Slovenia

Unknown

5,500 €

GDPR enforcement action by Slovenian Supervisory Authority (Informacijski pooblaščenec) on 2026-02-16.

Rank · Sector

#89

of 218 in Not assigned

Rank · Slovenia

of 17

Rank · All fines

#1,675

of 3,050

Case details

Authority: Slovenian Supervisory Authority (Informacijski pooblaščenec)
Date: 2026-02-16
Controller / Processor: Unknown
Sector: Not assigned
Quoted Articles: Art. 32 GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Slovenian DPA has imposed a fine of EUR 5,500 on a unkonwn company and a responsible person within the company. The controller failed to implement adequate technical and organisational measures to ensure data security by giving employees access to customer data that was not necessary for them to fulfil their duties. This resulted in a data breach. Additionally, the controller had been warned regarding the information obligations under Art. 12 and Art. 13 GDPR. The fine had been split up into a fine in the amount of EUR 5,400 for the company and EUR 100 for the employee responsible.

Open original source Links to the regulator's original publication or another source.