The Spanish Data Protection Agency (AEPD) closed a procedure concerning a massive data breach without imposing any sanction, due to the extinction of the legal personality of the data controller following a merger-absorption.

Facts and context

The Spanish data protection authority (AEPD) published a decision to archive the procedure initiated against SERED HOSTING, S.L. for failures related to data security and breach notification.

The case originated from the company's late notification of a data breach on January 14, 2024, followed the next day by a complaint from a data subject who had received communication from the company about the incident.

Reasons for the decision

The investigation identified several failures, although the procedure was ultimately archived. The data breach, detected on January 11, 2024 but having started on December 5, 2023, affected approximately 98,000 individuals and involved identification data, official documents, contact data, and access identifiers. The authority considered the security measures inadequate.

• Obligation to ensure the integrity and confidentiality of data (Article 5(1)(f) of the GDPR): The authority found that the technical and organizational measures implemented by SERED HOSTING were insufficient to guarantee a level of security appropriate to the risk. The occurrence of the breach, affecting sensitive data such as access identifiers and identity documents, demonstrated this failure. Furthermore, the company was unable to provide risk analyses, security audits, or other documents justifying the measures allegedly in place before the incident, despite requests from the authority.
• Obligation to communicate a data breach to data subjects (Article 34 of the GDPR): The authority noted that the communication sent to data subjects was incomplete, as it did not include a description of the likely consequences of the breach. However, the AEPD found that this infringement was time-barred under national law (Article 74 of the Organic Law on Data Protection and Guarantee of Digital Rights) and could therefore no longer be prosecuted.

Authority's decision

Consequently, the authority decided to archive the sanction procedure against SERED HOSTING, S.L. This decision was motivated by the extinction of the company's legal personality, which was absorbed by SOLUCIONES WEB ON LINE, S.L.U. on July 3, 2025, during the procedure.

Lessons learned

This decision reminds that:

• The disappearance of the legal personality of an entity (for example, by merger-absorption) can lead to the closure of a sanction procedure, as the supervisory authority's action can no longer be directed against a company that no longer exists.
• The absence of formal documentation (risk analysis, audits, security policies) to justify the security measures implemented before an incident makes it difficult or even impossible to demonstrate compliance with the security obligation of Article 5(1)(f) of the GDPR.
• The detection of suspicious activities, even without immediate evidence of data exfiltration, must trigger prompt in-depth investigations and containment measures, as the detection date of a breach may precede the explicit confirmation of compromise by a third party.