# REPSOL COMERCIALIZADORA DE ELECTRICIDAD Y GAS, S.L.: Insufficient technical and organisational measures to ensure information security

- Type: Enforcement
- Source: Spanish Data Protection Authority (aepd)
- Date: 2025-05-26
- Original: https://www.enforcementtracker.com/ETid-2738
- Canonical: https://overview.legal/posts/48853
- Topics: Controllers, Security, Processing Agreement, Personal Data, Supervisory Authorities, Data Controller

## Summary

The Spanish DPA imposed a fine of EUR 1,380,000 on REPSOL COMERCIALIZADORA DE ELECTRICIDAD Y GAS, S.L. The controller used outdated technical and organisational measures to manage customer contracts. This resulted in an individual receiving energy bills, without having a contract with the controller. The size of the controller, a multinational company, and the large amount of personal data being processed, were seen as aggravating factors.

## Full text

The Spanish DPA imposed a fine of EUR 1,380,000 on REPSOL COMERCIALIZADORA DE ELECTRICIDAD Y GAS, S.L. The controller used outdated technical and organisational measures to manage customer contracts. This resulted in an individual receiving energy bills, without having a contract with the controller. The size of the controller, a multinational company, and the large amount of personal data being processed, were seen as aggravating factors.

GDPR Articles: Art. 5 (1) d) GDPR, Art. 32 GDPR
Industry: Transportation and Energy

---
Generated by overview.legal · https://overview.legal/posts/48853 · 2026-08-22