Topic starter
31/07/2026 5:21 pm
TL;DR: Spain’s data protection authority has sanctioned Yoti over its Digital ID app, while the company disputes the decision and says no user data was breached, according to Yoti. The case puts consent, processing scope, and regulator-facing accountability at the centre of digital identity governance, especially where biometric or identity verification flows are involved.
Editorial analysis by NHI Mgmt Group, based on content published by Yoti: “Yotiâs response to AEPD sanctions and fine”.
Key questions
Q: What breaks when a digital ID app’s consent scope is too broad?
A: A broad consent scope can make lawful processing harder to defend because it obscures what the user actually agreed to and what the system really does.
Q: Why do identity verification programmes need stronger accountability than ordinary app security?
A: Identity verification programmes process personal data for a specific trust outcome, so regulators expect the organisation to justify purpose, minimisation, retention, and downstream use.
Q: How can security teams tell whether a digital ID workflow is failing governance review?
A: Warning signs include vague consent wording, reused data across services without a clear purpose, retention rules that are not tied to business need, and weak evidence of who approved each processing step.
Practitioner guidance
- Document the processing purpose for each identity flow Break the Digital ID app into discrete processing steps and record the lawful basis, data fields, and retention rule for each step.
- Align consent language to actual data use Review enrolment notices and consent capture points against the system’s real behaviour, including any identity verification, reuse, or sharing steps.
- Separate app-level evidence from platform-wide records Keep logs, policies, and audit evidence segmented so a finding about one digital ID app cannot be confused with broader services.
Bottom line: The core issue here is governance of digital identity processing, not a reported compromise of user data.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
31/07/2026 5:21 pm
Digital identity governance is now a documentation discipline as much as a technology discipline. The sanction described here is a reminder that secure operation does not end the governance conversation if the processing model cannot be defended. For identity programmes, the control question is whether every data use can be explained, evidenced, and constrained to the purpose the user and regulator expect. Practitioners should treat identity architecture, privacy notices, and retention records as one control surface.
A question worth separating out:
Q: Which matters more in a digital identity dispute, technical compromise or processing scope?
A: They are different questions. A compromise is about whether data was exposed or altered, while processing scope is about whether the organisation had the right to collect and use the data in the first place. In privacy cases, scope often drives the regulatory outcome even when no breach is found.
👉 Read our full editorial: AEPD sanction puts digital ID governance and GDPR accountability in focus