[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fI-dHZ4xPwp4-uN2NBImRXmk7hD2XtmtKP3LgjxSo_A0":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":20,"status":21,"created_at":22,"published_at":23,"article":24,"tags":28,"podcasts":47,"controls":48},"6bea8868-49be-45b4-8e23-14a873cee8af","ramona-films-fined-for-ignoring-gdpr-corrective-order-on-data-processing-agreement","079657bd-2460-4682-8c1e-7186ebe745c1","Ramona Films Fined for Ignoring GDPR Corrective Order on Data Processing Agreement","Ramona Films failed to comply with a corrective order from Spain's AEPD requiring a formal data processing agreement with their payment service provider, ultimately submitting an unsigned and undated document they later admitted was never executed. This case highlights that attempting to reframe a compliance obligation (shifting from processor to joint controller status) without proper legal basis compounds the original violation. Regulators treat non-compliance with corrective orders as a serious aggravating factor, demonstrating that procedural follow-through on GDPR obligations is just as critical as the initial compliance. Organizations must treat regulatory orders as binding legal deadlines, not suggestions, and ensure any agreements submitted as evidence are legally valid and verifiable.","**Immediate actions:**\n- Audit all current vendor and third-party relationships to confirm legally executed Data Processing Agreements (DPAs) or Joint Controller Agreements are in place and signed by authorized parties.\n- Establish a compliance tracking register to log all open regulatory orders with deadlines, responsible owners, and completion evidence.\n\n**Long-term improvements:**\n- Implement a formal contract lifecycle management process that prevents unsigned or undated agreements from being submitted to regulators or stored as compliance evidence.\n- Conduct periodic GDPR compliance reviews covering all data processor and joint controller relationships to ensure legal documentation remains current and valid.\n- Train legal and compliance teams on the distinction between data processor and joint controller arrangements to prevent misclassification under GDPR Articles 26 and 28.\n\n**Governance & Oversight:**\n- Appoint a Data Protection Officer (DPO) or designated compliance lead with authority to enforce regulatory deadlines and escalate non-compliance internally.\n- Create an internal response protocol for handling regulatory corrective orders, including legal review, document preparation, and executive sign-off before submission.",[12,13,14,15,16,17,18,19],"GDPR Article 26 (Joint Controllers)","GDPR Article 28 (Processor Agreements)","GDPR Article 58(2) (Corrective Powers of Supervisory Authority)","NIST SP 800-53 SA-9 (External Information System Services)","NIST SP 800-53 PM-1 (Information Security Program Plan)","CIS Control 15 (Service Provider Management)","ISO 27001 Annex A.15.1 (Information Security in Supplier Relationships)","ITIL Service Design – Supplier Management",{},"published","2026-08-21T14:20:39.316402+00:00","2026-08-21T14:20:39.044+00:00",{"id":7,"url":25,"slug":26,"title":27},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_PS-00008-2025&diff=52752&oldid=52748","aepd-spain-ps-00008-2025-d8fa05","AEPD (Spain) - PS-00008-2025",[29,35,41],{"id":30,"name":31,"slug":32,"description":33,"color":34},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":36,"name":37,"slug":38,"description":39,"color":40},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",{"id":42,"name":43,"slug":44,"description":45,"color":46},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[]]