University of Limerick fined €98,000: lessons for managing cybersecurity and GDPR compliance

Six of the incidents resulted from successful phishing attacks that compromised staff email accounts, exposing a wide range of personal data relating to students, staff and third parties. The case provides detailed insights into the DPC’s expectations around security measures, record‑keeping and breach‑handling processes.

Following its inquiry, the Irish Data Protection Commission (“DPC”) published its final decision, focusing on four main infringements:

1. Failure to implement appropriate technical and organisational measures

The DPC found that UL’s security controls did not meet the standards required under articles 5(1)(f) and 32 GDPR. While UL had introduced several security tools, including a DNS firewall, Fortinet devices, email filtering and limited multi‑factor authentication (MFA), these measures were not sufficient to mitigate the risks.

Key weaknesses identified included:

• no fully layered email‑security approach
• lack of domain‑based authentication mechanisms
• non‑mandatory cybersecurity training for staff
• filtering systems that relied heavily on blacklisting and failed to detect malicious links embedded in images
• MFA not enforced for all users
• the ability to auto‑forward emails externally, which attackers exploited
• a data protection policy that was still in draft form during the first breach, with the previous version predating the GDPR
• key policies only introduced or updated after breaches occurred

These findings highlight the importance of proactive and fully implemented technical controls, supported by mandatory training and up‑to‑date governance documentation.

2. Failure to maintain an adequate record of processing activities (RoPA)

Under article 30 GDPR, organisations must maintain a complete and accurate RoPA. The DPC found that UL’s RoPA lacked:

• sufficient detail on categories of data subjects
• types of personal data processed
• descriptions of security measures
• records of processing carried out through staff email accounts

These omissions undermined UL’s ability to demonstrate compliance and maintain oversight of high‑risk processing.

3. Delayed notification of personal data breaches

The GDPR requires controllers to notify supervisory authorities of personal data breaches within 72 hours. UL failed to meet this requirement in multiple cases, including one breach reported 10 days after discovery.

The DPC rejected internal communication delays as a justification, noting that:

• the 72‑hour deadline begins when the controller becomes aware of the breach
• weekends and public holidays do not pause the notification clock
• internal reporting structures must be designed to prevent delays

This finding reinforces that timely breach notification is a strict obligation and cannot be deferred for operational reasons.

4. Delays in informing affected individuals

Where a breach poses a high risk to individuals, article 34 requires organisations to notify affected data subjects without undue delay. UL failed to do so in three cases.

In one example, UL identified a breach as high risk in March 2019 but did not notify affected individuals until September 2019, waiting for the outcome of an external investigation. The DPC acknowledged the value of thorough investigations but stressed that they must not delay individuals’ ability to take protective steps such as resetting passwords or monitoring accounts.

Outcome and mitigation

The DPC imposed a €98,000 fine, noting that UL’s cooperation, acceptance of responsibility and proactive improvements to systems, policies and training helped reduce the final amount. The case reinforces the importance of:

• modern, layered security controls
• accurate, comprehensive records of processing
• clear internal breach‑reporting lines
• prompt communication with affected individuals

These findings serve as a reminder that both technical controls and organisational processes must operate effectively and consistently to meet GDPR requirements.