AEPD (Spain) - PS-00240-2025
Spain's AEPD fines Vodafone €750,000 for GDPR violations after a data breach.
Spain's data protection authority (AEPD) has fined Vodafone €750,000 for multiple GDPR violations following a data breach affecting its 'Super WiFi' service. The violations include inadequate security measures and allowing a processor to begin operations before a valid data processing agreement was in place. The AEPD cited previous sanctions against Vodafone as an aggravating factor.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Vodafone?
Get an email when a new story names Vodafone, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonVodafone Spain was fined €750,000 after its 'Super WiFi' service suffered a data breach compounded by two critical governance failures: inadequate technical and organizational security measures, and allowing a data processor to begin handling personal data before a valid Data Processing Agreement (DPA) was in place. Allowing a vendor to operate without a formal DPA is a direct violation of GDPR Article 28, which mandates that processing by a third party must be governed by a binding contract. This case illustrates that breaches are not solely a technical problem — contractual and procedural gaps in vendor onboarding can independently trigger significant regulatory penalties. The AEPD's decision to treat Vodafone's prior sanctions as an aggravating factor underscores that repeat offenders face escalating consequences, making proactive compliance culture essential.
What helps against this
How we list vendors- Encryption and key management
Stolen data stays unreadable, and the keys stay under your control.
- Third-party risk management (TPRM)
You know which suppliers could hurt you, and you hear quickly when one of them is breached.
- Compliance automation (GRC)
Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.