A recent enforcement action by the Spanish Data Protection Authority (AEPD) highlights the critical importance of maintaining robust backup systems. In May 2024, DENTALCUADROS BCN, S.L.P., a dental clinic in Spain, was fined €20,000 following a ransomware attack that encrypted sensitive patient data. The clinic's inadequate backup practices and delayed breach notification were central to the penalty.
What Happened?
The clinic suffered a ransomware attack that encrypted patients' sensitive health data.
The last external backup was made 37 days prior to the attack, resulting in a significant loss of patient information.
The clinic delayed notifying the AEPD, reporting the breach nearly a month after detection, far exceeding the 72-hour requirement under GDPR Article 33.
Patients were informed of the breach verbally during visits, contrary to the Data Protection Officer's recommendation for written notifications.
Why Was This a Problem?
The outdated backup meant that a substantial amount of patient data was irretrievably lost.
Delayed notification hindered the affected individual's ability to take timely protective measures.
Verbal communication lacked the formality and clarity required for such serious incidents.
These actions violated GDPR Articles 32 and 33, which mandate appropriate security measures and prompt breach notification.
What Does It Mean for Your Organisation?
This case highlights that smaller organisations are not exempt from stringent data protection obligations. Inadequate backup strategies and delayed responses can lead to significant penalties and loss of trust.
To Avoid Similar Pitfalls, Organisations Must:
Implement regular, secure, and tested backup procedures to ensure data can be restored in the event of loss.
Establish clear incident response plans that include timely breach notification protocols.
Ensure all staff are trained in data protection responsibilities and the importance of prompt action during incidents.
Communicate breaches to affected individuals through formal, documented channels to ensure clarity and compliance.
The takeaway?
This case reinforces that effective data protection is not only about preventing breaches but also about responding swiftly and appropriately when things go wrong. Regular backups and timely, clear communication should be cornerstones of any organisation’s data protection strategy.
Tales from the coalface
Each month, we examine Data Protection issues encountered by our clients. This month, we focus on retention periods and why holding on to personal data “just in case” can do more harm than good.
Letting Go is Hard to Do
For many organisations, deleting data is the hardest part of the data lifecycle. It’s easy to understand why: storage is cheap, data might come in handy one day, and deletion introduces uncertainty. But under the GDPR, indefinite retention is rarely lawful, and excessive retention is a growing source of regulatory scrutiny, and for sure a source of risk.
We have seen multiple clients struggle with ageing databases, sprawling archives, and legacy systems containing personal data from past customers, former employees, or long-completed transactions. In nearly all cases, these data stores serve no ongoing business purpose , yet they remain active, searchable, and exposed.
What’s the risk of holding data too long?
Breach impact is magnified: The more data you hold, the more you stand to lose in the event of a cyberattack. Breaches involving outdated or unnecessary personal data can be especially difficult to justify.
It weakens your legal basis: GDPR requires that data be kept no longer than necessary for the purposes for which it was collected (Article 5(1)(e)). Keeping it "just in case" is not a lawful reason.
Regulators are paying attention: Authorities across Europe have issued fines for failure to enforce retention limits. Even when no breach occurs, the mere presence of excessive data can attract sanctions.
Operational inefficiencies: Old data clutters systems, complicates migrations, and makes searches slower and less accurate. It also creates difficulties during subject access requests (SARs), where all relevant data must be retrieved.
Trust erosion: Data-savvy customers and employees expect that their information won’t be held forever. Failing to delete data when it’s no longer needed undermines those expectations.
Why it happens:
No clear data retention policy, or one that lacks practical enforcement mechanisms.
Uncertainty over legal obligations, especially when retention is linked to tax, employment, or contractual rules.
Systems that don’t support automated deletion or flag when retention periods expire.
Fear of deleting something important, especially in complex organisations with multiple stakeholders.
Lack of training or ownership, data just keeps accumulating because no one feels responsible for managing it.
How to fix it:
Establish a data retention schedule: Define how long each category of personal data should be kept, and align this with legal, regulatory, and business needs.
Automate where possible: Configure systems to flag or delete data once retention periods expire. Automation reduces reliance on human intervention.
Assign responsibility: Someone in your organisation, often within legal or compliance, should own the retention policy and ensure it is being followed.
Document your rationale: If you retain data beyond the standard period, be able to demonstrate why. This is especially important if retention is tied to legal obligations or ongoing claims.
Regularly review and purge legacy data: Periodically audit your systems and archives to identify and delete data that is no longer needed.
Retention is about balance: keeping data just long enough to meet legal and operational needs, but no longer. This is a core GDPR principle, not a technical detail. If your organisation is still struggling with expired records, unmanaged archives, or outdated systems, now is the time to act.
Holding on to data “just in case” is not a strategy — it’s a liability.
Contributors to this blog:
Gillian Traynor, Facundo Marcos Heredia and Dwayne Morgan
