In the event of a security incident or a complaint from a data subject, the Office for Personal Data Protection will initiate proceedings to determine whether the data controller has breached any of its obligations or whether the breach could have been avoided.
In deciding on a sanction, the Office will then assess, inter alia, how the data controller has cooperated in the proceedings in question or what evidence and arguments it has provided in its defence. Proper representation in the proceedings before the Office for Personal Data Protection is therefore a guarantee to minimise any possible sanction.