AEPD (Spain) - PS-00140-2025
Spain's AEPD fines a genomics company €2.4M for data protection and breach notification failures.
Spain's Data Protection Agency (AEPD) has fined a genomics and biotechnology company €2.4 million for failing to implement adequate security measures for sensitive genetic and health data. The company also violated GDPR by notifying the AEPD of a personal data breach after the mandatory 72-hour deadline. The AEPD highlighted deficiencies in password policies and optional multi-factor authentication as contributing factors.
AI summary of the linked source. Not reviewed by an editor. How this works
Run AEPD?
Get an email when a new story names AEPD, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA Spanish genomics and biotechnology company was fined €2.4 million by the AEPD for failing to adequately protect highly sensitive genetic and health data — among the most protected categories under GDPR. Weak password policies and optional (rather than mandatory) multi-factor authentication left the organization exposed to unauthorized access. Compounding the violation, the company failed to notify the AEPD within the mandatory 72-hour breach notification window, demonstrating a breakdown in incident response preparedness. This case underscores that organizations handling special category data under GDPR Article 9 face heightened obligations and significantly greater penalties when basic security hygiene and response procedures are neglected.
What helps against this
How we list vendors- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Security monitoring (SIEM)
Logs from everywhere end up in one place, with alerts that someone actually sees.
- Encryption and key management
Stolen data stays unreadable, and the keys stay under your control.