Authority
ICO
Country
United Kingdom
Date Issued
March 9, 2023
Industry
Finance
Summary
Gain Capital UK received a reprimand for failing to implement adequate security measures under Articles 32(1)(b) and 32(2) of UK GDPR after an unpatched software vulnerability allowed unauthorized access to personal data of 72,361 UK data subjects. The company had incorrectly relied on a third-party support contract for security updates when responsibility for patches remained with Gain Capital.
Violation Types
SecurityData BreachProcessor Obligations
Articles Violated
Related Enforcement Actions
Avoid enforcement risk with automated compliance
IQWorks helps organizations automate UK GDPR compliance before regulators come knocking.
Talk to an Expert