[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f_3_bIeSojbNes6gX215HHf0F1Wk6ptddU-uxUH-w9G8":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":68},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"80d06281-b9d6-44bb-9d20-c774170e24fa","AN - SAN 3154\u002F2026","an-san-3154-2026-f6f03f","Created page with \"{{COURTdecisionBOX |Jurisdiction=Spain |Court-BG-Color= |Courtlogo=Courts_logo1.png |Court_Abbrevation=AN |Court_Original_Name=Audiciencia Nacional |Court_English_Name=National Court |Court_With_Country=AN (Spain) |Case_Number_Name=SAN 3154\u002F2026 |ECLI=ECLI:ES:AN:2026:3154 |Original_Source_Name_1=Cendoj |Original_Source_Link_1=https:\u002F\u002Fwww.poderjudicial.es\u002Fsearch\u002FAN\u002FopenDocument\u002Ff0c803f2dd5f80a0a0a8778d75e36f0d\u002F20260729 |Original_Source_Language_1=Spanish; Castilian |O...\" Show changes","The Spanish National Court has upheld a €25,000 fine against KFC Restaurants Spain for violating GDPR. The violations included providing insufficient privacy information and failing to appoint a Data Protection Officer (DPO) despite systematic monitoring of customer data. The court found KFC's privacy notices too generic and that data processing was integral to its online and customer management activities, necessitating a DPO.","Spanish court upholds €25,000 fine against KFC for GDPR violations.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AN_-_SAN_3154\u002F2026&diff=52566&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F4c\u002FCourts_logo1.png","2026-07-31T14:03:04+00:00","2026-07-31T16:00:25.5463+00:00",7,[17,20],{"name":18,"type":19},"KFC","vendor",{"name":21,"type":22},"KFC Restaurants Spain, S.L.U.","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,34,39,41],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":40},{"id":23,"icon":25,"name":26,"slug":27},{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":49,"vendors":67},[50],{"slug":51,"name":52,"problem":53,"products":54},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[55,61],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":56,"product_name":57,"url":59,"description":60},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":62,"product_name":63,"url":65,"description":66},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",[],{"slug":69,"title":70,"body":71,"framework_refs":72,"framework_notes":84},"kfc-spain-fined-25000-for-gdpr-violations-over-inadequate-privacy-notices-and-missing-dpo","KFC Spain Fined €25,000 for GDPR Violations Over Inadequate Privacy Notices and Missing DPO","KFC Restaurants Spain was penalised by the Spanish National Court for failing to meet two fundamental GDPR obligations: providing clear, specific privacy information to customers and appointing a Data Protection Officer despite systematically monitoring customer data. The court ruled that KFC's privacy notices were too vague and generic to satisfy the transparency requirements under GDPR Articles 13 and 14, meaning customers lacked meaningful understanding of how their data was being used. The absence of a DPO — required when large-scale or systematic monitoring of individuals is integral to core business activities — compounded the compliance failure. This case demonstrates that data protection compliance must be embedded into business operations, not treated as a checkbox exercise with boilerplate legal text. Organisations handling customer data at scale face significant legal and reputational risk when governance structures and transparency obligations are neglected.",[73,74,75,76,77,78,79,80,81,82,83],"GDPR Article 13 – Information to be provided where personal data are collected from the data subject","GDPR Article 14 – Information to be provided where personal data have not been obtained from the data subject","GDPR Article 37 – Designation of the Data Protection Officer","GDPR Article 38 – Position of the Data Protection Officer","GDPR Article 39 – Tasks of the Data Protection Officer","NIST Privacy Framework PR.PO-P1 – Policies and procedures to manage data processing activities","NIST SP 800-53 PT-2 – Authority to Process Personally Identifiable Information","NIST SP 800-53 PT-5 – Privacy Notice","CIS Control 3 – Data Protection","ISO\u002FIEC 27701:2019 – Privacy Information Management System (PIMS)","ITIL 4 – Governance and Compliance Management Practice",{}]