A decision by the Data Protection Commission (DPC) highlights the consequences of failing to implement proper security measures and delaying breach notifications. Maynooth University was fined €40,000 following a data breach that compromised staff email accounts and led to financial fraud. The DPC found the university in breach of Articles 5(1)(f), 32(1), and 33(1) of the GDPR.
What happened?
Attackers gained control of up to six staff email accounts.
One compromised account was used to manipulate email rules, hiding messages from certain addresses.
This allowed fraudsters to deceive an employee, resulting in financial loss.
Maynooth University became aware of the breach in October 2018 but did not notify the DPC until over three weeks later.
An external security firm was engaged to assess the breach, delaying notification beyond the 72-hour GDPR deadline.
Why was this a problem?
The university lacked multi-factor authentication (MFA) for most email accounts, making it easier for attackers to gain access.
Outdated software and weak controls left email systems vulnerable to malware.
There were no clear policies on email security, password management, or staff training to mitigate such risks.
The delayed notification to the DPC prevented timely regulatory oversight and action to minimise harm.
What does this mean for your organisation?
This case serves as an important reminder that GDPR compliance requires proactive security measures and efficient breach handling procedures. Even public sector organisations are subject to enforcement if they fail to protect personal data adequately.
To avoid similar pitfalls, organisations must:
Implement MFA across all critical systems: Passwords alone are no longer sufficient.
Regularly update security software and apply patches: Unpatched systems are an easy target for attackers.
Establish strict policies on email security and access controls: Preventative measures can stop attacks before they happen.
Ensure breach reporting processes are in place: Delaying notification to assess the full impact of a breach can lead to regulatory penalties.
The takeaway?
Security failures and reporting delays are not just procedural missteps, they undermine trust, increase financial risk, and expose organisations to regulatory penalties. Maynooth University’s case reinforces that having some security measures in place is not enough; they must be comprehensive, up-to-date, and actively monitored.
This decision should prompt all organisations to re-evaluate their approach to cybersecurity and breach management. Are access controls strong enough? Is multi-factor authentication enforced? Are security patches applied regularly? Do staff receive practical, scenario-based training on email security?
Waiting until after a breach to identify weaknesses is a high-risk approach. Organisations must proactively test, refine, and reinforce their defences, before regulators, attackers, or financial losses force them to do so.
Tales from the coalface
Each month, we examine Data Protection issues encountered by our clients. This month, we focus on the risks of excessive data retention and why the ‘just in case’ approach to storing information can create more problems than it solves.
Many organisations struggle to let go of data, often keeping it far beyond what is necessary for business, legal, or regulatory purposes. Whether due to uncertainty, convenience, or a misplaced sense of security, excessive data retention increases legal, security, and operational risks, turning what seems like a harmless habit into a significant vulnerability.
The risk of retaining too much data:
Regulatory Non-Compliance: Under GDPR, data must be kept only for as long as necessary for the purpose it was collected. Holding onto data without a clear retention policy violates the data minimisation and storage limitation principles.
Increased Risk in Data Breaches: The more data an organisation retains, the greater the exposure in the event of a cyberattack or accidental leak. Attackers target organisations with large, unstructured datasets that haven’t been purged or secured properly.
Operational Inefficiencies: Outdated, redundant, and irrelevant data clutters systems, making it harder to manage current, valuable information. It also increases storage costs and slows down data retrieval processes.
Legal Liabilities: Retaining data past its lawful retention period means it could be subject to disclosure in legal proceedings, even if it should have been deleted long ago.
Why organisation hoard data:
Despite the risks, many organisation still hold onto data because:
They fear deleting something important.
There’s no clear retention policy or enforcement mechanism.
They believe more data means more business value, even if it’s outdated or unused.
Employees store copies of emails, files, and records without knowing if they should be retained or deleted.
How to fix it:
A data retention strategy isn’t just about deletion, it’s about control. Organisations should:
Define and enforce retention policies: Every category of data should have a clear retention period based on legal, business, and regulatory requirements.
Conduct data audits: Regularly review what’s stored, why it’s kept, and whether it should still be retained.
Implement automated retention and deletion rules: Where possible, use technology to enforce retention schedules and prevent unnecessary data build-up.
Train employees on data minimisation: Staff should know what data should be kept, what should be deleted, and how to handle retention requests.
Ensure defensible deletion: Deleting data must be secure, documented, and in line with retention policies to withstand regulatory scrutiny.
Holding onto data ‘just in case’ is not a strategy, it’s a risk waiting to happen. Without a clear retention policy, organisations open themselves up to regulatory penalties, security vulnerabilities, and operational inefficiencies. Unnecessary data storage doesn’t just take up space, it amplifies the risk of breaches, legal exposure, and rising storage costs.
Excessive data retention is often driven by fear, fear of deleting something important, fear of non-compliance, or fear of making the wrong decision. But in reality, the greater risk lies in keeping everything indefinitely. The more data an organisation stores, the harder it becomes to manage, secure, and justify its retention.
A well-defined, actively enforced data retention policy is not just a compliance requirement, it is a business necessity. It ensures that data is kept for the right reasons, securely disposed of when no longer needed, and handled in a way that reduces risk while supporting business objectives. Organisations that take a structured approach to data retention are not only protecting themselves from regulatory scrutiny but also improving efficiency, reducing costs, and strengthening their overall data governance.
Proactive data management is the key to minimising exposure, maintaining trust, and ensuring that data serves its intended purpose, nothing more, nothing less.
If your organisation needs support in reviewing retention policies, conducting data audits, or developing deletion strategies, Ambit Compliance can help.
Contributors to this blog:
Gillian Traynor and Dwayne Morgan
