[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f26Vzu5BdY6EXVDpIRDyEMc72OOWqopdKxuvRrsWSLn8":3},{"article":4,"iocs":44,"watch_terms":45,"solutions":46,"lesson":66},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"bcd99df3-9de2-4b6e-a045-704d33dcfa5f","AN - SAN 3154\u002F2026","an-san-3154-2026-434915","Fixed link ← Older revision Revision as of 07:35, 16 September 2026 Line 15: Line 15: |Original_Source_Name_1=Cendoj |Original_Source_Name_1=Cendoj |Original_Source_Link_1=https:\u002F\u002Fwww.poderjudicial.es\u002Fsearch\u002FAN\u002FopenDocument\u002Ff0c803f2dd5f80a0a0a8778d75e36f0d\u002F20260729 |Original_Source_Link_1=https:\u002F\u002Fwww.poderjudicial.es\u002Fsearch\u002FAN\u002FopenDocument\u002Ff0c803f2dd5f80a0a0a8778d75e36f0d\u002F20260729 |Original_Source_Language_1=Spanish; Castilian |Original_Source_Language_1=Spanish |Original_Source_Language__Code_1=ES |Original_Source_Language__Code_1=ES","The Spanish National Court upheld a €25,000 fine against KFC Restaurants Spain for violating GDPR. The violations included providing unspecific privacy information on their website and failing to appoint a Data Protection Officer (DPO) despite systematic monitoring of users. KFC was found to have provided generic details about data processing, recipients, and retention periods, and did not clearly link to its privacy policy.","KFC Spain fined €25,000 for GDPR violations related to privacy information and DPO appointment.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AN_-_SAN_3154\u002F2026&diff=53073&oldid=52594","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F4c\u002FCourts_logo1.png","2026-09-16T07:35:47+00:00","2026-09-16T08:00:14.726099+00:00",8,[17,20],{"name":18,"type":19},"KFC","vendor",{"name":21,"type":22},"KFC Restaurants Spain, S.L.U.","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,34,39],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":40},{"id":41,"icon":25,"name":42,"slug":43},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":47,"vendors":65},[48],{"slug":49,"name":50,"problem":51,"products":52},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[53,59],{"vendor_slug":54,"vendor_name":55,"vendor_logo":56,"product_slug":54,"product_name":55,"url":57,"description":58},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":60,"product_name":61,"url":63,"description":64},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",[],{"slug":67,"title":68,"body":69,"framework_refs":70,"framework_notes":81},"kfc-spain-fined-25000-for-gdpr-violations-over-vague-privacy-notices-and-missing-dpo","KFC Spain Fined €25,000 for GDPR Violations Over Vague Privacy Notices and Missing DPO","KFC Restaurants Spain was penalised by the Spanish National Court for failing to meet basic GDPR transparency requirements, including providing generic and unspecific privacy information on their website and not appointing a mandatory Data Protection Officer (DPO). When an organisation systematically monitors users — as KFC was found to do — GDPR Article 37 requires the appointment of a DPO, and this obligation cannot be overlooked. Vague privacy notices undermine individuals' rights to understand how their data is used, violating GDPR Articles 13 and 14. This case highlights that GDPR compliance is not a one-time checkbox but an ongoing operational responsibility that affects customer-facing digital assets directly. Organisations of all sizes in the food and retail sector must treat privacy governance as a core business function, not an afterthought.",[71,72,73,74,75,76,77,78,79,80],"GDPR Article 13 – Information to be provided where personal data are collected from the data subject","GDPR Article 14 – Information to be provided where personal data have not been obtained from the data subject","GDPR Article 37 – Designation of the data protection officer","GDPR Article 38 – Position of the data protection officer","GDPR Article 83(4) – Administrative fines for infringements of DPO obligations","NIST Privacy Framework PR.PO-P1 – Policies, processes, and procedures for managing data are established","NIST SP 800-53 PT-2 – Authority to Process Personally Identifiable Information","CIS Control 3 – Data Protection (Data Classification and Handling)","ISO\u002FIEC 27701:2019 – Privacy Information Management System (PIMS)","ITIL Service Design – Information Security and Privacy Policy Management",{}]