Spain

Owner of a Law Firm

600 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2025-04-03.

Rank · Sector

#317

of 322 in Finance, Insurance and Consulting

Rank · Spain

#937

of 1,075

Rank · All fines

#2,825

of 3,050

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2025-04-03
Controller / Processor: Owner of a Law Firm
Sector: Finance, Insurance and Consulting
Quoted Articles: Art. 5 (1) f) GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Spanish DPA imposed a fine on the owner of a law firm. The controller disclosed personal information in an external email because they did not implement sufficient technical and organizational measures. The original fine of EUR 1,000 was reduced to EUR 600 due to immediate payment and admission of responsibility by the controller.

Open original source Links to the regulator's original publication or another source.