Spain

HOLY MARY CATHOLIC SCHOOL, S.L.

12,000 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2026-03-01.

Rank · Sector

#169

of 357 in Public Sector and Education

Rank · Spain

#386

of 1,075

Rank · All fines

#1,295

of 3,050

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2026-03-01
Controller / Processor: HOLY MARY CATHOLIC SCHOOL, S.L.
Sector: Public Sector and Education
Quoted Articles: Art. 5 (1) a) GDPR, Art. 6 (1) GDPR, Art. 35 GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Spanish DPA has imposed a fine of EUR 12,000 on the HOLY MARY CATHOLIC SCHOOL, S.L. The controller, an educational institute, used Google Workspace for Education within its school environment. While the use of the tool may be justifiable under the GDPR, the controller failed to implement it adequately. The controller was unable to ensure that pupils only had access to the tools necessary for study purposes. The controller also failed to adequately inform data subjects and their parents, and to carry out a sufficient DPIA. The original fine of EUR 20,000 was reduced to EUR 12,000 due to immediate payment and admission of responsibility by the controller.

Open original source Links to the regulator's original publication or another source.