- Enforcing jurisdiction
- Poland · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Santander Bank Polska S. A. – €117,000 Fine (Poland, 2022)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
Santander Bank Polska S.A. was fined EUR 117,000 for not notifying customers about a data breach that exposed their information. A former employee accessed sensitive data, and the bank failed to inform affected customers, preventing them from taking protective actions. This case highlights the critical need for timely communication with customers regarding data breaches.
What happened
Santander Bank Polska S.A. was fined for failing to notify customers of a data breach that compromised their personal data.
Who was affected
Santander customers whose personal data was accessed without their knowledge due to the bank's failure to notify them.
What the authority found
The Polish DPA found that Santander Bank did not fulfill its obligation to inform customers about the data breach, violating GDPR requirements.
Why this matters
This case emphasizes the importance of transparency and timely communication with customers in the event of a data breach. Companies must have clear protocols for notifying affected individuals.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Review needed — 6 March 2026.
Processing notes: amount discrepancy.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Polish DPA has fined Santander Bank Polska S.A. EUR 118,000 for failing to notify data subjects of a data breach. A former employee of the bank managed to gain unauthorized access to a database for electronic services. Among other things, this allowed numerous Santander customers' data to be accessed. Due to the high risk for the data of the data subjects, the bank would have been obliged to inform them of the data breach. However, the bank deliberately refrained from doing so and continued to state that it would not comply with this obligation in the future. The DPA noted that this constituted a major intrusion for the data subjects, as they did not have the opportunity to take appropriate steps to protect their rights.
Related Enforcement Actions (0)
No other enforcement actions found for Santander Bank Polska S. A. in PL
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
19 January 2022
Authority
Urząd Ochrony Danych Osobowych
Fine Amount
€117,000
Enforcement Tracker ID
ETid-1085
About this data
Cite as: Cookie Fines. Santander Bank Polska S. A. - Poland (2022). Retrieved from cookiefines.eu
Last updated: