Spain

FLEXICAR INTERNACIONAL, S.L.

680,000 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2026-07-28.

Rank · Sector

#42

of 645 in Industry and Commerce

Rank · Spain

#37

of 1,114

Rank · All fines

#223

of 3,223

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2026-07-28
Controller / Processor: FLEXICAR INTERNACIONAL, S.L.
Sector: Industry and Commerce
Quoted Articles: Art. 5 (1) f) GDPR, Art. 13 GDPR, Art. 32 GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Spanish DPA has imposed a fine of EUR 680,000 on Flexicar Internacional, S.L. The controller operates numerous used car sales outlets. In a cyberattack reported to the authority on 3 June 2024, the personal data of individuals who had purchased a vehicle or completed web forms was lost. This data included ID numbers and other personal information. It was found that several security measures recommended in 2022 had not been implemented.

Open original source Links to the regulator's original publication or another source.