2024-04-11 — https://overview.legal/posts/132262 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0741*

In Case C-741/21, the Court of Justice of the European Union (Third Chamber) addressed a preliminary reference from the Landgericht Saarbrücken in proceedings between data subject GP and juris GmbH concerning GP's claim for compensation under Article 82 GDPR after the company processed his personal data for marketing purposes despite his objections. The Court held that "non-material damage" under Article 82(1) GDPR must be interpreted broadly and is not subject to a seriousness threshold, that a controller may be exempt from liability under Article 82(3) if it proves it was not in any way responsible for the infringement (including where a person acting under its authority under Article 29 was at fault), and that the criteria for administrative fines under Article 83 GDPR do not apply to the assessment of compensation amounts.

## Guidance

### Guidelines 9/2022 on personal data breach notification under GDPR

*Source: EDPB, edpb-guidelines-on-personal-data-breach-notification-under-gdpr, 2023-04-04 — https://overview.legal/posts/38058 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-92022-on-personal-data-breach-notification-under-gdpr_en*

The EDPB adopted Guidelines 9/2022 (Version 2.0, 28 March 2023) to update and replace the prior WP250 guidance on personal data breach notification under Articles 33 and 34 of the GDPR. The guidelines address the definition and types of personal data breaches, controller and processor notification obligations, the concept of a controller becoming "aware" of a breach, cross-border and non-EU establishment breach scenarios, and the conditions under which notification to supervisory authorities and data subjects is or is not required.

### Guidelines 01/2021 on Examples regarding Personal Data Breach Notification

*Source: EDPB, edpb-guidelines-on-examples-regarding-personal-data-breach-notification, 2022-01-03 — https://overview.legal/posts/38047 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-012021-on-examples-regarding-personal-data-breach-notification_en*

The European Data Protection Board (EDPB) adopted Guidelines 01/2021 on December 14, 2021, providing practical examples and analysis regarding personal data breach notification obligations under Articles 33 and 34 of the GDPR. The guidelines present hypothetical scenarios covering ransomware attacks and data exfiltration incidents, illustrating how controllers should assess risk to determine whether notification to supervisory authorities and communication to data subjects are required. The document serves as interpretive guidance for controllers evaluating breach severity, appropriate mitigation measures, and notification decisions, and does not impose any fines or sanctions.

### Guidelines on Personal data breach notification under Regulation 2016/679, WP250 rev.01

*Source: EDPB, guidelines-on-personal-data-breach-notification-under-regulation-2016679-wp250-en, 2018-05-25 — https://overview.legal/posts/126319 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-on-personal-data-breach-notification-under-regulation-2016679-wp250_en*

Уведомления относно нарушение на сигурността на личните данни Насока 25 May 2018 Уведомления относно нарушение на сигурността на личните данни Related documents Всички

### EDPB-EDPS Joint opinion 2/2026 on the Proposal for a Regulation as regards the simplification of the digital legislative framework (

*Source: EDPB, edpb-edps-joint-opinion-22026-proposal-en, 2026-02-11 — https://overview.legal/posts/53739 — original: https://www.edpb.europa.eu/our-work-tools/our-documents/edpbedps-joint-opinion/edpb-edps-joint-opinion-22026-proposal_en*

EDPB, EDPB-EDPS Joint opinion 2/2026 on the Proposal for a Regulation as regards the simplification of the digital legislative framework (Digital Omnibus)

### Opinion 2/2026 on the Proposal for a Directive amending Directives (EU) 2016/2341 and 2016/97 as regards the strengthening of the framework for occupational retirement provision

*Source: EDPS, 2026-01-09-opinion-22026-directive-amending-directives-eu-20162341-and-201697-regards-strengthening-, 2026-02-11 — https://overview.legal/posts/51418 — original: https://www.edps.europa.eu/data-protection/our-work/publications/opinions/2026-01-09-opinion-22026-directive-amending-directives-eu-20162341-and-201697-regards-strengthening-framework-occupational-retirement-provision_en*

EDPB - EDPS JOINT OPINION 2 /2026 On the Proposal for a Regulation as regards the simplification of the digital legislative framework (Digital Omnibus) Adopted on 1 0 February 2026 2 4 Executive summary On 19 November 2025, the European Commission (the ‘Commission’) issued a Digital Omnibus p roposal 1 amending a large corpus of the EU digital legislation, including the GDPR, the Single Digital Gateway Regulation, the EUDPR, the Data Act, the ePrivacy Directive, the Cybersecurity Directive, NIS…

### Opinion 14/2019 on the draft Standard Contractual Clauses submitted by the DK SA (Article 28(8) GDPR)

*Source: EDPB, opinion-142019-on-the-draft-standard-contractual-clauses-en, 2019-07-12 — https://overview.legal/posts/126212 — original: https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-142019-on-the-draft-standard-contractual-clauses_en*

Adopted 1 Opinion 14/2019 on the draft Standard Contractual Clauses sub mitted by the DK SA (Article 28( 8 ) GDPR) Adopted on 9 July 2019 Adopted 2 1 CONTENTS 2 Summary of the Facts ................................ ................................ ................................ .................... 4 3 Assessment ................................ ................................ ................................ ................................ .... 5 3.1 General reasoning of the Board…

### Art. 29 WP Guidelines on GDPR transparency requirements (WP260 rev.01)

*Source: EDPB, edpb-guidelines-on-transparency, 2018-04-11 — https://overview.legal/posts/38076 — original: https://www.edpb.europa.eu/system/files/2023-09/wp260rev01_en.pdf*

The Article 29 Data Protection Working Party issued these guidelines (WP260 rev.01), adopted on 29 November 2017 and last revised on 11 April 2018, to provide interpretive and practical guidance on the transparency requirements under the GDPR (Articles 12–14). The document addresses the form, timing, content, and modalities of information provided to data subjects, including issues such as plain language, layered privacy notices, information for children, and exceptions to the obligation to provide information. No fines or enforcement actions are imposed, as this is a guidance document rather than an enforcement decision.

### EDPB- EDPS Joint Opinion 01/2025 on the Proposal for a Regulation on simplification measures for SMEs and SMCs, in particular the record-keeping obligation under Art. 30(5) GDPR

*Source: EDPB, edpb-edps-jointopinion-202501-proposalsimplification-en, 2025-07-09 — https://overview.legal/posts/50980 — original: https://www.edpb.europa.eu/documents/legislative-opinion/edpb-edps-joint-opinion-012025-on-the-proposal-for-a-regulation-on_en*

De EDPB en EDPS steunen het doel om de administratieve lasten voor SMCs en MKB te verminderen, mits dit de bescherming van fundamentele rechten niet verlaagt. Ze benadrukken de noodzaak van een evenwichtige en proportionele aanpak en vragen om verduidelijking van de nieuwe drempel van 750 werknem...

## Enforcement decisions

### HDPA: Hellenic Open University found to have met breach notification duties after

*Source: HDPA (Greece), 2026-08-19 — https://overview.legal/posts/291288 — original: https://gdprhub.eu/index.php?title=HDPA_(Greece)_-_14/2026*

Facts — The Hellenic Open University (‘the controller’) submitted initial and supplementary notifications to the DPA after it was subject to a data breach resulting from a ransomware attack. The breach affected the personal data of 30,000 individuals in the controller’s information system and involved a leak of 813 GB of personal data that was later posted on the dark web but with restricted access as to its content. After respective requests and instructions by the DPA, the controller communicated the data breach to the affected individuals in accordance with Article 34 GDPR since the DPA considered a public notice insufficient. The controller also provided the DPA with further information, amongst others, regarding the nature of the breach and personal data affected. The controller took measures to prevent successful installation of malware in the future and to prevent future incidents and take measures to mitigate damage to affected parties, in accordance with Article 33 GDPR. Holding — The DPA held that the controller complied with its notification obligations under Article 33 and Article 34 GDPR, despite the initial notification being supplemented at a later time. Regarding the controller’s compliance with Article 32 GDPR (i.e. the obligation to implement adequate security measures), the DPA held that the cause of the incident was a human error, which could have been prevented through targeted training and improved authentication measures with individuals which have access to the system administration. In accordance with Article 58(2)(d) GDPR, the DPA ordered the controller to implement targeted training plans for system administrators and to fully implement the security measures mentioned above, within 6 months of this decision and to inform the DPA of such.

### VDAI fines medical company €450,000 for inadequate security measures in data breaches

*Source: VDAI (Lithuania), 2026-06-19 — https://overview.legal/posts/53896 — original: https://gdprhub.eu/index.php?title=VDAI_(Lithuania)_-_3R-1143*

Facts — Two medical companies (the controllers) had fallen victim to data breaches where a third party had gained access to their internal systems containing both health data and other personal data of patients (the data subjects). The first breach potentially concerned 63 data subjects, whereas the latter breach affected approximately 10,000 employees and 383,000 data subjects. The DPA initiated two separate investigations against the controllers in September 2024 and November 2025 respectively and later combined the cases. Holding — The DPA imposed a fine of €450,000 on the first controller it investigated as this company was also the legal successor of the other controller. It held that the controllers had failed to implement appropriate technical and organisational measures to ensure the security of processing and compliance with the principles of integrity and confidentiality. The controller had violated Articles 5(1)(f), 24(1), and 32(1)(b) GDPR. When assessing the GDPR infringements, the DPA took into account that the controllers processed sensitive categories of personal data. The DPA held the controllers lacked adequate security measures for protecting against unauthorised access to an IT system, such as access control and authentication. For instance, passwords used by employees did not reach a certain level of complexity, and multi-factor authentication was not used.

### Fundację Promocji Mediacji i Edukacji Prawnej Lex Nostra: Insufficient fulfilment of data breach notification obligations

*Source: Polish National Personal Data Protection Office (UODO), 2021-06-30 — https://overview.legal/posts/46884 — original: https://www.enforcementtracker.com/ETid-769*

The Polish DPA (UODO) has imposed a fine of EUR 3,000 on the Fundację Promocji Mediacji i Edukacji Prawnej Lex Nostra Foundation for the promotion of mediation and legal education. The controller had not immediately informed the DPA and the data subjects about a personal data breach. Several folders containing personal data had been stolen from the controller in early 2020. These included the names, addresses and telephone numbers, and in 3 to 4 cases also the PESEL numbers (Polish identificatio

### Slovenian DPA: Controller breached Art. 32, 15 and 34 GDPR over data breach and access

*Source: IP (Slovenia), 2026-03-04 — https://overview.legal/posts/354301 — original: https://gdprhub.eu/index.php?title=IP_(Slovenia)_-_0612-91/2025/40*

Facts — A controller, not named in the original decision but presumed to be a public institution, notified the Slovenian DPA after experiencing a data breach in relation to its website. The DPA carried out an inspection at the controller’s premises. In parallel, the controller shared on its website and with the media a press release with the aim of informing data subjects of the data breach. Subsequently, the controller received several access requests under Article 15 GDPR from individuals requesting information, among other things, on whether the data breach affected their personal data. To these requests the controller generally replied that the matter was under investigation and that the breach affected a unified registry of entities containing data subjects listed in various databases within the scope of the Slovenian Ministry of Agriculture. Holding — The DPA found that the controller failed to implement an appropriate access policy in violation of Article 32 GDPR. At the same time, the DPA held that the controller failed to respond appropriately to the data subjects’ access requests under Article 15 in relation to their personal data having been affected by the data breach since the response of the controller was not specific, explicit and unambiguous. In addition, the DPA considered the response provided by the controller as breaching Article 34 GDPR (i.e. communication of a personal data breach to the data subject) and Article 13 GDPR (i.e. information to be provided where personal data are collected from the data subject). Therefore, the DPA held that the controller must implement an appropriate access policy and additional measures in relation to the data subjects who addressed access requests in order to determine if the data breach affected them while documenting these measures in accordance with Article 32 GDPR. Finally, the DPA ordered the controller to respond to erasure requests in accordance with Article 17 GDPR.

### Towarzystwo Ubezpieczeń i Reasekuracji WARTA S.A.: Insufficient fulfilment of data breach notification obligations

*Source: Polish National Personal Data Protection Office (UODO), 2020-12-28 — https://overview.legal/posts/46616 — original: https://www.enforcementtracker.com/ETid-501*

The Polish DPA (UODO) fined Towarzystwo Ubezpieczeń i Reasekuracji WARTA S.A. EUR 18,930 for a breach of Art. 33 (1) GDPR and Art. 34 (1) GDPR. In May 2020, the DPA received a notification from a third party about a personal data breach involving an insurance agent acting as a processing agent for Towarzystwo Ubezpieczeń i Reasekuracji WARTA S.A. who sent an insurance policy to an unauthorized addressee by email. The document contained personal data concerning, among others, surnames, first name

### Tusla Child and Family Agency: Insufficient fulfilment of data breach notification obligations

*Source: Data Protection Authority of Ireland, 2020-06-30 — https://overview.legal/posts/46435 — original: https://www.enforcementtracker.com/ETid-320*

The organization sent a letter with abuse allegations to a third party who then uploaded it to social networks.

### Directorate of Social and Child Welfare Institutions of the Ferencvaros District of Budapest: Insufficient fulfilment of data breach notification obligations

*Source: Hungarian National Authority for Data Protection and the Freedom of Information (NAIH), 2019-05-21 — https://overview.legal/posts/46366 — original: https://www.enforcementtracker.com/ETid-251*

The employee of the Directorate sent by mistake 9 letters to the wrong recipient, which contained personal data of 18 data subjects (including data of children, criminal data and data related to the private life of the data subjects). The recipient informed the Directorate by telephone 5 days after the posting that it received certain letters by mistake. The Directorate notified NAIH on the data breach only weeks later.

### HUNGARY DPA: Insufficient fulfilment of data breach notification obligations

*Source: Hungarian National Authority for Data Protection and the Freedom of Information (NAIH), 2019-06-25 — https://overview.legal/posts/46189 — original: https://www.enforcementtracker.com/ETid-74*

The data controller did not fulfil its data breach notification obligations when a flash memory with personal data was lost.

## Recent developments

### ANSPDCP (Romania) - Fine against GLOBAL CUSTOMER CARE SERVICES S.R.L

*Source: GDPRhub, 2026-10-09 — https://overview.legal/posts/593306 — original: https://gdprhub.eu/index.php?title=ANSPDCP_(Romania)_-_Fine_against_GLOBAL_CUSTOMER_CARE_SERVICES_S.R.L*

The DPA fined a controller RON 26,294 (€5,000) for failing to implement adequate security measures, which led to a breach affecting the confidentiality and availability of personal data following a cyberattack. English Summary. Facts. A personal data breach occurred because of a cyberattack on of a call centre service provider (the controller). Thus, the confidentiality and availability of personal data were compromised and unauthorised parties gained access to the personal data of a significant

### Hellenic DPA decision on a data breach involving E.E.T.A.A. S.A. as processor for the Ministry of Social Cohesion and Family Affairs

*Source: European Data Protection Board, 2026-10-08 — https://overview.legal/posts/593252 — original: https://www.edpb.europa.eu/news/hellenic-dpa-decision-on-a-data-breach-involving-eetaa-sa-as-processor-for-the-ministry-of_en*

Background informationDate of final decision: 28/07/2026National caseController: Ministry of Social Cohesion and Family AffairsLegal Reference(s): Article 25 (Data protection by design and by default), Article 28 (Processor), Article 32 (Security of processing), Article 33 (Notification of a personal data breach to the supervisory authority) and Article 34 (Communication of a personal data breach to the data subject)Decision: Administrative fine, Compliance order, Summary of the DecisionOrigin o

### Advies van de AP aan WordPress-gebruikers die getroffen zijn door datalek

*Source: Autoriteit Persoonsgegevens, 2026-08-27 — https://overview.legal/posts/353594 — original: https://autoriteitpersoonsgegevens.nl/actueel/advies-van-de-ap-aan-wordpress-gebruikers-die-getroffen-zijn-door-datalek*

Recent zijn kwetsbaarheden ontdekt in de WordPress-software. WordPress wordt relatief veel gebruikt in Nederland. De kwetsbaarheden in WordPress worden momenteel actief misbruikt, met datalekken tot gevolg.

### The Italian SA fined Poste Vita for data breach

*Source: European Data Protection Board, 2026-06-04 — https://overview.legal/posts/53061 — original: https://www.edpb.europa.eu/news/the-italian-sa-fined-poste-vita-for-data-breach_en*

Background informationDate of final decision: 10 July 2025National caseController: Poste Vita s.p.a.Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 33 (Notification of a personal data breach to the supervisory authority)Decision: Administrative fineKey words: Administrative fine, Clients, Data security, Insurance, Personal data breachSummary of the DecisionOrigin of the case The investigation was initiated following a complaint from an insurance compan

### EDPB meets with EU Commissioner McGrath and adopts common data breach notification template

*Source: European Data Protection Board, 2026-06-10 — https://overview.legal/posts/53059 — original: https://www.edpb.europa.eu/news/edpb-meets-with-eu-commissioner-mcgrath-and-adopts-common-data-breach-notification-template_en*

Brussels, 10 June – During its latest plenary, the EDPB met with Michael McGrath, Commissioner for Democracy, Justice, the Rule of Law and Consumer Protection. In addition, the Board has adopted a common data breach notification template.The Board held a meeting with Commissioner McGrath, engaging in a fruitful discussion about common priorities and ongoing work on areas of mutual interest.The Digital Omnibus was among the key topics that shaped the discussion. The Board reiterated that, while s

## Literature

### European Union ∙ EDPB Adopts updated Guidelines on Personal Data Breach Notification under GDPR: The End of the One-Stop-Shop Reporting Mechanism for Non-EU Establishments

*Source: European Data Protection Law Review, 2022-01-01 — https://overview.legal/posts/132622 — original: https://doi.org/10.21552/edpl/2022/4/11*

### GDPR and NIS 2 Reporting Duties in Personal-Data Breaches:

*Source: European Data Protection Law Review, 2026-01-01 — https://overview.legal/posts/132466 — original: https://doi.org/10.21552/edpl/2025/4/9*

### IMPACT OF GDPR ON UKRAINIAN PERSONAL DATA PROTECTION LEGISLATION

*Source: Pravo ta nauki, 2018-12-30 — https://overview.legal/posts/132472 — original: https://doi.org/10.66556/2522-4549.1519.koshovyi-b*

The article examines the impact of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation – GDPR), which entered into force on 25 May 2018, on Ukrainian personal data protection legislation. The main novelties of GDPR are analyzed, including the principle of accountability, the right to erasure (right to be

### General Data Protection Regulation (GDPR) and Data Breaches: What You Should Know

*Source: Aesthetic Surgery Journal, 2018-10-29 — https://overview.legal/posts/132421 — original: https://doi.org/10.1093/asj/sjy296*

On May 25, 2018, the new General Data Protection Regulation (GDPR) enforced by the European Union and the United Kingdom Information Commissioner’s Office went into effect. Data protected by GDPR ranges from the relatively simple, such as email and IP addresses, to the highly sensitive, such as patient electronic health records. This recent regulation has resulted in a storm of activity by businesses and other data-collecting entities to comply with the requirements by updating privacy policies, opt-in notices, and email lists.1 How, if at all, does GDPR affect you? Generally speaking, the rules of GDPR differ somewhat from similar regulations in the United States, many of which are mandated on a state-by-state basis and involve varying definitions and remedies for a data breach.2 GDPR also differs in some respects from the Health Insurance Portability and Accountability (HIPAA) Breach Notification Rule issued by the US Department of Health and Human Services3 that details procedures by which covered entities and their business associates must provide notification following a breach of unsecured protected health information. Consider, however, that GDPR may have a broader definition of data breach than these other rules and that it protects the personal data rights of European Union citizens no matter where they live or where the breach occurs.1 Further, the widespread adoption of GDPR privacy standards by international companies may be a case of the “Brussels effect,” in which European laws and regulations are used as a global baseline.4 Therefore, wherever you conduct business, engage in research, or practice medicine, it is prudent to be aware of GDPR standards and their potential impact. The implications of GDPR for research and scholarly publishing entities are difficult and complex. Our subscribers, authors, and reviewers are located around the world, which means that this journal is clearly subject to GDPR rules. Our data security systems and procedures have always been robust, but we have taken all necessary steps to ensure that our data protection policies are completely GDPR-compliant. One of the greatest challenges for journals such as ours is to combine required diligence in data protection with the aim of increased transparency and accessibility in scientific research. Open science practices include sharing data sets as part of the publication process; this, of course, requires that such data be collected, stored, and shared in accordance with appropriate consent procedures and with ample regard for data sensitivity.1 Certainly, such concepts are not new. ASJ has always had a deep respect for data privacy and has, since its inception, implemented strict procedures to ensure confidentiality of sensitive data. In our case, GDPR simply serves to reinforce that obligation. Journal marketing practices must also be GDPR-compliant. This means that journals must obtain proper consent to store customer contact information and take measures to ensure that customers’ communication preferences are noted, kept current, and scrupulously adhered to. Although some may find a barrage of opt-in requests or opt-out offers somewhat annoying, such notifications allow consumers to specify their preferences for type and frequency of telemarketing, emails, e-alerts, and other communications.1 You undoubtedly will receive many such notices as businesses of all varieties struggle to meet GDPR requirements. Because violations of privacy standards—whether those established by GDPR, HIPAA, or the various states—can carry stiff financial penalties as well as result in loss of brand integrity, adherence to these standards is essential. In no instance is it more critical than in the case of healthcare providers. Clearly, although everyone in a position of responsibility with regard to patient data should be well familiar with applicable regulations for customer communications and data breach notification, even more important is preventing the compromise of data to begin with. Generally, any entity handling personal and sensitive data should ensure that the proper technical and organizational controls, meeting industry best practices, are in place to protect against a security breach.5 It has been reported that 95% of all breaches of enterprise networks enter through a spear phishing attack, that is, an email that is designed to appear legitimate but has a malicious attachment or link which, when selected, installs malware and attempts to access the user’s system. These spear phishing expeditions may often succeed in bypassing spam filters and antivirus engines. Experts recommend equipping your system with multiple antivirus engines, which should significantly increase malware detection rates. Other technologies, such as data sanitization and file type verification, may also be useful.6 Employee education, including training to identify vulnerabilities and risks, is vital. Most spear phishing emails will be sent to specific individuals within your organization, which enables the emails to avoid traditional spam filters. And if you think that healthcare entities are not among the preferred targets of malicious outsiders, think again! According to the 2014 Breach Level Index,7 the majority of data breaches by malicious outsiders were not for the purpose of stealing credit card information but, rather, for purposes of identity theft. Physicians and healthcare facilities should be aware that healthcare records are more valuable than credit card data; credit cards can easily be cancelled, but fraud using medical records is more difficult to identify and halt. Further, healthcare entities face the highest cost per stolen record—as high as $363, according to the Ponemon Institute.6 Healthcare facility data is often used to purchase drugs and even medical equipment, all of which can be sold on the black market for tremendous profit.8 Finally, in addition to preventive technology, organizational controls, and employee education, every responsible entity that manages personal and sensitive data should have in place a clear and comprehensive Incident Response Plan. This plan ought to specify all the members of the response team and each person’s exact responsibilities. It should include indicators for response escalation (notifying authorities, customers, media, etc. according to applicable regulations) and be tested for completeness and efficiency.5 Considering the increase in data breaches targeting healthcare entities, no plastic surgeon can afford to stick his or her head in the sand and simply hope for the best. You and virtually every member of your staff, as well as your software consultants, need to be actively engaged in the war against data breaches. Familiarize yourself with all applicable regulations (GDPR, HIPAA, and your individual state rules) that either already affect your practice or may do so. Differences in the various regulations may include: what the rule considers “covered information” (eg, what constitutes “personal information”); the definition of when a breach has occurred; the test for “harm threshold,” which may determine what subsequent actions are necessary; what constitutes a “safe harbor” (eg, the implementation of encryption); and specific notification requirements that must be adhered to with respect to timing, content, and methods.2 With regard to many issues of patient privacy, when there is a conflict between HIPAA and state law, whichever regulation provides the most protection for the patient typically is the one that takes precedence.9 As a footnote, I hasten to remind you that I am neither an IT expert nor a lawyer. The information included in this editorial should not be taken as specific legal or technical advice but, rather, as a general call to action. Each and every one of us should undertake a systematic review of data security. Employees who interface in any way with private data or the software managing that data must be properly trained to recognize and avoid possible breach attempts. Although not all such attacks are preventable, many are. The time and effort spent to fortify your defenses and mobilize your resources for remediation in the event of an attack is not only a wise initiative but, in today’s world, an absolutely necessary one. The author declared no potential conflicts of interest with respect to the research, authorship, and publication of this article. The author received no financial support for the research, authorship, and publication of this article.

### If it ain’t broke, don’t fix it? Ten improvements for the upcoming tenth anniversary of the General Data Protection Regulation

*Source: Computer law & security review, 2026-01-23 — https://overview.legal/posts/53843 — original: https://doi.org/10.1016/j.clsr.2025.106251*

As the General Data Protection Regulation (GDPR) approaches its tenth anniversary, the European legislator is considering reforms thereto. This article offers a set of research-based suggestions for what such reforms could look like, based on two assumptions. First, that the GDPR is overall a solid piece of legislation that upholds the enduring objectives and principles of data protection law. Second, that any improvement cannot compromise the level of protection of fundamental rights currently

## Tools

### Meldloket datalekken Autoriteit Persoonsgegevens

*Source: Autoriteit Persoonsgegevens, 2026-07-04 — https://overview.legal/posts/53807 — original: https://datalekken.autoriteitpersoonsgegevens.nl/*

Het officiële loket van de Autoriteit Persoonsgegevens voor het melden van datalekken op grond van artikel 33 AVG. Verwerkingsverantwoordelijken melden hier binnen 72 uur een inbreuk in verband met persoonsgegevens, en kunnen meldingen aanvullen of intrekken.

### EDPB Data Protection Guide for Small Business

*Source: EDPB, 2026-07-04 — https://overview.legal/posts/53804 — original: https://www.edpb.europa.eu/sme-data-protection-guide/home_en*

Interactive guide by the European Data Protection Board that walks SMEs through GDPR compliance: lawful bases, individuals' rights, security of processing, data breach response, and international transfers — with practical examples and checklists.

## Related topics

- **Personal Data** — https://overview.legal/topics/personal-data
  Information relating to identified or identifiable natural persons
- **Controllers** — https://overview.legal/topics/controllers
  Entities that determine purposes and means of processing
- **Supervisory Authorities** — https://overview.legal/topics/supervisory-authorities
  National data protection authorities and their powers
- **Notification Obligation** — https://overview.legal/topics/notification-obligation
  Duty to report data breaches to authorities and affected individuals
- **Processing** — https://overview.legal/topics/processing
  Any operation performed on personal data
- **Security** — https://overview.legal/topics/security
  Technical and organizational measures to protect personal data

---
Generated by overview.legal · https://overview.legal/topics/data-breaches · 2026-10-13