Details:
| Summary | The DPA’s decision shows that it took almost five months for the company to notify the data subjects of a data breach and almost three months for the DPA to receive a notification of a data breach concerning an security lack of IT systems of the company. |
| Link: | link |
| Related articles: | Art. 33 GDPR, Art. 34 GDPR |
| Type: | Insufficient fulfilment of data breach notification obligations |
| Fine: | EUR 18,700 |
| Sector | Public Sector and Education |
All data is based on The CMS’s Law GDPR Enforcement Tracker Source: https://www.enforcementtracker.com/