Poland

Sole trader providing accounting and tax advisory services

2,760 €

GDPR enforcement action by Polish National Personal Data Protection Office (UODO) on 2026-06-13.

Rank · Sector

#273

of 332 in Finance, Insurance and Consulting

Rank · Poland

#91

of 114

Rank · All fines

#2,218

of 3,132

Case details

Authority: Polish National Personal Data Protection Office (UODO)
Date: 2026-06-13
Controller / Processor: Sole trader providing accounting and tax advisory services
Sector: Finance, Insurance and Consulting
Quoted Articles: Art. 5 (1) f), (2) GDPR, Art. 25 (1) GDPR, Art. 32 (1), (2) GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Polish DPA has imposed a fine of EUR 2,760 on a sole trader. An unauthorised third party had gained access to the controller's employee's email account. The aforementioned email account contained the personal data of the controller's clients, employees and their children. The controller used this information – containing names, dates of birth, addresses, email addresses, images, phone numbers, bank account details, passport information and tax data – to register the data subjects with the social insurance institution. The authority found that the controller had not implemented adequate security measures to protect this sensitive personal data.

Open original source Links to the regulator's original publication or another source.