# Notification Obligation — legal context bundle

> Curated from overview.legal on 2026-10-13. Canonical page: https://overview.legal/topics/notification-obligation
> Sources are cited per item. Verify against the official texts before relying on them.

Duty to report data breaches to authorities and affected individuals

## Overview

## Legal Framework

The notification obligation under the GDPR is governed primarily by [Article 33](/laws/gdpr/art-33) and [Article 34](/laws/gdpr/art-34). Article 33 imposes a duty on controllers to notify the competent supervisory authority of a personal data breach; Article 34 requires communication of the breach to affected data subjects when a higher risk threshold is met.

Under [Article 33(1)](/laws/gdpr/art-33#par-1), the controller must notify the supervisory authority unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. The 72-hour clock starts when the controller becomes "aware" of the breach—not when the breach occurs. [Article 33(2)](/laws/gdpr/art-33#par-1) separately requires processors to notify controllers without undue delay.

> "the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority"
> — [GDPR Art. 33(1)](/laws/gdpr/art-33#par-1)

[Article 34(1)](/laws/gdpr/art-34#par-1) raises the threshold: communication to data subjects is required only when the breach is likely to result in a **high** risk to their rights and freedoms. The communication must describe the nature of the breach in clear and plain language and include the contact details, likely consequences, and mitigation measures referenced in Article 33(3)(b)–(d).

> "the controller shall communicate the personal data breach to the data subject without undue delay"
> — [GDPR Art. 34(1)](/laws/gdpr/art-34#par-1)

The definition of "personal data breach" in [Article 4(12)](/laws/gdpr/art-4#par-12) is broad, encompassing not only unauthorized access but also accidental destruction, loss, or alteration of personal data.

## Key Developments

The CJEU confirmed the dual notification structure in *TR v Land Hessen*, reciting both Article 33 and Article 34 as distinct obligations with different risk thresholds. The Court's recitation underscores that authority notification (risk threshold) and data subject communication (high risk threshold) operate independently.

Enforcement illustrates the consequences of non-compliance. In the *WARTA S.A.* case, the Polish DPA fined a controller EUR 18,930 after it failed to notify both the authority and data subjects despite being advised how to do so:

> "Despite the letter requesting explanations, the controller did not report the data breach nor did it inform the data subjects about the incident."
> — [WARTA S.A. (UODO)](/posts/46616#seg-2)

The Irish DPC's decision in *Permanent TSB* clarified the practical assessment of "undue delay," emphasizing that the 72-hour period begins from the moment the controller becomes aware of the breach:

> "This must be assessed by reference to when PTSB became aware of the personal data breach."
> — [Permanent TSB (DPC Ireland)](/posts/53597#seg-81)

[Article 33(4)](/laws/gdpr/art-33#par-1) permits phased notification where not all information is available at once. [Article 34(3)](/laws/gdpr/art-34#par-1) provides three exemptions from the data subject communication duty: effective encryption, subsequent risk-mitigating measures, or disproportionate effort (requiring a public communication instead).

## Status of the Debate

The notification obligation is actively contested in litigation. While the core structure—72-hour authority notification under Article 33 and high-risk data subject communication under Article 34—is well established, courts and supervisory authorities continue to grapple with boundary questions: when exactly a controller becomes "aware" of a breach, how to calibrate the risk assessment distinguishing "risk" from "high risk," and what constitutes sufficient justification for delayed notification. The EDPB has issued guidance through Guidelines 9/2022 and Guidelines 01/2021, but these do not bind courts. A CJEU ruling squarely addressing the "awareness" trigger and the proportionality of fines for late notification would resolve the principal open questions.

## Practical Guidance

- **Establish internal breach detection and escalation procedures** so that awareness of a potential breach reaches the controller's decision-makers quickly; the 72-hour clock under [Article 33(1)](/laws/gdpr/art-33#par-1) starts from awareness, not from full investigation.
- **Conduct a documented risk assessment** for every confirmed breach to determine whether the "risk" threshold for authority notification and the "high risk" threshold for data subject communication under [Article 34(1)](/laws/gdpr/art-34#par-1) are met.
- **Prepare notification templates** covering the [Article 33(3)](/laws/gdpr/art-33#par-3-pnt-a) content requirements—nature, contact point, likely consequences, and mitigation measures—to enable rapid filing within 72 hours.
- **Document any delay**: if the 72-hour deadline is missed, Article 33(1) requires reasons for the delay to accompany the notification.
- **Verify processor contracts** require processors to notify controllers without undue delay under Article 33(2), as controllers bear the authority-notification obligation even when the processor detects the breach.

## Legislation (full text of key provisions)

### Infringements entailing a personal data breach

*Source: NIS2, nis2-art-35-en, 2022-12-14 — https://overview.legal/posts/96467*

### Notification of a personal data breach to the supervisory authority

*Source: GDPR, gdpr-art-33-en, 2016-04-27 — https://overview.legal/posts/90633*

### Communication of a personal data breach to the data subject

*Source: GDPR, gdpr-art-34-en, 2016-04-27 — https://overview.legal/posts/90649*

### Definitions

*Source: ePrivacy Directive, eprivacy-art-2-en, 2002-07-12 — https://overview.legal/posts/132169*

DefinitionsSave as otherwise provided, the definitions in Directive 95/46/EC and in Directive 2002/21/EC of the European Parliament and of the Council of 7 March 2002 on a common regulatory framework for electronic communications networks and services (Framework Directive) ( 8 ) shall apply.The following definitions shall also apply:‘user’ means any natural person using a publicly available electronic communications service, for private or business purposes, without necessarily having subscribed to this service;‘traffic data’ means any data processed for the purpose of the conveyance of a communication on an electronic communications network or for the billing thereof; ▼M2 ‘location data’ means any data processed in an electronic communications network or by an electronic communications service, indicating the geographic position of the terminal equipment of a user of a publicly available electronic communications service; ▼B ‘communication’ means any information exchanged or conveyed between a finite number of parties by means of a publicly available electronic communications service. This does not include any information conveyed as part of a broadcasting service to the public over an electronic communications network except to the extent that the information can be related to the identifiable subscriber or user receiving the information; ▼M2 ————— ▼B ‘consent’ by a user or subscriber corresponds to the data subject's consent in Directive 95/46/EC;‘value added service’ means any service which requires the processing of traffic data or location data other than traffic data beyond what is necessary for the transmission of a communication or the billing thereof;‘electronic mail’ means any text, voice, sound or image message sent over a public communications network which can be stored in the network or in the recipient's terminal equipment until it is collected by the recipient; ▼M2 ‘personal data breach’ means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed in connection with the provision of a publicly available electronic communications service in the Community.

### Recital 85 — personal data breach notification requirements

*Source: GDPR, gdpr-rec-85-en, 2016-04-27 — https://overview.legal/posts/91685*

A personal data breach may, if not addressed in an appropriate and timely manner, result in physical, material or non-material damage to natural persons such as loss of control over their personal data or limitation of their rights, discrimination, identity theft or fraud, financial loss, unauthorised reversal of pseudonymisation, damage to reputation, loss of confidentiality of personal data protected by professional secrecy or any other significant economic or social disadvantage to the natural person concerned. Therefore, as soon as the controller becomes aware that a personal data breach has occurred, the controller should notify the personal data breach to the supervisory authority without undue delay and, where feasible, not later than 72 hours after having become aware of it, unless the controller is able to demonstrate, in accordance with the accountability principle, that the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where such notification cannot be achieved within 72 hours, the reasons for the delay should accompany the notification and information may be provided in phases without undue further delay.

### Recital 87 — personal data breach notification requirements

*Source: GDPR, gdpr-rec-87-en, 2016-04-27 — https://overview.legal/posts/91689*

It should be ascertained whether all appropriate technological protection and organisational measures have been implemented to establish immediately whether a personal data breach has taken place and to inform promptly the supervisory authority and the data subject. The fact that the notification was made without undue delay should be established taking into account in particular the nature and gravity of the personal data breach and its consequences and adverse effects for the data subject. Such notification may result in an intervention of the supervisory authority in accordance with its tasks and powers laid down in this Regulation.

### Recital 88 — personal data breach notification rules

*Source: GDPR, gdpr-rec-88-en, 2016-04-27 — https://overview.legal/posts/91691*

In setting detailed rules concerning the format and procedures applicable to the notification of personal data breaches, due consideration should be given to the circumstances of that breach, including whether or not personal data had been protected by appropriate technical protection measures, effectively limiting the likelihood of identity fraud or other forms of misuse. Moreover, such rules and procedures should take into account the legitimate interests of law-enforcement authorities where early disclosure could unnecessarily hamper the investigation of the circumstances of a personal data breach.

### Recital 86 — data breach notification to data subjects

*Source: GDPR, gdpr-rec-86-en, 2016-04-27 — https://overview.legal/posts/91687*

The controller should communicate to the data subject a personal data breach, without undue delay, where that personal data breach is likely to result in a high risk to the rights and freedoms of the natural person in order to allow him or her to take the necessary precautions. The communication should describe the nature of the personal data breach as well as recommendations for the natural person concerned to mitigate potential adverse effects. Such communications to data subjects should be made as soon as reasonably feasible and in close cooperation with the supervisory authority, respecting guidance provided by it or by other relevant authorities such as law-enforcement authorities. For example, the need to mitigate an immediate risk of damage would call for prompt communication with data subjects whereas the need to implement appropriate measures against continuing or similar personal data breaches may justify more time for communication.

### Recital 73 — lawful restrictions on data subject rights

*Source: GDPR, gdpr-rec-73-en, 2016-04-27 — https://overview.legal/posts/91661*

Restrictions concerning specific principles and the rights of information, access to and rectification or erasure of personal data, the right to data portability, the right to object, decisions based on profiling, as well as the communication of a personal data breach to a data subject and certain related obligations of the controllers may be imposed by Union or Member State law, as far as necessary and proportionate in a democratic society to safeguard public security, including the protection of human life especially in response to natural or manmade disasters, the prevention, investigation and prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security, or of breaches of ethics for regulated professions, other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, the keeping of public registers kept for reasons of general public interest, further processing of archived personal data to provide specific information related to the political behaviour under former totalitarian state regimes or the protection of the data subject or the rights and freedoms of others, including social protection, public health and humanitarian purposes. Those restrictions should be in accordance with the requirements set out in the Charter and in the European Convention for the Protection of Human Rights and Fundamental Freedoms.

## Case law

### Cypriot court backs DPA fines of €40,000 each on football clubs and €25,000 on processor

*Source: Administrative Court of Cyprus, 2026-05-12 — https://overview.legal/posts/353978 — original: https://gdprhub.eu/index.php?title=ΔΔΚ_-_14/2021*

Facts — On 26 July 2021, a journalist informed the Cypriot DPA of a security vulnerability on an online platform. This online platform hosted ticket purchase sites of two Cypriot football clubs, OMONIA and APOEL (the controllers). This flaw in the system allowed a user to identify, through a reserved-seat icon, the name and ID number of the fan who had reserved the seat. By using that information, the user could then download the fan card, including the fan’s photograph. The DPA ordered the controllers to submit a personal data breach notification in accordance with Article 33 GDPR. In addition, it asked them to provide information on whether a penetration test had been carried out on the platform and to submit their contracts with the platform provider which acted as the processor of this data. Both controllers submitted the Personal Data Breach Notification Form and the requested documents. The DPA fined each controller €40.000 and the processor €25.000 for the violations of Article 24(1) GDPR, Article 25 GDPR and Article 32(1) GDPR. The controllers and the processor appealed the decision, mainly disputing their responsibility for the required security measures, their respective roles under the GDPR, and the proportionality of the fines. One of the controllers challenged only part of that fine. Holding — The court held that, by submitting the breach notification form, the controllers had accepted both that there had been a personal data breach under Article 33 GDPR and that they acted as controllers for the purposes of the GDPR. The court further held that the platform provider acted as a processor under the relevant contracts and was therefore bound by Articles 28 and 32 GDPR. The court upheld the DPA’s finding that the controllers and the processor had infringed the GDPR. It rejected one of the controllers’ arguments that it had no duty to carry out a penetration test before the platform was launched. The court held that Article 24 GDPR, Article 25 GDPR and Article 32 GDPR impose a continuing obligation on controllers and processors to ensure a level of security appropriate to the risk. Since Article 32 GDPR lists security measures only by way of example, their duties were not limited to the measures expressly mentioned in that provision. The court also held that the processor’s prior internal checks did not change the outcome, as the duty to implement appropriate security measures is ongoing. However, the court annulled the administrative fines, insofar as challenged, because their amount had not been determined in accordance with the principle of proportionality. In particular, the court noted that one controller had been fined €40,000 although the infringement affected 3,652 persons, while the other controller received the same fine despite the fact that only up to 100 persons were affected. By contrast, the processor, which was involved in both infringements, received a lower fine of €25,000. The court held that the DPA had failed to respect the principle of proportionality when imposing the fines, given that the underlying facts were essentially the same and that liability under the GDPR is shared between controllers and processors.

### VB v Natsionalna agentsia za prihodite

*Source: CJEU, C-340/21, 2023-12-14 — https://overview.legal/posts/51485 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0340*

Data breach alone does not establish inadequate security measures. Burden on controller to prove adequacy.

### Cyprus court upholds €5,000 DPA fine on Pancyprian Judo Federation for Article 31 GDPR

*Source: ADMINISTRATIVE COURT OF CYPRUS, 2026-05-20 — https://overview.legal/posts/353976 — original: https://gdprhub.eu/index.php?title=ΔΔΚ_-_1421/2022*

Facts — On 3 November 2021, a data subject filed a complaint with the Cypriot DPA against an individual who managed a club affiliated with the Pancyprian Judo Federation. The complaint concerned the unauthorised publication of photos and other material, including material depicting the data subject’s minor child, in the context of under-18 Pancyprian judo matches held under the federation’s auspices. It also referred to an earlier lawyer’s letter concerning an alleged personal data breach, which the federation had forwarded to its member clubs. On 13 December 2021, the DPA requested various information from the federation. The federation did not respond. The DPA then sent a reminder on 25 January 2022, but the federation again failed to respond. Subsequently, on 30 March 2022 the DPA issued a prima facie decision finding a breach of Article 31 GDPR due to the federation’s lack of cooperation and invited the federation to submit its position. The federation did not respond to this either. On 11 May 2022, the DPA issued the contested decision, finding that the federation had failed to cooperate with it despite repeated requests. It imposed a €5,000 fine for breach of Article 31 GDPR. The federation appealed against the decision, arguing that it was based on an incorrect application of the GDPR and contained legal and factual errors. Holding — The court noted that, for Article 31 GDPR, Article 58 GDPR and Article 83 GDPR to apply, the federation had to qualify as either a controller or a processor. The court found that the federation did not fall within the definition of processor under Article 4(8) GDPR. It noted that the DPA did not appear to have treated it as such. The court then examined whether the federation could be considered a controller under Article 4(7) GDPR. It held that the contested decision did not clearly explain why the DPA had classified the federation as a controller. The court inferred that the DPA may have reached this conclusion due the fact that the federation had forwarded to its member clubs a lawyer’s letter concerning an alleged personal data breach in the past. However, the court rejected this reasoning. It held that the federation had merely forwarded the letter and had not given any instructions regarding the purposes or means of processing personal data. The DPA had not investigated whether the federation, either alone or jointly with its members, determined the purposes or means of the processing. Nor could such involvement be presumed merely because the federation had registered member clubs. The court concluded that, since the federation did not qualify as either a controller or a processor, Article 31 GDPR, Article 58(2) GDPR and Article 83 GDPR did not apply. It annulled the contested decision and ordered the DPA to pay €2,000 plus VAT in costs to the federation.

### SG Nürnberg: MOVEit zero-day cyberattack via processor did not breach Art. 32 GDPR

*Source: Social Court Nuremberg, 2026-06-10 — https://overview.legal/posts/122874 — original: https://gdprhub.eu/index.php?title=SG_Nürnberg_-_S_5_SF_65/24_DS*

Facts — The data subject (a child born in 2018), represented by her parents, was insured with the controller (a statutory health insurance provider) and participated in its digital bonus programme. The bonus programme was managed via an app. To handle the information technology operations of this programme, the controller hired the processor (an IT service provider), establishing a data processing agreement under Article 28 GDPR alongside specific information security guidelines. To provide these services, the processor utilised "MOVEit Transfer," a market-leading file transfer software developed by Progress Software Corp. On 31 May 2023, the software developer publicly announced a critical, previously unknown "zero-day" vulnerability in the software (later assigned CVE-2023-34362). At that exact moment, no security patch was available. On the very same day, 31 May 2023, the processor – alongside thousands of other companies worldwide – became the victim of a global cyberattack carried out by the hacker group "Clop." The hackers exploited this zero-day vulnerability to install a "web-shell" backdoor (typically named human2.aspx), bypassing authentication to exfiltrate database records. The compromised data included the data subject's first and last name, health insurance number, bonus points balance, and a bank account number (IBAN) belonging to her mother. No medical, health, or social security data was exfiltrated. On 1 June 2023, the developer released a security patch, which the processor installed immediately. On 2 June 2023, the German Federal Office for Information Security (BSI) issued a formal IT security warning (No. 2023-240133-1100, Version 1.1). The BSI classified the IT threat level as "3 / Orange" (business-critical), confirming active exploitation with data exfiltration. The BSI recommended immediately blocking all HTTP and HTTPS traffic to MOVEit environments, checking for specific Indicators of Compromise (IoCs) in the web server directories, and applying the newly released patch before reconnecting systems to the network. On 16 June 2023, the processor informed the controller about the incident. On 17 June 2023, the controller issued a public press release confirming that its external service provider for the bonus programme had been targeted on 31 May 2023. The release stated that the security vulnerability had been closed, that there was never any connection to the controller's internal IT systems, and that relevant supervisory authorities had been notified. The controller subsequently notified the data subject's parents. On 27 March 2024, the data subject, via legal counsel, sent a formal warning letter to the controller demanding an injunction, a declaration of liability for all potential future damages, and non-material damages of at least €3,000. Following the controller's refusal, the data subject filed a lawsuit with the Nuremberg Social Court (Sozialgericht Nürnberg), later expanding the claim to the processor as a joint defendant. Holding — The Court dismissed the lawsuit as partly inadmissible and otherwise unfounded, establishing the following legal principles: First, the Court held that a successful third-party cyberattack does not establish an irrebuttable presumption that a controller or processor failed to implement appropriate security measures under Article 32(1) GDPR and Article 5(1)(f) GDPR. To escape liability under Article 82(3) GDPR, an operator must prove they implemented robust baseline security controls (such as multi-factor authentication, encryption, and lockout policies) and applied a security patch immediately upon its release by the vendor, even if this occurred before formal alerts were issued by national IT security authorities. Second, the Court held that a claim for non-material damages under Article 82(1) GDPR based on the fear or distress of future data misuse cannot be established if the data subject is a minor who has no subjective knowledge or cognitive awareness of the data breach. Furthermore, if the compromised financial data (such as an IBAN) does not belong to the data subject personally, there is no direct risk of financial harm to them, rendering the alleged fear of financial damage unfounded. Third, the Court held that an injunction claim is inadmissible due to a lack of specificity if it merely demands that a controller stop making personal data accessible to third parties without implementing "state-of-the-art" security measures, without specifying the concrete technical or organisational measures the controller is required to take. Fourth, the Court held that a declaratory claim for potential future material damages is inadmissible under national procedural law (§ 55(1) SGG) if there is no realistic probability of future financial harm, particularly because the compromised bank account belonged to a third party (the mother) and the software vulnerability was immediately patched.

### TR v Land Hessen

*Source: Court of Justice of the European Union, C-768/21, 2024-09-26 — https://overview.legal/posts/132245 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0768*

In Case C-768/21, the Court of Justice of the European Union (First Chamber) ruled on a preliminary reference from the Verwaltungsgericht Wiesbaden concerning TR's challenge of the Hessischer Beauftragte für Datenschutz und Informationsfreiheit (HBDI) for declining to exercise corrective powers against Sparkasse X following a personal data breach complaint. The Court clarified the limits of supervisory authorities' discretion under GDPR Articles 57(1) and 58(2), holding that while authorities retain discretion in selecting corrective measures, they are legally obliged to exercise those powers when an infringement is established, and complainants have a right to an effective remedy under Article 77 even where no enforcement action was taken. No fine was imposed in this proceeding, as the ruling addressed the supervisory authority's enforcement obligations rather than penalizing a controller.

### BL v MediaMarktSaturn Hagen-Iserlohn GmbH

*Source: Court of Justice of the European Union, C-687/21, 2024-01-25 — https://overview.legal/posts/132272 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0687*

In Case C-687/21, the Court of Justice of the European Union interpreted Articles 5, 24, 32, and 82 of the GDPR in response to a preliminary ruling request from the Amtsgericht Hagen in proceedings between data subject BL and MediaMarktSaturn Hagen-Iserlohn GmbH concerning alleged non-material damage from personal data transmitted to an unauthorized third party due to employee error. The Court held that a controller's infringement of GDPR security obligations through employee error can give rise to a right to compensation under Article 82, that the severity of the infringement may be relevant to assessing both the appropriateness of protective measures and the existence of damage, and that the concept of non-material damage should be interpreted broadly without requiring a minimum threshold of severity. No fine was imposed, as the ruling addresses interpretation of GDPR provisions rather than administrative penalties.

### JU and SO v Scalable Capital GmbH

*Source: Court of Justice of the European Union, C-182/22, 2024-06-20 — https://overview.legal/posts/132254 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0182*

In Joined Cases C-182/22 and C-189/22, the Court of Justice of the European Union (Third Chamber) ruled on a preliminary reference from the Amtsgericht München concerning the interpretation of Article 82 GDPR in proceedings brought by data subjects JU and SO against Scalable Capital GmbH following the theft of their personal data from the company's trading application. The core issue was whether Article 82 GDPR permits compensation for non-material damage that is minimal or symbolic, and whether such compensation can serve a punitive function. The Court held that Article 82 GDPR does not preclude the awarding of minimal compensation for non-material damage, such as distress following a personal data breach, provided the damage is genuine and actually arose from the infringement, but clarified that compensation under the GDPR must be purely reparative and cannot have a punitive character.

### Digi Távközlési és Szolgáltató Kft. v Nemzeti Adatvédelmi és Információszabadság Hatóság

*Source: Court of Justice of the European Union, C-77/21, 2022-10-20 — https://overview.legal/posts/132306 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0077*

In this preliminary ruling, the CJEU interpreted Articles 5(1)(b) and 5(1)(e) GDPR in proceedings between Digi Távközlési és Szolgáltató Kft. and the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) concerning a personal data breach. The Court held that creating a new database from an existing one for testing and error-correction purposes constitutes further processing requiring compatibility assessment under the purpose limitation principle, and that the storage limitation principle applies such that data must be deleted once the testing purpose is fulfilled. No fine was imposed at the EU level, as the matter was remitted to the referring Hungarian court.

### A v Patērētāju tiesību aizsardzības centrs

*Source: Court of Justice of the European Union, C-507/23, 2024-10-04 — https://overview.legal/posts/132162 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0507*

The Court of Justice of the European Union issued a preliminary ruling on a reference from the Latvian Supreme Court in Case C-507/23, involving an individual ("A") and the Patērētāju tiesību aizsardzības centrs (Consumer Rights Protection Centre, Latvia) regarding compensation for non-material damage allegedly suffered from unlawful processing of personal data under Article 82(1) GDPR. The Court addressed whether apologies can constitute compensation for non-material damage and whether the controller's attitude and motivation may be considered in assessing the form and level of compensation. No fine was imposed, as the ruling clarifies interpretive questions of EU law for the referring national court.

### GP v juris GmbH

*Source: Court of Justice of the European Union, C-741/21, 2024-04-11 — https://overview.legal/posts/132262 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0741*

In Case C-741/21, the Court of Justice of the European Union (Third Chamber) addressed a preliminary reference from the Landgericht Saarbrücken in proceedings between data subject GP and juris GmbH concerning GP's claim for compensation under Article 82 GDPR after the company processed his personal data for marketing purposes despite his objections. The Court held that "non-material damage" under Article 82(1) GDPR must be interpreted broadly and is not subject to a seriousness threshold, that a controller may be exempt from liability under Article 82(3) if it proves it was not in any way responsible for the infringement (including where a person acting under its authority under Article 29 was at fault), and that the criteria for administrative fines under Article 83 GDPR do not apply to the assessment of compensation amounts.

### Data Protection Commissioner v Facebook Ireland and Maximillian Schrems

*Source: CJEU, C-311/18, 2020-07-16 — https://overview.legal/posts/51470 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62018CJ0311&ref=51470*

Invalidated Privacy Shield adequacy decision and upheld validity of Standard Contractual Clauses with additional safeguards required.

### AT and BT v PS GbR and Others

*Source: Court of Justice of the European Union, C-590/22, 2024-06-20 — https://overview.legal/posts/132253 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0590*

In Case C-590/22, the Court of Justice of the European Union (Third Chamber) ruled on a preliminary reference from the Amtsgericht Wesel (Germany) in proceedings between individuals AT and BT and tax consultancy PS GbR, concerning whether the claimants could receive compensation under Article 82(1) GDPR for non-material damage (fear and suffering) after their tax return was disclosed to third parties without consent. The Court held that the concept of non-material damage must be interpreted broadly and that compensation under Article 82 does not require the damage to reach a certain threshold of seriousness, nor can the criteria for administrative fines under Article 83 be applied to compensation claims, though the amount of compensation must correspond to the actual harm suffered.

## Guidance

### Guidelines 01/2021 on Examples regarding Personal Data Breach Notification

*Source: EDPB, edpb-guidelines-on-examples-regarding-personal-data-breach-notification, 2022-01-03 — https://overview.legal/posts/38047 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-012021-on-examples-regarding-personal-data-breach-notification_en*

The European Data Protection Board (EDPB) adopted Guidelines 01/2021 on December 14, 2021, providing practical examples and analysis regarding personal data breach notification obligations under Articles 33 and 34 of the GDPR. The guidelines present hypothetical scenarios covering ransomware attacks and data exfiltration incidents, illustrating how controllers should assess risk to determine whether notification to supervisory authorities and communication to data subjects are required. The document serves as interpretive guidance for controllers evaluating breach severity, appropriate mitigation measures, and notification decisions, and does not impose any fines or sanctions.

### Guidelines 9/2022 on personal data breach notification under GDPR

*Source: EDPB, edpb-guidelines-on-personal-data-breach-notification-under-gdpr, 2023-04-04 — https://overview.legal/posts/38058 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-92022-on-personal-data-breach-notification-under-gdpr_en*

The EDPB adopted Guidelines 9/2022 (Version 2.0, 28 March 2023) to update and replace the prior WP250 guidance on personal data breach notification under Articles 33 and 34 of the GDPR. The guidelines address the definition and types of personal data breaches, controller and processor notification obligations, the concept of a controller becoming "aware" of a breach, cross-border and non-EU establishment breach scenarios, and the conditions under which notification to supervisory authorities and data subjects is or is not required.

### Guidelines on Personal data breach notification under Regulation 2016/679, WP250 rev.01

*Source: EDPB, guidelines-on-personal-data-breach-notification-under-regulation-2016679-wp250-en, 2018-05-25 — https://overview.legal/posts/126319 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-on-personal-data-breach-notification-under-regulation-2016679-wp250_en*

Уведомления относно нарушение на сигурността на личните данни Насока 25 May 2018 Уведомления относно нарушение на сигурността на личните данни Related documents Всички

### EDPB-EDPS Joint opinion 2/2026 on the Proposal for a Regulation as regards the simplification of the digital legislative framework (

*Source: EDPB, edpb-edps-joint-opinion-22026-proposal-en, 2026-02-11 — https://overview.legal/posts/53739 — original: https://www.edpb.europa.eu/our-work-tools/our-documents/edpbedps-joint-opinion/edpb-edps-joint-opinion-22026-proposal_en*

EDPB, EDPB-EDPS Joint opinion 2/2026 on the Proposal for a Regulation as regards the simplification of the digital legislative framework (Digital Omnibus)

### Opinion 2/2026 on the Proposal for a Directive amending Directives (EU) 2016/2341 and 2016/97 as regards the strengthening of the framework for occupational retirement provision

*Source: EDPS, 2026-01-09-opinion-22026-directive-amending-directives-eu-20162341-and-201697-regards-strengthening-, 2026-02-11 — https://overview.legal/posts/51418 — original: https://www.edps.europa.eu/data-protection/our-work/publications/opinions/2026-01-09-opinion-22026-directive-amending-directives-eu-20162341-and-201697-regards-strengthening-framework-occupational-retirement-provision_en*

EDPB - EDPS JOINT OPINION 2 /2026 On the Proposal for a Regulation as regards the simplification of the digital legislative framework (Digital Omnibus) Adopted on 1 0 February 2026 2 4 Executive summary On 19 November 2025, the European Commission (the ‘Commission’) issued a Digital Omnibus p roposal 1 amending a large corpus of the EU digital legislation, including the GDPR, the Single Digital Gateway Regulation, the EUDPR, the Data Act, the ePrivacy Directive, the Cybersecurity Directive, NIS…

### Opinion 14/2019 on the draft Standard Contractual Clauses submitted by the DK SA (Article 28(8) GDPR)

*Source: EDPB, opinion-142019-on-the-draft-standard-contractual-clauses-en, 2019-07-12 — https://overview.legal/posts/126212 — original: https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-142019-on-the-draft-standard-contractual-clauses_en*

Adopted 1 Opinion 14/2019 on the draft Standard Contractual Clauses sub mitted by the DK SA (Article 28( 8 ) GDPR) Adopted on 9 July 2019 Adopted 2 1 CONTENTS 2 Summary of the Facts ................................ ................................ ................................ .................... 4 3 Assessment ................................ ................................ ................................ ................................ .... 5 3.1 General reasoning of the Board…

### Art. 29 WP Guidelines on GDPR transparency requirements (WP260 rev.01)

*Source: EDPB, edpb-guidelines-on-transparency, 2018-04-11 — https://overview.legal/posts/38076 — original: https://www.edpb.europa.eu/system/files/2023-09/wp260rev01_en.pdf*

The Article 29 Data Protection Working Party issued these guidelines (WP260 rev.01), adopted on 29 November 2017 and last revised on 11 April 2018, to provide interpretive and practical guidance on the transparency requirements under the GDPR (Articles 12–14). The document addresses the form, timing, content, and modalities of information provided to data subjects, including issues such as plain language, layered privacy notices, information for children, and exceptions to the obligation to provide information. No fines or enforcement actions are imposed, as this is a guidance document rather than an enforcement decision.

### EDPB- EDPS Joint Opinion 01/2025 on the Proposal for a Regulation on simplification measures for SMEs and SMCs, in particular the record-keeping obligation under Art. 30(5) GDPR

*Source: EDPB, edpb-edps-jointopinion-202501-proposalsimplification-en, 2025-07-09 — https://overview.legal/posts/50980 — original: https://www.edpb.europa.eu/documents/legislative-opinion/edpb-edps-joint-opinion-012025-on-the-proposal-for-a-regulation-on_en*

De EDPB en EDPS steunen het doel om de administratieve lasten voor SMCs en MKB te verminderen, mits dit de bescherming van fundamentele rechten niet verlaagt. Ze benadrukken de noodzaak van een evenwichtige en proportionele aanpak en vragen om verduidelijking van de nieuwe drempel van 750 werknem...

## Enforcement decisions

### Fundację Promocji Mediacji i Edukacji Prawnej Lex Nostra: Insufficient fulfilment of data breach notification obligations

*Source: Polish National Personal Data Protection Office (UODO), 2021-06-30 — https://overview.legal/posts/46884 — original: https://www.enforcementtracker.com/ETid-769*

The Polish DPA (UODO) has imposed a fine of EUR 3,000 on the Fundację Promocji Mediacji i Edukacji Prawnej Lex Nostra Foundation for the promotion of mediation and legal education. The controller had not immediately informed the DPA and the data subjects about a personal data breach. Several folders containing personal data had been stolen from the controller in early 2020. These included the names, addresses and telephone numbers, and in 3 to 4 cases also the PESEL numbers (Polish identificatio

### HDPA: Hellenic Open University found to have met breach notification duties after

*Source: HDPA (Greece), 2026-08-19 — https://overview.legal/posts/291288 — original: https://gdprhub.eu/index.php?title=HDPA_(Greece)_-_14/2026*

Facts — The Hellenic Open University (‘the controller’) submitted initial and supplementary notifications to the DPA after it was subject to a data breach resulting from a ransomware attack. The breach affected the personal data of 30,000 individuals in the controller’s information system and involved a leak of 813 GB of personal data that was later posted on the dark web but with restricted access as to its content. After respective requests and instructions by the DPA, the controller communicated the data breach to the affected individuals in accordance with Article 34 GDPR since the DPA considered a public notice insufficient. The controller also provided the DPA with further information, amongst others, regarding the nature of the breach and personal data affected. The controller took measures to prevent successful installation of malware in the future and to prevent future incidents and take measures to mitigate damage to affected parties, in accordance with Article 33 GDPR. Holding — The DPA held that the controller complied with its notification obligations under Article 33 and Article 34 GDPR, despite the initial notification being supplemented at a later time. Regarding the controller’s compliance with Article 32 GDPR (i.e. the obligation to implement adequate security measures), the DPA held that the cause of the incident was a human error, which could have been prevented through targeted training and improved authentication measures with individuals which have access to the system administration. In accordance with Article 58(2)(d) GDPR, the DPA ordered the controller to implement targeted training plans for system administrators and to fully implement the security measures mentioned above, within 6 months of this decision and to inform the DPA of such.

### Towarzystwo Ubezpieczeń i Reasekuracji WARTA S.A.: Insufficient fulfilment of data breach notification obligations

*Source: Polish National Personal Data Protection Office (UODO), 2020-12-28 — https://overview.legal/posts/46616 — original: https://www.enforcementtracker.com/ETid-501*

The Polish DPA (UODO) fined Towarzystwo Ubezpieczeń i Reasekuracji WARTA S.A. EUR 18,930 for a breach of Art. 33 (1) GDPR and Art. 34 (1) GDPR. In May 2020, the DPA received a notification from a third party about a personal data breach involving an insurance agent acting as a processing agent for Towarzystwo Ubezpieczeń i Reasekuracji WARTA S.A. who sent an insurance policy to an unauthorized addressee by email. The document contained personal data concerning, among others, surnames, first name

### Enea S.A.: Insufficient fulfilment of data breach notification obligations

*Source: Polish National Personal Data Protection Office (UODO), 2021-01-11 — https://overview.legal/posts/46699 — original: https://www.enforcementtracker.com/ETid-584*

The Polish DPA (UODO) fined Enea S.A. EUR 30,000 for the controller's failure to report a personal data breach, in violation of Art. 33 (1) GDPR. The DPA received information about a personal data breach from a person who had become an unauthorized recipient of personal data. The breach consisted of sending an email with an unencrypted, non-password protected attachment that contained personal data of several hundred individuals. The sender of the email was an employee of the sanctioned controll

### HUNGARY DPA: Insufficient fulfilment of data breach notification obligations

*Source: Hungarian National Authority for Data Protection and the Freedom of Information (NAIH), 2019-06-25 — https://overview.legal/posts/46189 — original: https://www.enforcementtracker.com/ETid-74*

The data controller did not fulfil its data breach notification obligations when a flash memory with personal data was lost.

### Mayor of the City and Municipality of Myślenice: Insufficient fulfilment of data breach notification obligations

*Source: Polish National Personal Data Protection Office (UODO), 2026-04-30 — https://overview.legal/posts/83463 — original: https://www.enforcementtracker.com/ETid-3198*

The Polish DPA (UODO) fined the Mayor of the City and Municipality of Myślenice €1,790 for insufficient fulfilment of personal data breach notification obligations under Article 33(1) GDPR. The authority found that the public sector entity failed to properly comply with the requirement to notify the supervisory authority of a personal data breach within the prescribed 72-hour timeframe.

### Tusla Child and Family Agency: Insufficient fulfilment of data breach notification obligations

*Source: Data Protection Authority of Ireland, 2020-06-30 — https://overview.legal/posts/46435 — original: https://www.enforcementtracker.com/ETid-320*

The organization sent a letter with abuse allegations to a third party who then uploaded it to social networks.

### Court Bailiff: Insufficient fulfilment of data breach notification obligations

*Source: Polish National Personal Data Protection Office (UODO), 2025-10-23 — https://overview.legal/posts/49055 — original: https://www.enforcementtracker.com/ETid-2940*

The Polish DPA has imposed a fine of EUR 5,000 on a court bailiff. The controller forwarded a letter containing personal data to the wrong person, failing to inform either the affected data subjects or the DPA.

## Recent developments

### ANSPDCP (Romania) - Fine against GLOBAL CUSTOMER CARE SERVICES S.R.L

*Source: GDPRhub, 2026-10-09 — https://overview.legal/posts/593306 — original: https://gdprhub.eu/index.php?title=ANSPDCP_(Romania)_-_Fine_against_GLOBAL_CUSTOMER_CARE_SERVICES_S.R.L*

The DPA fined a controller RON 26,294 (€5,000) for failing to implement adequate security measures, which led to a breach affecting the confidentiality and availability of personal data following a cyberattack. English Summary. Facts. A personal data breach occurred because of a cyberattack on of a call centre service provider (the controller). Thus, the confidentiality and availability of personal data were compromised and unauthorised parties gained access to the personal data of a significant

### Hellenic DPA decision on a data breach involving E.E.T.A.A. S.A. as processor for the Ministry of Social Cohesion and Family Affairs

*Source: European Data Protection Board, 2026-10-08 — https://overview.legal/posts/593252 — original: https://www.edpb.europa.eu/news/hellenic-dpa-decision-on-a-data-breach-involving-eetaa-sa-as-processor-for-the-ministry-of_en*

Background informationDate of final decision: 28/07/2026National caseController: Ministry of Social Cohesion and Family AffairsLegal Reference(s): Article 25 (Data protection by design and by default), Article 28 (Processor), Article 32 (Security of processing), Article 33 (Notification of a personal data breach to the supervisory authority) and Article 34 (Communication of a personal data breach to the data subject)Decision: Administrative fine, Compliance order, Summary of the DecisionOrigin o

### EDPB meets with EU Commissioner McGrath and adopts common data breach notification template

*Source: European Data Protection Board, 2026-06-10 — https://overview.legal/posts/53059 — original: https://www.edpb.europa.eu/news/edpb-meets-with-eu-commissioner-mcgrath-and-adopts-common-data-breach-notification-template_en*

Brussels, 10 June – During its latest plenary, the EDPB met with Michael McGrath, Commissioner for Democracy, Justice, the Rule of Law and Consumer Protection. In addition, the Board has adopted a common data breach notification template.The Board held a meeting with Commissioner McGrath, engaging in a fruitful discussion about common priorities and ongoing work on areas of mutual interest.The Digital Omnibus was among the key topics that shaped the discussion. The Board reiterated that, while s

### Norway's DPA fines medical device company for breach notification violation

*Source: IAPP, 2023-03-22 — https://overview.legal/posts/6231 — original: https://iapp.org/news/a/norwegian-dpa-fines-medical-device-company-for-breach-notification-violation#entry-4175*

> 
																						Norway's data protection authority, the Datatilsynet, fined U.S.-based Argon Medical Devices 2.5 million kroner for failing to report a July 2021 data breach within the 72-hour deadline required by the EU General Data Protection Regulation. "This case is an important reminder that data controllers — including those established outside the (European Economic Area) — must have suitable measures in place to be able to immediately determine whether a breach of personal data

### WODC: Rapport Bescherming gegeven Evaluatie UAVG meldplicht datalekken en de boetebevoegdheid

*Source: News, 2022-06-30 — https://overview.legal/posts/6300 — original: https://www.rijksoverheids.nl/documenten/kamerstukken/2022/09/06/tk-aanbiedingsbrief-rapport-bescherming-gegeven-evaluatie-uavg-meldplicht-datalekken-en-de-boetebevoegdheid#entry-207*

> Het onderzoek laat zien dat de duidelijkheid en toegankelijkheid van de UAVG kritisch wordt beoordeeld. Mede de ‘beleidsneutrale’ invulling van de wet en de korte tijd waarin deze tot stand moest komen hebben daartoe geleid. Wanneer wordt bezien hoe AP en de jurisprudentie nader invulling hebben gegeven aan de normen in de wet is de conclusie dat dit deels is gebeurd, maar voor een ander deel ook nog verder dient te worden uitgewerkt. In het onderzoeksrapport worden daarvan op verschillende pl

## Literature

### European Union ∙ EDPB Adopts updated Guidelines on Personal Data Breach Notification under GDPR: The End of the One-Stop-Shop Reporting Mechanism for Non-EU Establishments

*Source: European Data Protection Law Review, 2022-01-01 — https://overview.legal/posts/132622 — original: https://doi.org/10.21552/edpl/2022/4/11*

### General Data Protection Regulation (GDPR) and Data Breaches: What You Should Know

*Source: Aesthetic Surgery Journal, 2018-10-29 — https://overview.legal/posts/132421 — original: https://doi.org/10.1093/asj/sjy296*

On May 25, 2018, the new General Data Protection Regulation (GDPR) enforced by the European Union and the United Kingdom Information Commissioner’s Office went into effect. Data protected by GDPR ranges from the relatively simple, such as email and IP addresses, to the highly sensitive, such as patient electronic health records. This recent regulation has resulted in a storm of activity by businesses and other data-collecting entities to comply with the requirements by updating privacy policies, opt-in notices, and email lists.1 How, if at all, does GDPR affect you? Generally speaking, the rules of GDPR differ somewhat from similar regulations in the United States, many of which are mandated on a state-by-state basis and involve varying definitions and remedies for a data breach.2 GDPR also differs in some respects from the Health Insurance Portability and Accountability (HIPAA) Breach Notification Rule issued by the US Department of Health and Human Services3 that details procedures by which covered entities and their business associates must provide notification following a breach of unsecured protected health information. Consider, however, that GDPR may have a broader definition of data breach than these other rules and that it protects the personal data rights of European Union citizens no matter where they live or where the breach occurs.1 Further, the widespread adoption of GDPR privacy standards by international companies may be a case of the “Brussels effect,” in which European laws and regulations are used as a global baseline.4 Therefore, wherever you conduct business, engage in research, or practice medicine, it is prudent to be aware of GDPR standards and their potential impact. The implications of GDPR for research and scholarly publishing entities are difficult and complex. Our subscribers, authors, and reviewers are located around the world, which means that this journal is clearly subject to GDPR rules. Our data security systems and procedures have always been robust, but we have taken all necessary steps to ensure that our data protection policies are completely GDPR-compliant. One of the greatest challenges for journals such as ours is to combine required diligence in data protection with the aim of increased transparency and accessibility in scientific research. Open science practices include sharing data sets as part of the publication process; this, of course, requires that such data be collected, stored, and shared in accordance with appropriate consent procedures and with ample regard for data sensitivity.1 Certainly, such concepts are not new. ASJ has always had a deep respect for data privacy and has, since its inception, implemented strict procedures to ensure confidentiality of sensitive data. In our case, GDPR simply serves to reinforce that obligation. Journal marketing practices must also be GDPR-compliant. This means that journals must obtain proper consent to store customer contact information and take measures to ensure that customers’ communication preferences are noted, kept current, and scrupulously adhered to. Although some may find a barrage of opt-in requests or opt-out offers somewhat annoying, such notifications allow consumers to specify their preferences for type and frequency of telemarketing, emails, e-alerts, and other communications.1 You undoubtedly will receive many such notices as businesses of all varieties struggle to meet GDPR requirements. Because violations of privacy standards—whether those established by GDPR, HIPAA, or the various states—can carry stiff financial penalties as well as result in loss of brand integrity, adherence to these standards is essential. In no instance is it more critical than in the case of healthcare providers. Clearly, although everyone in a position of responsibility with regard to patient data should be well familiar with applicable regulations for customer communications and data breach notification, even more important is preventing the compromise of data to begin with. Generally, any entity handling personal and sensitive data should ensure that the proper technical and organizational controls, meeting industry best practices, are in place to protect against a security breach.5 It has been reported that 95% of all breaches of enterprise networks enter through a spear phishing attack, that is, an email that is designed to appear legitimate but has a malicious attachment or link which, when selected, installs malware and attempts to access the user’s system. These spear phishing expeditions may often succeed in bypassing spam filters and antivirus engines. Experts recommend equipping your system with multiple antivirus engines, which should significantly increase malware detection rates. Other technologies, such as data sanitization and file type verification, may also be useful.6 Employee education, including training to identify vulnerabilities and risks, is vital. Most spear phishing emails will be sent to specific individuals within your organization, which enables the emails to avoid traditional spam filters. And if you think that healthcare entities are not among the preferred targets of malicious outsiders, think again! According to the 2014 Breach Level Index,7 the majority of data breaches by malicious outsiders were not for the purpose of stealing credit card information but, rather, for purposes of identity theft. Physicians and healthcare facilities should be aware that healthcare records are more valuable than credit card data; credit cards can easily be cancelled, but fraud using medical records is more difficult to identify and halt. Further, healthcare entities face the highest cost per stolen record—as high as $363, according to the Ponemon Institute.6 Healthcare facility data is often used to purchase drugs and even medical equipment, all of which can be sold on the black market for tremendous profit.8 Finally, in addition to preventive technology, organizational controls, and employee education, every responsible entity that manages personal and sensitive data should have in place a clear and comprehensive Incident Response Plan. This plan ought to specify all the members of the response team and each person’s exact responsibilities. It should include indicators for response escalation (notifying authorities, customers, media, etc. according to applicable regulations) and be tested for completeness and efficiency.5 Considering the increase in data breaches targeting healthcare entities, no plastic surgeon can afford to stick his or her head in the sand and simply hope for the best. You and virtually every member of your staff, as well as your software consultants, need to be actively engaged in the war against data breaches. Familiarize yourself with all applicable regulations (GDPR, HIPAA, and your individual state rules) that either already affect your practice or may do so. Differences in the various regulations may include: what the rule considers “covered information” (eg, what constitutes “personal information”); the definition of when a breach has occurred; the test for “harm threshold,” which may determine what subsequent actions are necessary; what constitutes a “safe harbor” (eg, the implementation of encryption); and specific notification requirements that must be adhered to with respect to timing, content, and methods.2 With regard to many issues of patient privacy, when there is a conflict between HIPAA and state law, whichever regulation provides the most protection for the patient typically is the one that takes precedence.9 As a footnote, I hasten to remind you that I am neither an IT expert nor a lawyer. The information included in this editorial should not be taken as specific legal or technical advice but, rather, as a general call to action. Each and every one of us should undertake a systematic review of data security. Employees who interface in any way with private data or the software managing that data must be properly trained to recognize and avoid possible breach attempts. Although not all such attacks are preventable, many are. The time and effort spent to fortify your defenses and mobilize your resources for remediation in the event of an attack is not only a wise initiative but, in today’s world, an absolutely necessary one. The author declared no potential conflicts of interest with respect to the research, authorship, and publication of this article. The author received no financial support for the research, authorship, and publication of this article.

### IMPACT OF GDPR ON UKRAINIAN PERSONAL DATA PROTECTION LEGISLATION

*Source: Pravo ta nauki, 2018-12-30 — https://overview.legal/posts/132472 — original: https://doi.org/10.66556/2522-4549.1519.koshovyi-b*

The article examines the impact of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation – GDPR), which entered into force on 25 May 2018, on Ukrainian personal data protection legislation. The main novelties of GDPR are analyzed, including the principle of accountability, the right to erasure (right to be

### GDPR: A new challenge for personal data protection

*Source: Bankarstvo, 2017-01-01 — https://overview.legal/posts/132473 — original: https://doi.org/10.5937/bankarstvo1704166m*

stručni članak Erne Mraznica Raiffeisen banka ad Beograd erne.mraznica@raiffeisenbank.rs GDPR - NOVI IZAZOV ZAŠTITE PODATAKA O LIČNOSTI Rezime Dana 4. maja 2016. godine objavljena je Opšta Uredba o zaštiti podataka o ličnosti u Sl. glasniku EU, koja će se primenjivati od 25. maja 2018. godine. Cilj propisa je harmonizacija zaštite podataka o ličnosti na nivou EU, veći stepen kontrole za lica čiji se podaci obrađuju i unapređeno upravljanje savremenim rizicima iz ove oblasti. Banke, po prirodi svog poslovanja, spadaju među najveće rukovaoce podataka o ličnosti i u postupku usklađivanja sa obavezama utvrđenih Uredbom biće u prilici da izvrše punu analizu svog postojećeg regulatornog i infrastrukturnog okvira zaštite podataka o ličnosti. Istovremeno, pruža im se prilika da isprave eventualne nedostatke u postojećim procesima, odnosno da značajno povećaju svest organizacije o standardima zaštite podataka o ličnosti, posebno imajući u vidu zaprećene stroge sankcije za slučaj neusklađenosti. Ključne reči : GDPR, podatak o ličnosti, osnovni principi, prava lica, rukovalac, obrada podataka, transfer podataka, sankcije, usklađivanje JEL : F52, G14 doi: 10.5937/bankarstvo1704166M 166 Bankars

### If it ain’t broke, don’t fix it? Ten improvements for the upcoming tenth anniversary of the General Data Protection Regulation

*Source: Computer law & security review, 2026-01-23 — https://overview.legal/posts/53843 — original: https://doi.org/10.1016/j.clsr.2025.106251*

As the General Data Protection Regulation (GDPR) approaches its tenth anniversary, the European legislator is considering reforms thereto. This article offers a set of research-based suggestions for what such reforms could look like, based on two assumptions. First, that the GDPR is overall a solid piece of legislation that upholds the enduring objectives and principles of data protection law. Second, that any improvement cannot compromise the level of protection of fundamental rights currently

## Related topics

- **Data Breaches** — https://overview.legal/topics/data-breaches
  Security incidents involving unauthorized access to personal data
- **Personal Data** — https://overview.legal/topics/personal-data
  Information relating to identified or identifiable natural persons
- **Controllers** — https://overview.legal/topics/controllers
  Entities that determine purposes and means of processing
- **Supervisory Authorities** — https://overview.legal/topics/supervisory-authorities
  National data protection authorities and their powers
- **Supervision** — https://overview.legal/topics/supervision
  Oversight and enforcement by supervisory authorities
- **Processing** — https://overview.legal/topics/processing
  Any operation performed on personal data

---
Generated by overview.legal · https://overview.legal/topics/notification-obligation · 2026-10-13