# Gestores Administrativos Reunidos S.A. (GARSA): Insufficient technical and organisational measures to ensure information security

- Type: Enforcement
- Source: Spanish Data Protection Authority (aepd)
- Date: 2026-08-04
- Original: https://www.enforcementtracker.com/ETid-3406
- Canonical: https://overview.legal/posts/607216
- Topics: Notification Obligation, Data Breaches, Notified Body Reporting and Notification Obligations, Security, Supervision, Personal Data, Supervisory Authorities, Article 19 GDPR - Notification of Rectification, Erasure or Restriction, Insurance

## Summary

The Spanish Data Protection Authority (AEPD) fined Gestores Administrativos Reunidos S.A. (GARSA) €75,000 for failing to implement sufficient technical and organizational measures to ensure information security, violating Article 5(1)(f) and Article 33 of the GDPR. The enforcement action, initiated on August 4, 2026, concerns a company in the finance, insurance, and consulting sector that did not adequately safeguard personal data or meet breach notification obligations.

## Full text

Spanish Data Protection Authority (aepd) fined Gestores Administrativos Reunidos S.A. (GARSA) €75,000 on 2026-08-04 for: Insufficient technical and organisational measures to ensure information security.
GDPR Articles: Art. 5 (1) f) GDPR, Art. 33 GDPR
Sector: Finance, Insurance and Consulting
Country: Spain
Source: https://www.aepd.es/documento/ps-00008-2026.pdf

## Cited law provisions (4)

### GDPR — gdpr-art-5-par-1-en

Personal data shall be:

### GDPR — gdpr-art-5-par-1-pnt-f-en

processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).

### GDPR — gdpr-art-5-en

Principles relating to processing of personal data

### GDPR — gdpr-art-33-en

Notification of a personal data breach to the supervisory authority

---
Generated by overview.legal · https://overview.legal/posts/607216 · 2026-11-14