AEPD (Spain) - PS-00240-2025
Spain's AEPD fines Vodafone €750K for inadequate security and missing processor agreement in Super WiFi breach.
Spain's Data Protection Authority (AEPD) fined Vodafone España €750,000 for violations of GDPR Articles 5(1)(f), 28, and 32 following an unauthorized data access incident affecting the Super WiFi service. The DPA found that Vodafone failed to implement adequate security measures, processed data without a valid processor agreement (the agreement was only signed in September 2024, months after the November 2023 breach), and could not demonstrate proper encryption or audit controls of the third-party processor.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Vodafone?
Get an email when a new story names Vodafone, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonVodafone España suffered an unauthorized data access incident in November 2023 affecting its Super WiFi service, but critically had no valid data processing agreement with the third-party processor until September 2024 — nearly a year after the breach. This violated GDPR Articles 5(1)(f), 28, and 32, which require confidentiality safeguards, formal processor contracts, and appropriate technical/organizational security measures. The absence of verifiable encryption and audit controls over the third-party processor compounded the failure, demonstrating that outsourcing data processing does not transfer regulatory responsibility. This case underscores that organizations remain fully accountable for how processors handle personal data and must have governance structures in place before processing begins, not after an incident forces the issue.
What helps against this
How we list vendors- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Encryption and key management
Stolen data stays unreadable, and the keys stay under your control.
- Third-party risk management (TPRM)
You know which suppliers could hurt you, and you hear quickly when one of them is breached.