An analysis of risks that fails to include obvious threats, such as human error, is deemed insufficient and results in a violation of the obligations of security and data protection by design.

Facts and context

The Polish data protection authority (UODO) published on November 2, 2026, a sanction decision against the Poznań School of Logistics, including the imposition of a fine of 64,652 zł (approximately €15,035), for breaches related to the security of personal data processing.

The case originated from a data breach notification by the school itself, following the accidental publication by an employee of a file containing detailed data of 964 students on the dean's online platform.

Reasons for the decision

• Obligation to ensure the security of processing and data protection by design (Article 24, paragraph 1, Article 25, paragraph 1 and Article 32, paragraphs 1 and 2 of the GDPR): The authority found that the controller had not implemented appropriate technical and organizational measures to ensure a level of security appropriate to the risk. Indeed, the risk analysis conducted before the incident, although considering threats such as hardware failures or viruses, did not include the threat of accidental data disclosure by an employee. The authority emphasized that even after the breach, the updated risk analysis was not corrected to include this proven threat, retaining the same risk catalog as before. Consequently, the choice of security measures was arbitrary and inadequate, violating the principles of data protection by design and security of processing. Furthermore, the school could not provide any documentary evidence of the controls it claimed to have performed to verify communications, thus failing its obligation to demonstrate compliance.

Authority's decision

As a result, the authority imposed a fine of 64,652 zł (approximately €15,035) on the Poznań School of Logistics.

Moreover, the authority ordered the school to bring its processing operations into compliance with the GDPR. This compliance involves conducting a comprehensive risk analysis and implementing appropriate technical and organizational measures to minimize identified risks, taking into account the state of knowledge, implementation costs, and the nature of the processing.

Lessons learned

This decision reminds that:

• A risk analysis must be exhaustive and include foreseeable threats such as human error; its scope cannot be limited to technical risks alone such as hardware failures or cyberattacks.
• The occurrence of a security incident must imperatively lead to a reassessment and update of the risk analysis to include the threat that materialized.
• The accountability obligation requires documenting the control and verification measures implemented; mere assertions without evidence are insufficient to demonstrate compliance.