[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fyuYOIKfUDkPZy7VJVIAIPua9QwWwrETmxfLOnh5xD4k":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":68},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"c9d1e53e-f533-495b-8d44-b3db2df1d060","AEPD (Spain) - PS-00008-2025","aepd-spain-ps-00008-2025-7144e0","← Older revision Revision as of 07:05, 24 August 2026 Line 92: Line 92: }} }} he DPA fined a controller €60,000 for failing to comply with a corrective order requiring it to formalise and report its relationship with a processor. The DPA fined a controller €60,000 for failing to comply with a corrective order requiring it to formalise and report its relationship with a processor. == English Summary == == English Summary ==","Spain's data protection authority (AEPD) has fined RAMONA FILMS, S.L. €60,000 for failing to comply with a corrective order. The company was previously fined for GDPR infringements, including lacking a data processing agreement with a payment provider. The AEPD ordered RAMONA FILMS to formalize and report its relationship with the processor, but the company failed to provide the required agreement and instead submitted an unsigned, undated document, claiming joint controllership which was ultimately unsubstantiated.","Spain's AEPD fines RAMONA FILMS, S.L. €60,000 for non-compliance with a corrective order.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_PS-00008-2025&diff=52761&oldid=52752","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F5\u002F59\u002FLogoES.jpg","2026-08-24T07:05:18+00:00","2026-08-24T08:00:18.542622+00:00",7,[17,20],{"name":18,"type":19},"AEPD","vendor",{"name":21,"type":22},"RAMONA FILMS, S.L.","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,34,39,41],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":40},{"id":23,"icon":25,"name":26,"slug":27},{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":49,"vendors":67},[50],{"slug":51,"name":52,"problem":53,"products":54},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[55,61],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":56,"product_name":57,"url":59,"description":60},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":62,"product_name":63,"url":65,"description":66},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",[],{"slug":69,"title":70,"body":71,"framework_refs":72,"framework_notes":81},"spanish-dpa-fines-film-company-60000-for-ignoring-gdpr-corrective-order","Spanish DPA Fines Film Company €60,000 for Ignoring GDPR Corrective Order","RAMONA FILMS was fined €60,000 not merely for an initial GDPR violation, but for failing to comply with a corrective order issued by Spain's AEPD — a compounding failure that significantly increased their liability. The core issue was the absence of a lawful Data Processing Agreement (DPA) with a payment provider, a fundamental GDPR Article 28 requirement governing controller-processor relationships. Submitting an unsigned, undated document and mischaracterizing the relationship as joint controllership demonstrated both legal misunderstanding and a lack of internal compliance governance. This case illustrates that regulatory non-compliance does not simply go away — regulators escalate enforcement when organizations fail to remediate identified gaps. The reputational and financial consequences of ignoring corrective orders far outweigh the cost of proper compliance.",[73,74,75,76,77,78,79,80],"GDPR Article 28 (Processor obligations and Data Processing Agreements)","GDPR Article 26 (Joint Controllers)","GDPR Article 58 (Powers of supervisory authorities)","GDPR Article 83 (Conditions for imposing administrative fines)","NIST Privacy Framework PR.P-P4 (Data processing policies, processes, and procedures)","CIS Control 15 (Service Provider Management)","ISO\u002FIEC 27001 Annex A.15 (Supplier relationships)","ITIL Service Design — Supplier Management Practice",{}]