Spain

Gestores Administrativos Reunidos S.A. (GARSA)

75,000 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2026-08-04.

Rank · Sector

#115

of 343 in Finance, Insurance and Consulting

Rank · Spain

#153

of 1,133

Rank · All fines

#620

of 3,267

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2026-08-04
Controller / Processor: Gestores Administrativos Reunidos S.A. (GARSA)
Sector: Finance, Insurance and Consulting
Quoted Articles: Art. 5 (1) f) GDPR, Art. 33 GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Spanish DPA has imposed a fine of EUR 75,000 on Gestores Administrativos Reunidos S.A. (GARSA). On 14 May 2024, approximately 85 GB of data was exfiltrated from the controller's systems in a cyberattack involving compromised credentials. The controller became aware of this on 30 May 2024. A total of 141,210 data subjects were affected: 88,108 had a DNI number; 732 had a social security number; 5,995 had an email address; 4,196 had a postal address; and 3,186 had an IBAN. This personal data was uploaded to the dark web on 28 June 2024. On 1 July 2024, the controller notified the relevant authority. It was only after being ordered to do so by the authority on 13 September 2024 that the controller informed its customers. The controller informed its customers from 17 to 22 October 2024. It was found that the controller did not notify the authority or data subjects within the legal timeframe.

Open original source Links to the regulator's original publication or another source.