Ramona Films Fined for Ignoring GDPR Corrective Order on Data Processing Agreement
Written by AI from the linked story. Not reviewed by an editor. How this works
Ramona Films failed to comply with a corrective order from Spain's AEPD requiring a formal data processing agreement with their payment service provider, ultimately submitting an unsigned and undated document they later admitted was never executed. This case highlights that attempting to reframe a compliance obligation (shifting from processor to joint controller status) without proper legal basis compounds the original violation. Regulators treat non-compliance with corrective orders as a serious aggravating factor, demonstrating that procedural follow-through on GDPR obligations is just as critical as the initial compliance. Organizations must treat regulatory orders as binding legal deadlines, not suggestions, and ensure any agreements submitted as evidence are legally valid and verifiable.
Tactical Insight
Immediate actions
- Audit all current vendor and third-party relationships to confirm legally executed Data Processing Agreements (DPAs) or Joint Controller Agreements are in place and signed by authorized parties.
- Establish a compliance tracking register to log all open regulatory orders with deadlines, responsible owners, and completion evidence.
Long-term improvements
- Implement a formal contract lifecycle management process that prevents unsigned or undated agreements from being submitted to regulators or stored as compliance evidence.
- Conduct periodic GDPR compliance reviews covering all data processor and joint controller relationships to ensure legal documentation remains current and valid.
- Train legal and compliance teams on the distinction between data processor and joint controller arrangements to prevent misclassification under GDPR Articles 26 and 28.
Governance & Oversight
- Appoint a Data Protection Officer (DPO) or designated compliance lead with authority to enforce regulatory deadlines and escalate non-compliance internally.
- Create an internal response protocol for handling regulatory corrective orders, including legal review, document preparation, and executive sign-off before submission.