[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fMWT58o10Xuzg6GSlWhjA1qt7pAT0Usqc3AHHW-RA_7M":3},{"article":4,"iocs":42,"watch_terms":43,"solutions":44,"lesson":47},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":24},"7f24e4d0-0bfa-4b5d-8e3e-433d8658072a","The Spanish DPA fined Securitas Direct 100 000 EUR for making the exercise of data subject rights more difficult by directing individuals to a chargeable telephone number","the-spanish-dpa-fined-securitas-direct-100-000-eur-for-making-the-exercise-of-da-14c9a9","The Spanish DPA fined Securitas Direct 100 000 EUR for making the exercise of data subject rights more difficult by directing individuals to a chargeable telephone number ikerinar Tue, 22\u002F09\u002F2026 - 13:21","The Spanish Data Protection Agency (AEPD) has fined Securitas Direct €100,000 for violating GDPR Article 12. The company directed individuals to a chargeable 902 telephone number to exercise their data subject rights, which is contrary to GDPR requirements for free access. Despite offering other free channels, the specific direction to the costly number was deemed a hindrance.","Spanish DPA fines Securitas Direct €100,000 for hindering data subject rights via chargeable phone number.","https:\u002F\u002Fwww.edpb.europa.eu\u002Fnews\u002Fthe-spanish-dpa-fined-securitas-direct-100-000-eur-for-making-the-exercise-of-data-subject_en",null,"2026-09-22T11:21:01+00:00","2026-09-22T12:00:12.329953+00:00",7,[17],{"name":18,"type":19},"Securitas Direct","vendor","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":20,"icon":12,"name":22,"slug":23},"Policy","policy",[25,30,35,37],{"category":26},{"id":27,"icon":12,"name":28,"slug":29},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":31},{"id":32,"icon":12,"name":33,"slug":34},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":36},{"id":20,"icon":12,"name":22,"slug":23},{"category":38},{"id":39,"icon":12,"name":40,"slug":41},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18],{"controls":45,"vendors":46},[],[],{"slug":48,"title":49,"body":50,"framework_refs":51,"framework_notes":60},"securitas-direct-fined-100k-for-obstructing-gdpr-data-subject-rights-via-chargeable-helpline","Securitas Direct Fined €100K for Obstructing GDPR Data Subject Rights via Chargeable Helpline","Securitas Direct violated GDPR Article 12 by routing individuals seeking to exercise their data subject rights to a chargeable 902 telephone number, effectively creating a financial barrier to rights that must be accessible free of charge. Even though alternative free channels existed, the deliberate direction to a paid number was sufficient for the Spanish DPA to determine that the company made the exercise of rights 'unduly difficult.' This case underscores that GDPR compliance is not only about having compliant processes in theory, but ensuring that every communication channel actively promoted to data subjects meets the regulation's accessibility standards. Organizations must audit all customer-facing touchpoints — not just their policies — to ensure no inadvertent or intentional friction is introduced into the rights-exercise process.",[52,53,54,55,56,57,58,59],"GDPR Article 12 — Transparent information, communication and modalities for the exercise of the rights of the data subject","GDPR Article 15-22 — Data subject rights (access, erasure, portability, objection, etc.)","GDPR Article 83(5)(b) — Infringements of data subjects' rights","NIST Privacy Framework PR.PO-P1 — Policies and procedures for data processing","NIST SP 800-53 IP-1 — Consent; IP-6 — Redress","CIS Control 3 — Data Protection (data governance and accountability)","ISO\u002FIEC 27701:2019 — Privacy Information Management (PIMS), clause 7.3 — Rights of data subjects","ITIL Service Design — Accessibility and usability of service channels",{}]