Poland

District Governor of Lubartów

4,960 €

GDPR enforcement action by Polish National Personal Data Protection Office (UODO) on 2026-05-25.

Rank · Sector

#275

of 397 in Public Sector and Education

Rank · Poland

#78

of 124

Rank · All fines

#1,997

of 3,280

Case details

Authority: Polish National Personal Data Protection Office (UODO)
Date: 2026-05-25
Controller / Processor: District Governor of Lubartów
Sector: Public Sector and Education
Quoted Articles: Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 25 (1) GDPR, Art. 28 (1) GDPR, Art. 32 (1), (2) GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Polish DPA has imposed a fine of EUR 4,958 on the District Governor of Lubartów. The controller had appointed a processor to carry out land consolidation work. This processor processed the personal data of data subjects on a laptop using specialist software. This data contained the names, parents' names, dates of birth, addresses and land register numbers of an undisclosed number of individuals. The laptop was then stolen from the processor's possession. The personal data was not encrypted; it was only protected within the software program. It was found that the controller had not carried out a risk assessment for the personal data being processed by the processor. Furthermore, the controller did not audit the processor to ensure adequate security and integrity guarantees for the data being processed. The infrigement lasted from January 2022 until December 2023. The processor was fined aswell.

Open original source Links to the regulator's original publication or another source.