31Therefore, Articles 24 and 32 of the GDPR cannot be understood as meaning that unauthorised disclosure of personal data or unauthorised access to such data by a third party are sufficient to conclude that the measures adopted by the controller concerned were not appropriate, within the meaning of those provisions, without even allowing that controller to adduce evidence to the contrary.
Source: EUR-Lex, © European Union, 1998-2026. Reuse authorised under Decision 2011/833/EU.