Poland

Land-surveying office

2,951 €

GDPR enforcement action by Polish National Personal Data Protection Office (UODO) on 2026-05-25.

Rank · Sector

#308

of 379 in Public Sector and Education

Rank · Poland

#92

of 118

Rank · All fines

#2,224

of 3,152

Case details

Authority: Polish National Personal Data Protection Office (UODO)
Date: 2026-05-25
Controller / Processor: Land-surveying office
Sector: Public Sector and Education
Quoted Articles: Art. 28 (3) c), f) GDPR, Art. 32 (1), (2) GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Polish DPA has imposed a fine of EUR 2,951 on a land-surveying office. The controller, the district governor, had appointed land-surveying office to carry out land consolidation work. This processor processed the personal data of data subjects on a laptop using specialist software. This data contained the names, parents' names, dates of birth, addresses and land register numbers of an undisclosed number of individuals. The laptop was then stolen from the processor's possession. The personal data was not encrypted; it was only protected within the software program. It was found that, although the processor had carried out risk assessments in the years before, it had not put in lpace safeguards, mitigating the risks found in those assessments. The infrigement lasted from January 2022 until December 2023. The controller was fined aswell.

Open original source Links to the regulator's original publication or another source.