breaches - DPO Hub

Personal data breaches – in practice

paid – 2 min read

A breach happens. What now? When are you "aware", how do you assess the risk – and who do you need to notify? 📝 Homework: download the revised breach flowchart, tailor it to your organisation and ensure you have a step-by-step process in place.

Mar 8, 2026

Personal data breaches

paid – 3 min read

…

Mar 1, 2026

Denmark Google Workspace for Education Chromebook case (Helsingørgate)

paid – 12 min read

🇩🇰 DPA concludes the case, applies the dreaded EDPB Opinion and signal enforcement change – and shares takeaways in webinar. Must-read if you're in Denmark but crucial to everyone using third-country processors, especially US ones.

Feb 13, 2026

Norway DPA orders Helseplattformen to rectify shortcomings

paid – 3 min read

Weird DPA conclusion on controller's responsibility 🤔, will wait for the final decision | 🇳🇴 Datatilsynet notifies Helseplattformen of their intent to order fixes to serious organisational and (less serious) technical deficiencies.

Jan 14, 2026

EDPB Support Pool of Experts (SPE) projects

paid – 6 min read

Latest: Legitimate interest OSS case digest.

Jan 1, 2026

UK ICO fines Capita £14 million for breach after weak security and slow reaction

paid – 8 min read

After first flagging a fine with a potential starting point of £97m, the 🇬🇧 DPA heavily reduced it after several mitigating factors we can all learn from. A decision packed with practical lessons for DPOs, data protection and security teams alike!

Oct 26, 2025

🇮🇪 DPC fines Meta €91m for failing to safeguard passwords and notify breaches

paid – 1 min read

UPDATE 1 Jan: Summary + full decision published! The DPC fines Meta for failing to safeguard users' passwords (storing them in plaintext!) and for notifying the breach too late.

Dec 30, 2024

CJEU C-768/21 Land Hessen (DPA obligation to act) 26 Sep 2024

paid – 3 min read

…

Dec 28, 2024

🇮🇪 DPC fines Meta €251m for failing on data protection by design and default and breach handling

paid – 1 min read

Meta failed to properly notify and document a breach affecting 3m EEA Facebook users and to build in data protection requirements throughout the design and development cycle.

Dec 18, 2024

Norway DPA fines university for insufficient access control in MS Teams

paid – 4 min read

The 🇳🇴 University of Agder was fined €12,500 (NOK 150k) for failing to secure personal data on Teams/SharePoint and insufficient internal controls. Short decision, several takeaways for everyone!

Sep 12, 2024

France: unemployment breach impacts 43m dating back 20 years

paid – 1 min read

🇫🇷 Massive breach and what we can learn immediately from it: data minimisation, deletion, breach response plans - and communication that people actually understand!

Mar 20, 2024

Sweden MedHelp 1177 case

paid – 8 min read

This case is not only a goldmine for DPOs in the Swedish healthcare sector (although particularly so), but DPOs in general, for assessing roles, legal bases and processor liability.

Feb 22, 2024