Spain

HOY VOY A CONDUCIR, S.L.

30,000 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2026-07-31.

Rank · Sector

#153

of 636 in Industry and Commerce

Rank · Spain

#323

of 1,104

Rank · All fines

#976

of 3,197

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2026-07-31
Controller / Processor: HOY VOY A CONDUCIR, S.L.
Sector: Industry and Commerce
Quoted Articles: Art. 32 GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Spanish DPA has imposed a fine of EUR 30,000 on HOY VOY A CONDUCIR, S.L. The controller runs a driving school franchise. Hackers offered a database containing the names, ID numbers, email addresses, phone numbers and addresses of 200,000 of the controller's students and staff online. The controller received warnings about the offering on 1 May 2024 and 1 August 2024 but dismissed them as untrustworthy. It was only in October 2024 that the controller noticed the breach. It was found that the controller was operating old, obsolete systems that no longer received official support and had not implemented adequate measures to ensure data security.

Open original source Links to the regulator's original publication or another source.