Compulsory of the obligation established in Article 32.2 of the GDPR.

SocMobility (processing controller) did not adequately determine the appropriate security measures to guarantee a safety level appropriate to the risk of the data processing entrusted to Indra (those who are in charge of processing) for the implementation and management of the T-Mobility card, while in the processing order contract the SocMobility entity indicated to Indra that the security measures it had to implement for the provision of the services being commissioned were of the basic level, i.e. it categorized the system as basic, when according to the concurrent circumstances in the processing being commissioned, the basic level was not sufficient.