GDPR and cybersecurity: lessons learned from the Endesa incident

Following the cybersecurity incident attributed to Endesa, involving potential unauthorised access to customer data, it is a reminder that no organisation is immune to cyberattacks. The difference lies in how they are prevented, detected and managed.

Furthermore, cyberattacks do not only affect large companies. SMEs and medium-sized businesses are increasingly becoming targets, and a data breach is not just a technical issue but also a legal, organisational and reputational one, with an impact on trust comparable to that of a regulatory sanction.

What does the GDPR require in the event of a data breach?

The GDPR provides a preventive framework to reduce risks and respond quickly to incidents. It requires organisations to document data processing activities, implement measures appropriate to the level of risk, establish an incident management procedure and notify data breaches to the Spanish Data Protection Agency (AEPD) within 72 hours, where required, and to affected individuals if there is a high risk. Furthermore, security is not just about technology; it is also about organisation.

Security is not just about technology: it is also about organisation

Security measures are not limited to firewalls, antivirus software, encryption or backups. Internal organisation is equally important, including:

Role-based access controls (least privilege), passwords and multi-factor authentication (MFA).
Usage policies (devices, email and tools) and supplier oversight.
Monitoring and backups with recovery testing.

Quick preparedness checklist:

Data identified and located, an incident response plan in place and staff trained in phishing awareness.
MFA enabled on key systems, access permissions reviewed and recoverable backups.
Contracts and controls in place with critical suppliers.

In many cases, data breaches are not caused by “sophisticated” attacks, but by human error, unauthorised access or a lack of clear procedures.

What does the AEPD assess when an incident occurs?

In the event of a regulatory infringement, the Spanish Data Protection Agency (AEPD) may impose significant financial penalties. However, there is one key aspect that many companies are unaware of: the AEPD also assesses the measures adopted by the organisation. Factors taken into consideration include:

Whether GDPR compliance was genuine and up to date, and whether security measures were appropriate to the level of risk.
Whether staff had received appropriate training.
Whether the organisation acted with due diligence and speed (containment, analysis, documentation and notification where applicable), as well as its level of cooperation during the investigation.

Training: an obligation and a strategic investment

One critical aspect that is often underestimated is training. Having policies in place is of little use if staff do not know how to identify a data breach or signs of an incident (phishing, suspicious access or information leaks), whom to report it to internally, or what to do (and what not to do) during the first few hours.

The GDPR requires individuals who process personal data to act in accordance with instructions and exercise due diligence. Training employees and collaborators is not optional: it reduces risks and improves incident response.

How can Baker Tilly help you?

At Baker Tilly, we help you implement or update your GDPR compliance framework, define security measures proportionate to the level of risk, strengthen your incident response plan, review suppliers and train teams. We also provide support in the event of a data breach, including containment, documentation and notifications where required, as well as carrying out a rapid assessment to identify and prioritise gaps and develop a phased action plan.

Cybersecurity and data protection: GDPR checklist to prevent security breaches