Spain

CAIXABANK, S.A.

400,000 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2026-04-15.

Rank · Sector

#49

of 323 in Finance, Insurance and Consulting

Rank · Spain

#45

of 1,078

Rank · All fines

#278

of 3,059

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2026-04-15
Controller / Processor: CAIXABANK, S.A.
Sector: Finance, Insurance and Consulting
Quoted Articles: Art. 5 (1) f) GDPR, Art. 25 GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Spanish DPA has imposed a fine of EUR 400,000 on CAIXABANK, S.A. The controller's customer service department forwarded the personal data of data subjects to an unrelated third party. This incident occurred due to human error, and the controller failed to implement adequate technical and organisational measures to prevent it. The original fine of EUR 500,000 was reduced to EUR 400,000 due to immediate payment by the controller.

Open original source Links to the regulator's original publication or another source.