News · GDPRhub EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

AEPD (Spain) - EXP202500113

Processing Agreement IP Address Supervisory Authorities Security Controllers Personal Data Law Enforcement
Jan 13, 2026
Summary

Facts: The data protection authority (DPA) has fined a bank €500,000 after documents belonging to a customer were lost during delivery by a courier service. The authority ruled that the bank had not ensured adequate security measures and proper oversight of the service provider, in accordance with Article 32 of the GDPR. The DPA imposed a fine of €500,000 on a bank because customer documents were lost during transport via a courier service. The DPA determined that the bank had not provided sufficient security and adequate oversight of the service provider, in accordance with Article 32 of the GDPR. Summary in English: A bank was fined €500,000 by the data protection authority because customer documents were lost during delivery by a courier service. The authority found that the bank had failed to implement adequate security measures and proper oversight of the service provider, violating Article 32 of the GDPR.

How it connects

References

Related across sources

Enforcement Municipality of Gooise Meren: Insufficient legal basis for data processing Dutch Supervisory Authority for Data Protection (AP) Enforcement Municipality of Haarlemmermeer: Insufficient legal basis for data processing Dutch Supervisory Authority for Data Protection (AP) Enforcement Municipality of Delft: Insufficient legal basis for data processing Dutch Supervisory Authority for Data Protection (AP) Enforcement Municipality of Eindhoven: Insufficient legal basis for data processing Dutch Supervisory Authority for Data Protection (AP) Enforcement Municipality of Ede: Insufficient legal basis for data processing Dutch Supervisory Authority for Data Protection (AP) Enforcement Municipality of Hilversum: Insufficient legal basis for data processing Dutch Supervisory Authority for Data Protection (AP)

Full text

Facts: The data protection authority (DPA) has fined a bank €500,000 after documents belonging to a customer were lost during shipment via a courier service. The authority ruled that the bank had not ensured sufficient security measures were in place and that adequate oversight of the service provider was maintained, in accordance with [Article 32 GDPR]. The DPA fined a bank €500,000 for the loss of a customer's documents during transport via a courier service. The DPA determined that the bank had not ensured sufficient security measures were in place and that adequate oversight of the service provider was maintained, in accordance with [Article 32 GDPR]. Summary in English: Summary in English: The responsible party did not receive the documents. Between February 2nd and February 16th, 2023, the data subject contacted the responsible party on multiple occasions. The responsible party informed them that the documents had not arrived and that an investigation was being conducted with various courier companies. Dynamic had not reported any incidents during the contractual relationship, which made the responsible party's investigation more difficult. The responsible party later confirmed and acknowledged the loss of the documents. --- This content has been automatically translated using machine translation. The original version is available in the source language. --- This content was automatically translated using machine translation. The original version is available in the source language.

Similar Content