Ransomware at a home-care provider: notice, DPO independence and the missing DPIA
Zorgzaam Thuis is a Dutch home-care organisation with 400 staff and 2,300 clients. On Monday at 08:40 the IT manager finds ransomware on the file server holding care plans, medication schedules and staff rosters. The ransom note demands payment within 48 hours. Backups sat on a separate NAS reachable with the same administrator account; a test restore on Wednesday succeeded but the restore point is three weeks old. On Thursday the attackers post a sample of 20 client records on a leak site, including names, addresses and dementia diagnoses. The DPO is also the quality and safety manager, sits on the management team under the CFO and has no separate budget. The ROPA has not been updated since 2022, and no DPIA was done for the electronic medication module introduced in 2023. The board asks the DPO: 'Are we obliged to tell anyone?'
1. Advise on notification to the Dutch DPA and to clients and families, including timing and content.
Read the worked answer
This is a personal data breach under Article 4(12) - a confidentiality breach, now confirmed by publication, involving health data about vulnerable people. The risk is high: diagnosis disclosure, addresses, and potential identity or phishing misuse.
Supervisory authority (Article 33). Notify the Autoriteit Persoonsgegevens without undue delay and, where feasible, within 72 hours of awareness. Awareness of the breach, not certainty about its full extent, starts the clock. If the investigation is incomplete, file a phased notification under Article 33(4) within the deadline and supplement later - this is the correct route here rather than waiting.
Content (Article 33(3)): nature of the breach including categories and approximate numbers of data subjects and records; the DPO's contact details; likely consequences; measures taken and proposed, including containment, restore status and credential rotation.
Data subjects (Article 34). Where high risk is likely - clearly the case for the 20 published individuals and probably for the whole 2,300 - communicate without undue delay, in plain language: what happened, the DPO contact point, likely consequences, and what people should do (watch for unexpected contact, tell the organisation about suspicious calls). If individual contact is disproportionate, public communication is permitted, but here the client list exists, so direct contact is feasible.
Beyond GDPR. Report the extortion to the police, consider NIS2 obligations if the entity is in scope, and do not pay without legal advice; payment does not remove the notification duty.
2. What does the DPO's position tell you about Articles 37–39, and what are the practical consequences?
Read the worked answer
The arrangement breaches the independence requirements.
- Article 38(3): the DPO must report directly to the highest management level. Reporting to the CFO, who also controls budget and operational decisions, does not meet this.
- Article 38(6): the DPO must not be in a position that creates a conflict of interest. Combining DPO with quality and safety manager, and membership of the management team that decides on remediation, creates exactly that: the DPO would be monitoring measures they helped design and may have to justify.
- Article 38(1)–(2): the DPO needs the resources and expert support necessary to perform the role. No separate budget is evidence against.
- The DPO must be involved, properly and in a timely manner, in all matters relating to personal data protection (Article 38(1)) and must be consulted on the DPIA (Article 35(2)).
Consequences. Opinions the DPO gives may be discounted precisely where they matter. A DPO who is structurally conflicted cannot provide the independent assurance that Article 39 requires, and the organisation cannot demonstrate accountability under Article 5(2). This is an Article 83(4) infringement, and supervisory authorities commonly cite DPO conflicts as an aggravating factor when assessing other failures.
Fix. Separate the DPO function from operational management, or appoint an external DPO; give a direct reporting line to the board or supervisory body; provide a budget and access to legal and technical expertise; and record that the DPO was consulted here, with their advice minuted even if the board disagrees.
3. How do the missing DPIA and the outdated ROPA change the organisation's exposure?
Read the worked answer
They change the case from an incident to a pattern.
DPIA (Article 35). A DPIA is required where processing is likely to result in high risk. Electronic medication scheduling for 2,300 clients combines health data, vulnerable data subjects, scale and technology - squarely within Article 35(3) and the Dutch DPA's mandatory list. Running the module since 2023 without one is a standalone infringement, and it meant the risks that materialised (single administrator account, reachable backups) were never assessed or mitigated.
ROPA (Article 30). An outdated record means the organisation cannot show what it holds, where, or for how long - which also means the breach response had to rebuild the data map under time pressure.
Effect on the file. Under Article 5(2) and Article 24, the controller must be able to demonstrate compliance. Missing documents remove that ability and turn aggravating factors into the centre of the assessment; EDPB Guidelines 04/2022 treat failure to carry out a DPIA and poor records as factors increasing seriousness. Fines for Articles 30 and 35 sit in the Article 83(4) tier (up to EUR 10 million or 2%), separate from and additional to the Article 32 security finding.
Remediation order. Contain the breach; rotate credentials and separate backup access; notify; then build the ROPA, conduct the DPIA with the DPO, and adopt a documented backup and restore standard with tested recovery objectives.