AEPD (Spain) - PS-00240-2025
Spain's AEPD fines Vodafone €750,000 for GDPR violations after a data breach.
Spain's Data Protection Agency (AEPD) has fined Vodafone España €750,000 for violating GDPR. The fine stems from a data breach affecting the 'Super WiFi' service, where Vodafone allowed a processor to begin operations before a valid data processing agreement was in place. The AEPD cited infringements of Articles 5(1)(f), 28, and 32 GDPR, considering previous sanctions against Vodafone as an aggravating factor.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Vodafone?
Get an email when a new story names Vodafone, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonVodafone España permitted a third-party data processor to begin handling personal data under its 'Super WiFi' service before a legally compliant Data Processing Agreement (DPA) was established, violating GDPR Articles 5(1)(f), 28, and 32. This failure represents a fundamental breakdown in vendor onboarding governance, where contractual and compliance controls were not verified before data flows commenced. The absence of a valid DPA means there were no enforceable obligations on the processor regarding data security, confidentiality, or breach notification. This case underscores that controllers remain fully accountable for processor activities, making pre-engagement due diligence a non-negotiable requirement. Repeat infringements, as seen here with prior Vodafone sanctions, attract aggravated penalties and signal systemic cultural or process failures to regulators.
What helps against this
How we list vendors- Encryption and key management
Stolen data stays unreadable, and the keys stay under your control.
- Third-party risk management (TPRM)
You know which suppliers could hurt you, and you hear quickly when one of them is breached.
- Compliance automation (GRC)
Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.