[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ffMtlXR0PN3-vI_hxQGQcQfuUghGj3mNCKVFDWN5eEkE":3},{"article":4,"iocs":44,"watch_terms":45,"solutions":46,"lesson":135},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"c0054523-0637-4e4b-b5ec-83f9d7e700f2","AEPD (Spain) - PS-00240-2025","aepd-spain-ps-00240-2025-eba739","← Older revision Revision as of 14:14, 22 September 2026 Line 92: Line 92: }} }} The DPA fined Vodafone €750,000 for infringing Articles 5(1)(f), 28 and 32 GDPR after a data breach affecting the \"Super WiFi\" service, finding inadequate security and that processing began without a valid processor agreement. The DPA fined Vodafone €750,000 for infringing [[Article 5 GDPR|Articles 5(1)(f)]], [[Article 28 GDPR|28]] and [[Article 32 GDPR|32 GDPR]] after a data breach affecting the \"Super WiFi\" service, finding inadequate security and that processing began without a valid processor agreement. == English Summary == == English Summary ==","Spain's Data Protection Authority (AEPD) fined Vodafone España €750,000 for violations of GDPR Articles 5(1)(f), 28, and 32 following an unauthorized data access incident affecting the Super WiFi service. The DPA found that Vodafone failed to implement adequate security measures, processed data without a valid processor agreement (the agreement was only signed in September 2024, months after the November 2023 breach), and could not demonstrate proper encryption or audit controls of the third-party processor.","Spain's AEPD fines Vodafone €750K for inadequate security and missing processor agreement in Super WiFi breach.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_PS-00240-2025&diff=53153&oldid=53148","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F5\u002F59\u002FLogoES.jpg","2026-09-22T14:14:12+00:00","2026-09-22T16:00:38.482678+00:00",8,[17,20],{"name":18,"type":19},"Vodafone","vendor",{"name":21,"type":22},"Super WiFi","product","3f0f8451-91df-4b6c-9a73-ef3b2509b7f1",{"id":23,"icon":25,"name":26,"slug":27},null,"GDPR","gdpr",[29,34,39],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":40},{"id":41,"icon":25,"name":42,"slug":43},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":47,"vendors":134},[48,76,105],{"slug":49,"name":50,"problem":51,"products":52},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[53,61,68],{"vendor_slug":54,"vendor_name":55,"vendor_logo":56,"product_slug":57,"product_name":58,"url":59,"description":60},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":49,"product_name":65,"url":66,"description":67},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"slug":77,"name":78,"problem":79,"products":80},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[81,89,97],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","ciphertrust","CipherTrust Data Security Platform","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fdata-security-platform","Data discovery, encryption and central key management across on-premises and cloud.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"utimaco","Utimaco","\u002Fvendor-logos\u002Futimaco.png","utimaco-hsm","Utimaco General Purpose HSM","https:\u002F\u002Futimaco.com\u002Fdata-protection\u002Fgp-hsm","Hardware security modules for key generation, storage and cryptographic operations.",{"slug":106,"name":107,"problem":108,"products":109},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",[110,118,126],{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"securityscorecard","SecurityScorecard","\u002Fvendor-logos\u002Fsecurityscorecard.png","security-ratings","SecurityScorecard Ratings","https:\u002F\u002Fsecurityscorecard.com\u002Fsolutions\u002Fuse-cases\u002Fsecurity-ratings\u002F","Outside-in security ratings and monitoring of suppliers.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"bitsight","Bitsight","\u002Fvendor-logos\u002Fbitsight.png","bitsight-tprm","Bitsight Third-Party Risk Management","https:\u002F\u002Fwww.bitsight.com\u002Fproducts\u002Fthird-party-risk-management","Supplier assessments and continuous monitoring based on security ratings.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"upguard","UpGuard","\u002Fvendor-logos\u002Fupguard.png","upguard-vendor-risk","UpGuard Vendor Risk","https:\u002F\u002Fwww.upguard.com\u002Fproduct\u002Fvendor-risk","Supplier security questionnaires, ratings and continuous monitoring.",[],{"slug":136,"title":137,"body":138,"framework_refs":139,"framework_notes":152},"vodafone-espaa-fined-750k-for-inadequate-third-party-data-processor-controls","Vodafone España Fined €750K for Inadequate Third-Party Data Processor Controls","Vodafone España suffered an unauthorized data access incident in November 2023 affecting its Super WiFi service, but critically had no valid data processing agreement with the third-party processor until September 2024 — nearly a year after the breach. This violated GDPR Articles 5(1)(f), 28, and 32, which require confidentiality safeguards, formal processor contracts, and appropriate technical\u002Forganizational security measures. The absence of verifiable encryption and audit controls over the third-party processor compounded the failure, demonstrating that outsourcing data processing does not transfer regulatory responsibility. This case underscores that organizations remain fully accountable for how processors handle personal data and must have governance structures in place before processing begins, not after an incident forces the issue.",[140,141,142,143,144,145,146,147,148,149,150,151],"GDPR Article 5(1)(f) – Integrity and Confidentiality","GDPR Article 28 – Processor obligations and Data Processing Agreements","GDPR Article 32 – Security of processing","GDPR Article 33 – Notification of a personal data breach","NIST SP 800-171 r2 – 3.13 System and Communications Protection","NIST CSF PR.AT-3 – Third-party stakeholder awareness","NIST CSF ID.SC-4 – Supplier risk assessment","CIS Control 15 – Service Provider Management","CIS Control 3 – Data Protection","ISO\u002FIEC 27001:2022 – Annex A 5.19 Information security in supplier relationships","ISO\u002FIEC 27001:2022 – Annex A 5.20 Addressing information security within supplier agreements","ITIL 4 – Supplier Management Practice",{}]