# AEPD (Spain) - EXP202500113

- Type: News
- Source: GDPRhub
- Date: 2026-01-13
- Canonical: https://overview.legal/posts/51879
- Topics: Processing Agreement, IP Address, Supervisory Authorities, Security, Controllers, Personal Data, Law Enforcement

## Summary

Facts: The data protection authority (DPA) has fined a bank €500,000 after documents belonging to a customer were lost during delivery by a courier service. The authority ruled that the bank had not ensured adequate security measures and proper oversight of the service provider, in accordance with Article 32 of the GDPR. The DPA imposed a fine of €500,000 on a bank because customer documents were lost during transport via a courier service. The DPA determined that the bank had not provided sufficient security and adequate oversight of the service provider, in accordance with Article 32 of the GDPR. Summary in English: A bank was fined €500,000 by the data protection authority because customer documents were lost during delivery by a courier service. The authority found that the bank had failed to implement adequate security measures and proper oversight of the service provider, violating Article 32 of the GDPR.

## Full text

Facts: The data protection authority (DPA) has fined a bank €500,000 after documents belonging to a customer were lost during shipment via a courier service. The authority ruled that the bank had not ensured sufficient security measures were in place and that adequate oversight of the service provider was maintained, in accordance with [Article 32 GDPR]. The DPA fined a bank €500,000 for the loss of a customer's documents during transport via a courier service. The DPA determined that the bank had not ensured sufficient security measures were in place and that adequate oversight of the service provider was maintained, in accordance with [Article 32 GDPR]. Summary in English: Summary in English: The responsible party did not receive the documents. Between February 2nd and February 16th, 2023, the data subject contacted the responsible party on multiple occasions. The responsible party informed them that the documents had not arrived and that an investigation was being conducted with various courier companies. Dynamic had not reported any incidents during the contractual relationship, which made the responsible party's investigation more difficult. The responsible party later confirmed and acknowledged the loss of the documents. --- *This content has been automatically translated using machine translation. The original version is available in the source language.* --- *This content was automatically translated using machine translation. The original version is available in the source language.*

## Cited law provisions (1)

### GDPR — gdpr-art-32-en

Security of processing

---
Generated by overview.legal · https://overview.legal/posts/51879 · 2026-08-22