Skip to content
OneClubOneClub
GlossaryLegal

Personal Data Breach

Security incident affecting personal data: loss, theft, unauthorised access, accidental destruction. Triggers a 72-hour notification window to the AEPD if there is risk.

Definition

GDPR (arts. 33-34) defines a personal data breach as any violation causing the accidental or unlawful destruction, loss, alteration of personal data transmitted, stored or processed; or unauthorised disclosure or access to such data. Typical sports-club examples: lost USB drive with the member database, email containing data sent to the wrong recipient, hack of the club's website, theft of an unencrypted laptop, accidental leak via a public URL.

Controller duties: 1) record the breach in an internal log, 2) assess the risk to individuals' rights and freedoms, 3) if there is risk, notify the AEPD within 72 hours of becoming aware, 4) if the risk is high, notify affected individuals without undue delay.

When does it apply?

As soon as you become aware of the incident — even if contained. Notification to AEPD is online via their e-office. If it's not possible to assess everything within 72h, file a partial first notification and complete later. Failing to notify when required is a typical AEPD fine.

Practical example

C.D. Bádminton Vigo's board discovers that a spreadsheet with data on 320 members (including minors with date of birth and parents' IDs) was uploaded by mistake to a public Google Drive folder for 48 hours before being noticed. They handle it as: 1) remove the file and log the incident, 2) assess risk (medium: full identifiers of minors), 3) notify the AEPD within 72h with a technical report, 4) write to all affected members explaining what happened and the measures taken. The AEPD accepts the notification and, given diligent behaviour, imposes no sanction.

Common mistakes

  • Not notifying 'to avoid sanction': AEPD fines unnotified breaches harder than the breach itself when well managed.
  • Waiting to 'be sure' before notifying: if you don't have full info in 72h, file a partial notification.
  • Not informing affected individuals when required: GDPR mandates it when risk is high.
  • Not logging unnotified breaches: even low-risk breaches must be internally recorded.

Related terms

If you care about this term, you probably also wonder about these:

Go deeper

Long-form guides and product pages where we cover this topic in depth:

This is not specific legal or tax advice

Information as of May 2026. Regulation evolves and every club has its own casuistry (region, federation, size, activities). For your specific case talk to a lawyer or tax advisor specialised in Spanish sports law.

Move from Excel to software built for sports clubs

SEPA + card payments with Stripe, member portal, player onboarding, ticketing. Free up to 50 members, no card required.