# CAIXABANK, S.A.: Non-compliance with general data processing principles

- Type: Enforcement
- Source: Spanish Data Protection Authority (aepd)
- Date: 2026-09-10
- Original: https://www.enforcementtracker.com/ETid-3380
- Canonical: https://overview.legal/posts/607190
- Topics: Privacy by Design & Default, Privacy by Default, Privacy by Design, Accountability, Personal Data, Supervision, Supervisory Authorities, Insurance

## Summary

The Spanish Data Protection Authority (AEPD) fined CaixaBank, S.A. €408,000 for non-compliance with general data processing principles. The enforcement action centered on the bank's failure to meet data protection by design and by default obligations under Article 25, as well as inadequate information provided to data subjects under Article 13 of the GDPR.

## Full text

Spanish Data Protection Authority (aepd) fined CAIXABANK, S.A. €408,000 on 2026-09-10 for: Non-compliance with general data processing principles.
GDPR Articles: Art. 25 (1), (2) GDPR, Art. 13 GDPR
Sector: Finance, Insurance and Consulting
Country: Spain
Source: https://www.aepd.es/documento/ps-00028-2025.pdf

## Cited law provisions (3)

### GDPR — gdpr-art-25-par-1-en

Taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for rights and freedoms of natural persons posed by the processing, the controller shall, both at the time of the determination of the means for processing and at the time of the processing itself, implement appropriate technical and organisational measures, such as pseudonymisation, which are designed to implement data-protection principles, such as data minimisation, in an effective manner and to integrate the necessary safeguards into the processing in order to meet the requirements of this Regulation and protect the rights of data subjects.

### GDPR — gdpr-art-13-en

Information to be provided where personal data are collected from the data subject

### GDPR — gdpr-art-25-en

Data protection by design and by default

---
Generated by overview.legal · https://overview.legal/posts/607190 · 2026-11-14