# CAIXABANK, S.A.: Insufficient technical and organisational measures to ensure information security

- Type: Enforcement
- Source: Spanish Data Protection Authority (aepd)
- Date: 2026-04-15
- Original: https://www.enforcementtracker.com/ETid-3201
- Canonical: https://overview.legal/posts/83466
- Topics: Privacy by Default, Security, Accountability, Privacy by Design, Privacy by Design & Default, Insurance, Supervisory Authorities, Supervision

## Summary

The Spanish Data Protection Authority (AEPD) fined Caixabank, S.A. €400,000 for failing to implement sufficient technical and organizational measures to ensure information security, finding violations of Article 5(1)(f) and Article 25 of the GDPR. The enforcement action, initiated in the finance and insurance sector, addressed the bank's inadequate data protection by design and by default safeguards.

## Full text

Spanish Data Protection Authority (aepd) fined CAIXABANK, S.A. €400,000 on 2026-04-15 for: Insufficient technical and organisational measures to ensure information security.
GDPR Articles: Art. 5 (1) f) GDPR, Art. 25 GDPR
Sector: Finance, Insurance and Consulting
Country: Spain
Source: https://www.aepd.es/documento/ps-00143-2025.pdf

---
Generated by overview.legal · https://overview.legal/posts/83466 · 2026-08-23