# 23ANDME, INC: Insufficient technical and organisational measures to ensure information security

- Type: Enforcement
- Source: Spanish Data Protection Authority (aepd)
- Date: 2026-07-16
- Original: https://www.enforcementtracker.com/ETid-3378
- Canonical: https://overview.legal/posts/607188
- Topics: Notification Obligation, Data Breaches, Notified Body Reporting and Notification Obligations, Security, Supervision, Supervisory Authorities, Article 19 GDPR - Notification of Rectification, Erasure or Restriction, Genetic Data, Healthcare

## Summary

The Spanish Data Protection Authority (AEPD) fined 23andMe, Inc. €2,400,000 for failing to implement sufficient technical and organizational measures to ensure information security, following a breach of GDPR Article 5(1)(f) and Article 33. The enforcement action addresses the genetic testing company's inadequate safeguards and breach notification obligations within the healthcare data sector.

## Full text

Spanish Data Protection Authority (aepd) fined 23ANDME, INC €2,400,000 on 2026-07-16 for: Insufficient technical and organisational measures to ensure information security.
GDPR Articles: Art. 5 (1) f) GDPR, Art. 33 GDPR
Sector: Health Care
Country: Spain
Source: https://www.aepd.es/documento/ps-00140-2025.pdf

## Cited law provisions (4)

### GDPR — gdpr-art-5-par-1-en

Personal data shall be:

### GDPR — gdpr-art-5-par-1-pnt-f-en

processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).

### GDPR — gdpr-art-5-en

Principles relating to processing of personal data

### GDPR — gdpr-art-33-en

Notification of a personal data breach to the supervisory authority

---
Generated by overview.legal · https://overview.legal/posts/607188 · 2026-11-14