AEPD (Spain) - PS-00008-2025
Spain's AEPD fines RAMONA FILMS, S.L. €60,000 for non-compliance with a corrective order.
Spain's data protection authority (AEPD) has fined RAMONA FILMS, S.L. €60,000 for failing to comply with a corrective order. The company was previously fined for GDPR infringements, including lacking a data processing agreement with a payment provider. The AEPD ordered RAMONA FILMS to formalize and report its relationship with the processor, but the company failed to provide the required agreement and instead submitted an unsigned, undated document, claiming joint controllership which was ultimately unsubstantiated.
AI summary of the linked source. Not reviewed by an editor. How this works
Run AEPD?
Get an email when a new story names AEPD, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonRAMONA FILMS was fined €60,000 not merely for an initial GDPR violation, but for failing to comply with a corrective order issued by Spain's AEPD — a compounding failure that significantly increased their liability. The core issue was the absence of a lawful Data Processing Agreement (DPA) with a payment provider, a fundamental GDPR Article 28 requirement governing controller-processor relationships. Submitting an unsigned, undated document and mischaracterizing the relationship as joint controllership demonstrated both legal misunderstanding and a lack of internal compliance governance. This case illustrates that regulatory non-compliance does not simply go away — regulators escalate enforcement when organizations fail to remediate identified gaps. The reputational and financial consequences of ignoring corrective orders far outweigh the cost of proper compliance.
What helps against this
How we list vendors- Compliance automation (GRC)
Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.