Poland

Company

336,000 €

GDPR enforcement action by Polish National Personal Data Protection Office (UODO) on 2024-05-20.

Rank · Sector

#22

of 270 in Health Care

Rank · Poland

#11

of 111

Rank · All fines

#288

of 3,051

Case details

Authority: Polish National Personal Data Protection Office (UODO)
Date: 2024-05-20
Controller / Processor: Company
Sector: Health Care
Quoted Articles: Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 32 (1), (2) GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Polish DPA has imposed a fine of EUR 336,000 on a company. The company had suffered a ransomware attack on their systems which resulted in the loss of personal data. During its investigation the DPA found that the company had failed to install adequate technical and organizational measures to protect personal data, allowing such an attack to occur.

Open original source Links to the regulator's original publication or another source.