Spain

Owner of a Law Firm

600 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2025-04-03.

Rank · Sector

#322

of 327 in Finance, Insurance and Consulting

Rank · Spain

#941

of 1,079

Rank · All fines

#2,859

of 3,085

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2025-04-03
Controller / Processor: Owner of a Law Firm
Sector: Finance, Insurance and Consulting
Quoted Articles: Art. 5 (1) f) GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Spanish DPA imposed a fine on the owner of a law firm. The controller disclosed personal information in an external email because they did not implement sufficient technical and organizational measures. The original fine of EUR 1,000 was reduced to EUR 600 due to immediate payment and admission of responsibility by the controller.

Open original source Links to the regulator's original publication or another source.