The Spanish data protection authority, Agencia Española de Protección de Datos (AEPD), regularly investigates violations of the General Data Protection Regulation (GDPR). In a recent case—EXP202213023—the AEPD examined key aspects of personal data processing in the context of consumer complaints. The investigation revealed significant shortcomings in GDPR compliance, prompting a closer review of how data protection requirements were being implemented.

Cases like this are also highly relevant for Switzerland, where the Federal Act on Data Protection (FADP) establishes comparable standards. They offer valuable insights into the challenges organizations face and the measures they must adopt to ensure compliance with data protection laws.

Although this case involves a Spanish company, it holds significant relevance for Switzerland. Both the GDPR and the Swiss Federal Act on Data Protection (FADP) require a range of measures to safeguard personal data, albeit with some differences in implementation. Cases like the AEPD decision demonstrate that inadequate compliance can lead not only to legal repercussions, but also to a considerable loss of customer trust.

For Swiss companies, this underscores the importance of continuous review and adaptation of their data protection strategies—both to meet legal requirements and to maintain strong customer relationships.

The AEPD decision centered around the inadequate handling of data deletion requests. Consumers lacked sufficient means to have their data deleted efficiently and in a timely manner—a clear violation of the “right to be forgotten” (Art. 17 GDPR).

The Swiss FADP also grants data subjects the right to deletion (Art. 32 FADP), though with less stringent requirements than the GDPR. In this case, the AEPD reviewed the company’s internal processes and recommended comprehensive reforms in the management of personal data. Such analyses are equally relevant in Switzerland, as they encourage companies to critically assess and improve their own data handling procedures.

In this case, the AEPD imposed not only financial penalties, but also issued binding directives requiring the company to improve its data protection practices. The imposed fines and the resulting reputational damage illustrate the serious consequences that data protection violations can entail.

For Swiss companies, the case serves as a reminder that data protection compliance is not merely a legal formality but should be viewed as a core element of corporate ethics. Investing in data protection technologies and implementing regular employee training are key preventive measures that help avoid similar outcomes.

To avoid data protection breaches and their consequences, Swiss companies should adopt a proactive approach. This includes conducting regular audits and implementing a comprehensive compliance management system.

Although appointing a Data Protection Officer (DPO) is not legally required in Switzerland, it is strongly recommended for larger or data-intensive organizations. A DPO plays a vital role in monitoring legal compliance and serving as an internal consultant.

Employee training should also be firmly integrated into corporate strategy. Promoting awareness of data protection issues helps minimize security risks and foster a privacy-conscious corporate culture.

Modern technologies can significantly support compliance with data protection requirements. These include data encryption, pseudonymization, and secure data transmission methods.

Automated tools for handling data subject requests—such as deletion or correction—make it easier to meet legal obligations efficiently. For Swiss companies, it is particularly important to use cloud solutions hosted in Switzerland or the EU, ensuring that data is managed in line with legal standards.

Close cooperation with data protection experts and legal advisors helps companies stay aligned with evolving legal requirements and implement them correctly. Regular communication with data protection authorities can also prevent misinterpretations and foster legal certainty.

Engaging external specialists allows organizations to identify and address security gaps early, a key factor in minimizing risk and enhancing long-term compliance.

The AEPD case in Spain provides valuable lessons for Swiss companies navigating data protection obligations. Avoiding data breaches requires strategic foresight that integrates both technical solutions and human resources.

Organizations that regularly review and update their data protection policies not only fulfill their legal duties but also position themselves as reliable and responsible partners. In today’s digital economy, a consistent and visible commitment to data protection is not just a legal obligation—it’s a powerful competitive advantage.