Introduction

Data theft from banks and other financial institutions is a major legal and operational risk in Spain. It can involve hackers stealing customer credentials, insiders copying account records, ransomware groups extracting databases, phishing attacks that obtain card information, or service providers exposing banking data. The incident may affect personal data, payment information, commercial secrets, authentication credentials, and records protected by banking confidentiality.

Spanish law treats this as more than a technology failure. A bank may face criminal investigations against the thief, supervisory action for inadequate controls, data-protection enforcement, contractual claims, and civil compensation claims from customers. The legal response depends on what data was taken, how it was accessed, the security measures in place, and the actual risk created for individuals and the financial system.

Legal and Regulatory Framework

The central privacy framework is the EU General Data Protection Regulation (GDPR), directly applicable in Spain, together with Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD). A data theft is normally a “personal data breach” where it causes unlawful access, disclosure, loss, alteration, or destruction of personal information.

Under GDPR Article 32, a bank must apply security measures appropriate to the risk. These may include encryption, strong access controls, multi-factor authentication, network monitoring, segregation of sensitive databases, backup protection, incident testing, staff training, and supplier controls. Because banks process highly valuable financial and identity data, they are expected to maintain a high standard of protection.

GDPR Article 33 generally requires notification to the Spanish Data Protection Agency (AEPD) within 72 hours after the institution becomes aware of a breach that is likely to create a risk to individuals’ rights and freedoms. The notification must describe the breach, categories and approximate number of affected persons and records, likely consequences, and remedial measures.

Where the theft is likely to create a high risk, such as exposure of passwords, card data, identity documents, account details, or data enabling fraud, Article 34 requires prompt communication to affected customers. The bank must explain the nature of the incident, give a contact point, and set out practical protective steps. Strong encryption can reduce or remove the notification obligation if stolen data is unintelligible to the attacker.

Spain’s Criminal Code also applies. Unauthorised access to computer systems, interception of communications, disclosure of secrets, fraud, identity misuse, and damage to computer systems can lead to criminal liability. Employees, contractors, hackers, and organised criminal groups may all be investigated. If a company’s poor governance facilitated offences, corporate criminal liability may also arise under the Criminal Code.

For regulated financial entities, the Digital Operational Resilience Act (DORA) adds EU-wide operational-resilience duties. Banks must manage ICT risk, test resilience, maintain incident-management processes, classify and report major ICT-related incidents, and control risks created by critical third-party technology providers. The Bank of Spain and other competent authorities can examine governance and operational resilience alongside traditional prudential supervision.

Bank Duties, Customer Rights and Remedies

A bank must act quickly after discovering suspected data theft. It should contain access, preserve forensic evidence, reset compromised credentials, assess whether payment systems are affected, identify the data and persons involved, and document every decision. It must also review whether a processor, cloud provider, payment provider, or outsourced call centre contributed to the breach.

Affected customers may exercise GDPR rights of access, rectification, erasure, restriction, objection, and portability where relevant. More importantly after theft, they may complain to the AEPD, seek an order requiring corrective measures, and claim compensation under GDPR Article 82 if they suffered material or non-material damage.

Compensation is not automatic merely because a breach occurred. The person must show a GDPR infringement, actual damage, and a causal link. Damage may include unauthorised transactions, identity fraud, costs of replacing documents, or genuine emotional distress caused by loss of control over sensitive banking information. A bank cannot avoid responsibility simply by blaming a processor; controllers must ensure processors provide sufficient guarantees and comply with contractual security duties.

Payment losses may additionally be assessed under payment-services rules. If stolen data leads to an unauthorised payment transaction, the payment service provider must generally refund the payer promptly unless it can establish customer fraud or, in appropriate cases, gross negligence. The privacy breach and payment-refund issue can therefore run in parallel.

Enforcement and Institutional Response

The AEPD can investigate banks and impose corrective measures and administrative fines. GDPR penalties can reach up to €20 million or 4% of worldwide annual turnover, depending on the violation. In practice, the authority considers the severity, duration, number of people affected, safeguards used, cooperation, and remedial action.

The Bank of Spain focuses on financial stability, governance, operational risk, outsourcing, and continuity. A serious theft may reveal weaknesses in internal controls, risk management, outsourcing oversight, or incident escalation. The National Cybersecurity Institute (INCIBE) and Spain’s national cyber-security bodies may also provide technical coordination, while the police and public prosecutor investigate cybercrime.

Case Laws

1. STC 292/2000, Spanish Constitutional Court
   The Court recognised the fundamental right to data protection as giving individuals power over their personal information. This constitutional basis supports strict safeguards when banks hold extensive personal and financial data.
2. C-300/21, UI v Österreichische Post AG
   The Court of Justice of the European Union (CJEU) held that a GDPR breach alone does not automatically create a right to compensation. Actual damage and a causal link are required.
3. C-340/21, Natsionalna agentsia za prihodite
   The CJEU considered a cyberattack involving stolen personal data. It confirmed that fear of possible misuse can qualify as non-material damage if it is genuine, while security measures must be assessed against the actual risk.
4. C-456/22, VX v Gemeinde Ummendorf
   The CJEU reaffirmed that non-material damage must be real, but it does not need to cross a particular seriousness threshold. This is important for customers distressed by exposure of banking data.
5. C-807/21, Deutsche Wohnen
   The CJEU clarified that GDPR administrative fines apply where an undertaking intentionally or negligently infringes the Regulation. Banks must therefore demonstrate active compliance, not merely possess written policies.
6. C-154/21, RW v Österreichische Post AG
   The CJEU stressed that access rights must give meaningful information about recipients of disclosed personal data. After a theft or unlawful disclosure, transparency about who received data can be essential.

Conclusion

In Spain, data theft from a financial institution can trigger privacy, criminal, payment-services, operational-resilience, and supervisory consequences at the same time. The strongest defence is preventive: encryption, layered access controls, tested incident plans, supplier oversight, and clear governance. Once theft occurs, rapid containment, lawful notification, honest customer communication, and documented remediation are critical to reducing harm and legal exposure.