AN - SAN 3154/2026

KFC Restaurants Spain was penalised by the Spanish National Court for failing to meet two fundamental GDPR obligations: providing clear, specific privacy information to customers and appointing a Data Protection Officer despite systematically monitoring customer data. The court ruled that KFC's privacy notices were too vague and generic to satisfy the transparency requirements under GDPR Articles 13 and 14, meaning customers lacked meaningful understanding of how their data was being used. The absence of a DPO — required when large-scale or systematic monitoring of individuals is integral to core business activities — compounded the compliance failure. This case demonstrates that data protection compliance must be embedded into business operations, not treated as a checkbox exercise with boilerplate legal text. Organisations handling customer data at scale face significant legal and reputational risk when governance structures and transparency obligations are neglected.