AEPD (Spain) - PS-00240-2025

Vodafone España suffered a data breach in its Super WiFi service and was fined €750,000 by Spain's AEPD for multiple GDPR violations, including inadequate security measures, absence of a valid data processor agreement, and falsely claiming encryption was in place. The lack of a proper Article 28 data processing agreement means third-party data processors were operating without legally required contractual safeguards, creating uncontrolled risk exposure for personal data. Misrepresenting security controls (such as claiming encryption that did not exist) is particularly serious as it undermines regulatory oversight and incident accountability. This case is aggravated by repeat offences in 2021 and 2022, demonstrating a systemic failure to embed a culture of data protection compliance. Organisations processing large volumes of personal data face heightened scrutiny and proportionally larger penalties when violations recur.