# AEPD (Spain) - PS/00372/2025 - Type: Enforcement - Source: AEPD - Date: 2026-11-11 - Original: https://gdprhub.eu/index.php?title=AEPD_(Spain)_-_PS/00372/2025 - Canonical: https://overview.legal/posts/607574 ## Cited law provisions (34) ### GDPR — gdpr-art-4-par-1-en ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; ### GDPR — gdpr-art-4-par-2-en ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction; ### GDPR — gdpr-art-4-par-7-en ‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law; ### GDPR — gdpr-art-4-par-8-en ‘processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller; ### GDPR — gdpr-art-9-par-1-en Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited. ### GDPR — gdpr-art-9-par-2-en Paragraph 1 shall not apply if one of the following applies: ### GDPR — gdpr-art-35-par-7-en The assessment shall contain at least: ### GDPR — gdpr-art-58-par-2-en Each supervisory authority shall have all of the following corrective powers: ### GDPR — gdpr-art-83-par-4-en Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 10 000 000 EUR, or in the case of an undertaking, up to 2 % of the total worldwide annual turnover of the preceding financial year, whichever is higher: ### GDPR — gdpr-art-83-par-5-en Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 20 000 000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher: ### GDPR — gdpr-art-1-en Subject-matter and objectives ### GDPR — gdpr-art-2-en Material scope ### GDPR — gdpr-art-3-en Territorial scope ### GDPR — gdpr-art-4-en For the purposes of this Regulation: ### GDPR — gdpr-art-5-en Principles relating to processing of personal data ### GDPR — gdpr-art-6-en Lawfulness of processing ### GDPR — gdpr-art-9-en Processing of special categories of personal data ### GDPR — gdpr-art-10-en Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out only under the control of official authority or when the processing is authorised by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects. Any comprehensive register of criminal convictions shall be kept only under the control of official authority. ### GDPR — gdpr-art-14-en Information to be provided where personal data have not been obtained from the data subject ### GDPR — gdpr-art-20-en Right to data portability ### GDPR — gdpr-art-24-en Responsibility of the controller ### GDPR — gdpr-art-25-en Data protection by design and by default ### GDPR — gdpr-art-28-en Processor ### GDPR — gdpr-art-30-en Records of processing activities ### GDPR — gdpr-art-34-en Communication of a personal data breach to the data subject ### GDPR — gdpr-art-35-en Data protection impact assessment ### GDPR — gdpr-art-46-en Transfers subject to appropriate safeguards ### GDPR — gdpr-art-54-en Rules on the establishment of the supervisory authority ### GDPR — gdpr-art-57-en Tasks ### GDPR — gdpr-art-58-en Powers ### GDPR — gdpr-art-72-en Procedure ### GDPR — gdpr-art-77-en Right to lodge a complaint with a supervisory authority ### GDPR — gdpr-art-83-en General conditions for imposing administrative fines ### GDPR — gdpr-art-90-en Obligations of secrecy --- Generated by overview.legal · https://overview.legal/posts/607574 · 2026-11-14