July 2026 GDPR Fine: the Employee Who Illegally Accessed a Client’s Accounts

GDPR 5 August 2026·7 min read·by Adriana Ceaușescu

In short: The Romanian DPA (ANSPDCP) fined Banca Transilvania RON 26,172 (€5,000) for breaching Art. 32 GDPR: an employee accessed a person’s bank statements — name, IBAN, account type, transactions and balance — with no work-related reason, at the request of a third party. The authority’s conclusion: the technical and organisational measures were not enough to prevent unauthorised access from the inside. The lesson for every company: defending against outside attacks is not enough — you must also control what your own employees can see.

What happened

It all started with a complaint from a person who reported that their data had been used unlawfully. Following the investigation, the authority found that a bank employee had accessed the person’s account statements — with no work duty justifying the access — at the request of a third party. Name, IBAN, account type, client code, transactions and balance were exposed.

The fine: RON 26,172, the equivalent of €5,000, for breaching Article 32(1), (2) and (4) GDPR. The bank paid it. Beyond the fine, the authority ordered corrective measures: putting in place technical and organisational measures that prevent this kind of access.

Why Article 32 is at the heart of the decision

Article 32 requires “security of processing”: technical measures (who can open what, access logs, alerts) and organisational ones (procedures, training, checks) appropriate to the risk. The key point of this decision: risk does not only come from outside. An employee with overly broad, unsupervised access rights is, in the eyes of the law, a vulnerability of the controller — not an excuse.

That is why the bank answers for it, not just the employee: the controller must build the system so that curiosity or “a favour for a friend” cannot turn into a data leak.

Where the system failed

Access broader than the actual need. The employee could open the accounts of a client they did not work with.
No alarm bell. The unjustified access was not detected by the bank — it was reported by the data subject.
The human factor. The request came from a third party — exactly the scenario we covered in our article on the human factor in GDPR: people are either the first line of defence or the weakest link.

Five measures that prevent exactly this scenario

Access on a need-to-know basis. Each role sees strictly the data required for the job — nothing more. Review rights on every role change and departure.
Logs and alerts. Every access to client data leaves a trace, and unusual access (a client outside the portfolio, unusual volume, odd hours) automatically raises a flag.
Written rules with consequences. A clear internal procedure: access without a work duty is forbidden and disciplined — and every employee signs it.
Recurring training. Not just at onboarding — regularly, with real cases like this one, because real cases change behaviour.
Periodic access audits. Regularly check who has access to what and who actually accessed what — before a complaint does it for you.

Manage GDPR compliance from a single application: askGDPR.ro is our compliance-management platform — records of processing (ROPA) and DPIAs generated and kept up to date, the incident register with the 72-hour breach-notification workflow, the security-measures register, audit-ready evidence (PDF/DOCX) and reminders for legal deadlines, plus an AI assistant grounded in your company’s context. Beyond GDPR, it also covers ISO 27001, NIS2, DORA, TISAX, AI Act, EcoVadis and Brand Watch. Start with a free compliance self-assessment. For staff training, the courses on cursuri.infoshare.ro come with certificates and audit-ready records.

The amount looks small for a bank. The message is not: the Romanian DPA consistently sanctions unauthorised internal access, and a single complaint is enough to trigger an investigation in which the controller must show all its measures. Those who have them get off lightly. Those who do not pay twice: the fine, and their clients’ trust.

Frequently asked questions

Why was the bank fined, and not the employee?

Because the GDPR places responsibility on the controller: the company must implement measures that prevent unauthorised access, including by its own employees. The employee may face separate disciplinary or criminal liability, but the administrative fine targets the controller that did not protect its data well enough.

What exactly does Article 32 GDPR require?

Technical and organisational measures appropriate to the risk: access control, access logging, regular testing of the measures, internal procedures and staff training. There is no single mandatory checklist — the controller chooses measures fit for its activity, but must be able to demonstrate they are sufficient.

How do I find out whether my employees can access data without my knowledge?

Through an audit of access rights (who can access what, and why) and of the logs (who actually accessed what). If your systems keep no access logs, that is the first problem to fix — without them you can neither detect nor prove anything.

Do you know who can access the data in your company?

We audit your access rights and security measures together, with concrete remediation steps — before a complaint does it for you. Get in touch.