Spain

CERRADA, S.L.

4,000 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2026-07-24.

Rank · Sector

#367

of 645 in Industry and Commerce

Rank · Spain

#603

of 1,114

Rank · All fines

#2,071

of 3,223

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2026-07-24
Controller / Processor: CERRADA, S.L.
Sector: Industry and Commerce
Quoted Articles: Art. 32 GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Spanish DPA has imposed a fine of EUR 4,000 on Cerrada, S.L. The controller operates an online bookstore. In October 2024, the welcome email sent to new users contained their email address and password in plain text. A data subject complained about this on 11 October 2024. The controller replied that sending data and passwords unencrypted was a usability choice. In August 2025, the controller's DPO certified a new password recovery protocol. However, the authority found that this measure still did not address the security problems regarding the welcome email.

Open original source Links to the regulator's original publication or another source.