An SEO plugin update exposed board reports, and the Data Protection Commission made three findings

In 2018 a small credit union in County Meath notified the Data Protection Commission of a breach. Board reports relating to membership enquiries, stored within its website, had become publicly available through search engine results.

The decision records the credit union's own account of the cause. A search engine optimisation tool installed on the website received an update that Slane Credit Union had not anticipated.

There was no attack. An update to a plugin changed what it exposed.

This piece is about the mechanism. Slane Credit Union is a small community body, and the decision is public.

The DPC found that the credit union broke Article 5(1)(f) and Article 32(1). It had not put in place technical and organisational measures giving a level of security appropriate to the risk.

It found that the credit union broke Article 24 and Article 30(1). It had not put in place organisational measures that took account of the nature, scope, context and purposes of the processing. And its record of processing did not include all the appropriate information.

And it found that the credit union broke Article 28(1) and (3). It had not done due diligence on its processor, the supplier processing personal data for it, and had no agreement with that processor meeting the requirements of Article 28(3).

The first finding is the security failure itself. The other two concern the record of processing and the processor. The processor was a sole trader the credit union had engaged to design and manage its website, and the decision says the failure on that side contributed to the breach.

An administrative fine of €5,000 for the infringement of Article 5(1)(f), the security principle.

A reprimand for all of the infringements. The record of processing and the processor agreement were not fined, but the reprimand formally covered them too.

A breach notification can lead a regulator to look at how you process personal data generally. Here, two of the three findings were about duties that exist before any breach: Article 30's record of processing and Article 28's processor agreement.

Article 28 requires a written contract with anybody who processes personal data on your behalf. It must set out the subject matter, duration, nature and purpose of the processing, the type of data, the categories of people, and your obligations and rights as the controller. Article 28 also requires you to use only processors that provide sufficient guarantees, which is the due diligence half.

In practice that can mean the hosting company, the email platform, the booking system, the analytics provider, the accountant's software, and a plugin vendor whose service handles the data. The agreement for each may sit inside the vendor's terms, waiting for you to accept it, and not come as a separate document.

Our own compliance record flags this automatically. When we ran it against ourselves on 29 August 2026, it returned eleven findings, each naming a processor holding data on our behalf with no agreement recorded.

Write the record of processing. It is the document the DPC found incomplete here.

List the processors and find the agreement for each. A missing agreement is a gap to close.

And then look at the website, because that is where this one started. A plugin that updates itself is a supplier making changes to your systems. Know which of yours do.