Spain

VODAFONE ESPAÑA, S.A.U.

400,000 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2026-09-11.

Rank · Sector

#74

of 383 in Media, Telecoms and Broadcasting

Rank · Spain

#49

of 1,104

Rank · All fines

#293

of 3,197

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2026-09-11
Controller / Processor: VODAFONE ESPAÑA, S.A.U.
Sector: Media, Telecoms and Broadcasting
Quoted Articles: Art. 28 GDPR, Art. 32 GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Spanish DPA has imposed a fine of EUR 400,000 on VODAFONE ESPAÑA, S.A.U. On 5 November 2023 the servers of a processor contracted to operate telesales and assisted digital sales were attacked. Vodafone was notified on 8 November 2023 and informed the AEPD on 11 November 2023. The personal data of 98,509 customers and prospects was rendered inaccessible. Of these data subjects, the name, mobile number, ID number, address, email address and bank account number of 2,150 were encrypted, while the name and mobile number were encrypted for the rest. The subsequent investigation found no evidence of exfiltration. The processor had not implemented two-factor authentification and had installed an outdated anti-virus software, furthermore at the time of the attack, there was no valid processing agreement in place.

Open original source Links to the regulator's original publication or another source.