[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fal1Y-v6qWsTIzZziuo1RYgICqGw031z-DiG44L8XNEE":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":126},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"51d12726-2a12-4ece-bbf8-d111a1d0f336","AEPD (Spain) - PS-00240-2025","aepd-spain-ps-00240-2025-534b61","Created page with \"{{DPAdecisionBOX |Jurisdiction=Spain |DPA-BG-Color= |DPAlogo=LogoES.jpg |DPA_Abbrevation=AEPD |DPA_With_Country=AEPD (Spain) |Case_Number_Name=PS-00240-2025 |ECLI= |Original_Source_Name_1=AEPD |Original_Source_Link_1=https:\u002F\u002Fwww.aepd.es\u002Fdocumento\u002Fps-00240-2025.pdf |Original_Source_Language_1=Spanish |Original_Source_Language__Code_1=ES |Original_Source_Name_2= |Original_Source_Link_2= |Original_Source_Language_2= |Original_Source_Language__Code_2= |Type=Investigat...\" Show changes","Spain's Data Protection Agency (AEPD) has fined Vodafone España €750,000 for violating GDPR. The fine stems from a data breach affecting the 'Super WiFi' service, where Vodafone allowed a processor to begin operations before a valid data processing agreement was in place. The AEPD cited infringements of Articles 5(1)(f), 28, and 32 GDPR, considering previous sanctions against Vodafone as an aggravating factor.","Spain's AEPD fines Vodafone €750,000 for GDPR violations after a data breach.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_PS-00240-2025&diff=53139&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F5\u002F59\u002FLogoES.jpg","2026-09-22T10:24:56+00:00","2026-09-22T12:00:07.907341+00:00",7,[17,20],{"name":18,"type":19},"Vodafone","vendor",{"name":21,"type":22},"Super WiFi","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,34,39,41],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":40},{"id":23,"icon":25,"name":26,"slug":27},{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":49,"vendors":125},[50,79,108],{"slug":51,"name":52,"problem":53,"products":54},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[55,63,71],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","luna-hsm","Thales Luna HSM","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fhardware-security-modules","Hardware security modules for protecting cryptographic keys.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"utimaco","Utimaco","\u002Fvendor-logos\u002Futimaco.png","utimaco-hsm","Utimaco General Purpose HSM","https:\u002F\u002Futimaco.com\u002Fdata-protection\u002Fgp-hsm","Hardware security modules for key generation, storage and cryptographic operations.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"slug":80,"name":81,"problem":82,"products":83},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",[84,92,100],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"securityscorecard","SecurityScorecard","\u002Fvendor-logos\u002Fsecurityscorecard.png","security-ratings","SecurityScorecard Ratings","https:\u002F\u002Fsecurityscorecard.com\u002Fsolutions\u002Fuse-cases\u002Fsecurity-ratings\u002F","Outside-in security ratings and monitoring of suppliers.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"onetrust","OneTrust","\u002Fvendor-logos\u002Fonetrust.png","third-party-management","OneTrust Third-Party Management","https:\u002F\u002Fwww.onetrust.com\u002Fsolutions\u002Fthird-party-management\u002F","Supplier inventory, risk assessments and monitoring across privacy and security.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"bitsight","Bitsight","\u002Fvendor-logos\u002Fbitsight.png","bitsight-tprm","Bitsight Third-Party Risk Management","https:\u002F\u002Fwww.bitsight.com\u002Fproducts\u002Fthird-party-risk-management","Supplier assessments and continuous monitoring based on security ratings.",{"slug":109,"name":110,"problem":111,"products":112},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[113,119],{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":114,"product_name":115,"url":117,"description":118},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":120,"product_name":121,"url":123,"description":124},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",[],{"slug":127,"title":128,"body":129,"framework_refs":130,"framework_notes":141},"vodafone-espaa-fined-750k-for-allowing-processor-to-operate-without-valid-data-processing-agreement","Vodafone España Fined €750K for Allowing Processor to Operate Without Valid Data Processing Agreement","Vodafone España permitted a third-party data processor to begin handling personal data under its 'Super WiFi' service before a legally compliant Data Processing Agreement (DPA) was established, violating GDPR Articles 5(1)(f), 28, and 32. This failure represents a fundamental breakdown in vendor onboarding governance, where contractual and compliance controls were not verified before data flows commenced. The absence of a valid DPA means there were no enforceable obligations on the processor regarding data security, confidentiality, or breach notification. This case underscores that controllers remain fully accountable for processor activities, making pre-engagement due diligence a non-negotiable requirement. Repeat infringements, as seen here with prior Vodafone sanctions, attract aggravated penalties and signal systemic cultural or process failures to regulators.",[131,132,133,134,135,136,137,138,139,140],"GDPR Article 5(1)(f) – Integrity and confidentiality principle","GDPR Article 28 – Processor obligations and Data Processing Agreements","GDPR Article 32 – Security of processing","GDPR Article 83(4) – Administrative fines for Article 28 infringements","NIST SP 800-53 SA-9 – External System Services","NIST SP 800-53 CA-3 – System Interconnections","CIS Control 15 – Service Provider Management","ISO\u002FIEC 27001:2022 Annex A 5.19 – Information security in supplier relationships","ISO\u002FIEC 27001:2022 Annex A 5.20 – Addressing information security within supplier agreements","ITIL 4 – Supplier Management Practice",{}]