# Epic Ltd.: Insufficient legal basis for data processing

- Type: Enforcement
- Source: Cypriot Data Protection Commissioner
- Date: 2023-02-03
- Original: https://www.enforcementtracker.com/ETid-1818
- Canonical: https://overview.legal/posts/47933
- Topics: Processing Agreement, Controllers, Telecommunications, Privacy by Design & Default, Security, Processing, Data Controller, Supervisory Authorities

## Summary

The Cypriot DPA has imposed a fine of EUR 3,250 on Epic Ltd. The contoller had made unsolicited calls to 332 former customers without a valid legal basis. The DPA also found that the controller had not taken appropriate technical and organizational measures to prove that data processing was carried out in compliance with the GDPR.

## Full text

The Cypriot DPA has imposed a fine of EUR 3,250 on Epic Ltd. The contoller had made unsolicited calls to 332 former customers without a valid legal basis. The DPA also found that the controller had not taken appropriate technical and organizational measures to prove that data processing was carried out in compliance with the GDPR.

GDPR Articles: Art. 6 (1) GDPR, Art. 24 (1), (2) GDPR, Art. 32 (1) GDPR
Industry: Media, Telecoms and Broadcasting

---
Generated by overview.legal · https://overview.legal/posts/47933 · 2026-08-22