Spain

VODAFONE ESPAÑA, S.A.U.

750,000 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2026-08-18.

Rank · Sector

#61

of 383 in Media, Telecoms and Broadcasting

Rank · Spain

#35

of 1,104

Rank · All fines

#215

of 3,197

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2026-08-18
Controller / Processor: VODAFONE ESPAÑA, S.A.U.
Sector: Media, Telecoms and Broadcasting
Quoted Articles: Art. 5 (1) f) GDPR, Art. 28 GDPR, Art. 32 GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Spanish DPA has imposed a fine of EUR 750,000 on VODAFONE ESPAÑA, S.A.U. On 23 November 2023 Vodafone informed the relevant authority of a cyberattack on one of its processors. The processor operates the Super Wifi 5 app and stores Vodafone customer data. In operating this app the processor used a sub-processor, on which the attack occurred. The processor was made aware of the attack via social media and subsequently informed Vodafone, who then informed the AEPD. The personal data of customers affected included email addresses and names.

Open original source Links to the regulator's original publication or another source.