Compulsory of the obligation established in Article 32.1 of the GDPR.

Indra, in his capacity as sub-processor, did not apply the basic level security measures required by SocMobility in the treatment processor's contract, to ensure a safety level appropriate to the risk (thus to prevent unauthorised persons from accessing these data), since the T-Mobility access portal did not modify the password that the manufacturer of the "Liferay" undercuture assigns to the admin, so that access was opened, and in turn accessible to third parties.