AEPD (Spain) - ps-00028-2025
Spain's AEPD fines CaixaBank €408,000 for GDPR violations in inheritance procedures.
Spain's data protection authority (AEPD) has fined CaixaBank €408,000 for violating GDPR principles. The bank was found to have collected more personal and financial information than necessary during inheritance procedures, failing to implement data minimization by design. Additionally, CaixaBank did not adequately demonstrate that it provided data subjects with the required information under Article 13 GDPR.
AI summary of the linked source. Not reviewed by an editor. How this works
Run CaixaBank?
Get an email when a new story names CaixaBank, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonCaixaBank violated core GDPR principles by collecting excessive personal and financial data during inheritance procedures, breaching the data minimization principle enshrined in Article 5(1)(c) GDPR. The bank also failed to adequately demonstrate compliance with Article 13 transparency obligations, meaning data subjects were not properly informed about how their data was being used. This case highlights that GDPR compliance is not just about preventing breaches — it requires proactively designing processes that limit data collection to what is strictly necessary. Regulators are increasingly scrutinizing whether organizations can demonstrate compliance, not merely claim it. Fines of this magnitude signal that procedural GDPR violations carry significant financial and reputational consequences.
What helps against this
How we list vendors- Cloud security posture management (CSPM and CNAPP)
Misconfigured cloud storage and over-permissive roles get caught before they leak.
- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.
- Compliance automation (GRC)
Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.