Following a question from THIS StackExchange about Data Protection Act application in the UK, there is an aspect about "proactivity" and "responsabilities" that I do not fully understand.

Let's assume for this example: On a given organization the person responsible for Data Protection Act compliance do all due dilligences up to his/her knowledge to make sure that the company is compliant with the UK-GDPR / Data Protection Act.

At one point, a third party discovers a vulnerability on the company's IT estructure that produces a data breach. That third party notifies the organization's DPO with the details of the data breach, but the DPO "do not believe" the info and just ignore the new information.

  1. Is that "bad practice"?
  2. Is this something regulated?
  3. Is there any responsible for "ignore that"?
  4. Who else should be notified?

1 Answer 1


The DPO clearly hasn’t done “all due diligence

Ignoring a potential security vulnerability of which you are aware is not due diligence, it’s negligence.

Article 5(1) imposes the following principle on data controllers:

(f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).”

I don’t think dismissing a tip-off without any investigation does this. We’re a breach to occur through this vulnerability the data controller could be successfully prosecuted and the DPO will likely need to bring their resume up to date.

  • from your comment I am still not sure about one detail. If a DPO with an "outdated resume" gets the notification and decided to "ignore it" because he/she doesn't believe it, then the DPO is taking putting the company in risk of get fines by the Authority. Right? Aug 29, 2022 at 9:34
  • 1
    @JaviM yes I am
    – Dale M
    Aug 29, 2022 at 9:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .