Wire by Fusion42
Fusion42 Scout Raise
The Debrief & Outliers
Regulatory RadarWorkday Debrief · Mon 09:00 UTCSector Deep DiveWorkday Debrief · Tue 09:00 UTCGeo PulseWorkday Debrief · Wed 09:00 UTCOperating ConditionsWorkday Debrief · Thu 09:00 UTCWeekly BriefingWorkday Debrief · Fri 09:00 UTCWTF Happened This WeekSat 09:00 UTC · 3σ outliers
Benchmarks
Benchmarks HomeBy News TypeBy RegionBy Sector
AI WeeklyAbout

Switch product

Fusion42RaiseScoutWire

The Debrief & Outliers

All editionsRegulatory RadarWorkday Debrief · Mon 09:00 UTCSector Deep DiveWorkday Debrief · Tue 09:00 UTCGeo PulseWorkday Debrief · Wed 09:00 UTCOperating ConditionsWorkday Debrief · Thu 09:00 UTCWeekly BriefingWorkday Debrief · Fri 09:00 UTCWTF Happened This WeekSat 09:00 UTC · 3σ outliers

Database & benchmarks

Benchmarks HomeBy News TypeBy RegionBy SectorStories

Account

Sign in
← Back

Wire · regulatory

AEPD fines Gestora Clubs DiR €21000 for lacking valid DPIA for biometric access system

16 July 2026 · By · Wire by Fusion42

Published

16 July 2026

Topic

regulatory

◆ Sectors

Cybersecurity

◆ Geography

Spain

◆ Source

Read at dataguidance.com →

◆ Verified

Fusion42 · 16 July 2026 · Fusion42 review

Spain's AEPD fined Gestora Clubs DiR €21,000 for operating a biometric fingerprint access system for 95,000 gym users without a valid Data Protection Impact Assessment, as required by GDPR Article 35. The company must submit a compliant DPIA within three months.

This Wire brief sits within Fusion42's coverage of Cybersecurity.

◆ ◆ The Wire takeaway

If you're building a physical access system that uses fingerprints, faces or any biometric data, you need a certified DPIA before launch—not after a complaint arrives. Spain just made this concrete: incomplete assessment costs €21,000 minimum, and regulators are auditing what you wrote, not just that you wrote something.

◆ Coverage

1 source · 16 Jul 2026

◆ Related on Wire

◆ Topics

Cybersecuritygdpr-enforcementbiometric-datadpia-requirementfitness-clubshigh-risk-processing