What is an inspection or sanction procedure?
It's when an authority —the AEPD, the CCN or a sector regulator— requests information or opens a procedure over a possible breach, often after a complaint or a data breach.
What makes the difference isn't never having had a problem, but being able to prove you acted with due diligence: that you had measures, evidence and procedures in place.
Documentary preparation: included in your plan
When a request arrives, the first thing is to gather what proves your diligence and prepare an orderly, on-time technical response.
- Review of the request and deadlines.
- Collection of evidence of your diligence.
- Technical response and documentary submission.
- A tidy, traceable due-diligence file.
This is included in your Plan Tria. We prepare the documentation, the evidence and the technical response, and coordinate with your lawyer, who handles the legal side. It isn't an extra: it's what your managed service does.
Specialised legal support (add-on service)
Formal legal defence —legal submissions, representation, appeals— is handled by a lawyer. If you don't have one experienced in cybersecurity and data protection, we provide it as an add-on service, with specialist lawyers working side by side with our technical side.
- Submissions and legal defence in the procedure.
- Representation before the authority.
- Strategy to mitigate the sanction.
- Full coordination with the technical evidence we already hold.
What's at stake
- Fines (the GDPR reaches up to €20M or 4% of turnover).
- Mandatory corrective measures.
- Reputation and client trust.
- The precedent for future actions.
How we act
- Analysis of the request. What they ask and by when.
- Evidence collection (included in your plan).
- Technical response and due-diligence file.
- Legal support, if you need it, with specialist lawyers (add-on).
- Follow-up to closure.
The best defence is prepared beforehand. With Plan Tria your due-diligence file is always ready — the day the request arrives, you don't start from scratch.
Frequently asked questions
Is preparing the response included?
Yes. Gathering evidence, preparing the technical response and keeping the due-diligence file ready is part of Plan Tria.
Do you represent me before the AEPD?
Formal legal representation is handled by a lawyer. If you don't have one, we offer legal support as an add-on, with lawyers specialised in cybersecurity, coordinated with our technical side.
How big can the fine be?
The GDPR provides for fines up to €20 million or 4% of global turnover, depending on severity.
Can the sanction be reduced?
Proving diligence, cooperation and corrective measures can mitigate it. That's why having the evidence ready in advance matters.