Content type · 1,181 documents

Enforcement

Regulatory actions, fines, warnings, and enforcement decisions

🇪🇺 EU 🇳🇱 NL
Enforcement dashboard — fines by country, authority and article →
Country: Spain (50) Clear filter
Filter by Topic Supervisory Authorities3518 Processing Agreement2798 Processing2594 Personal Data2548 Controllers2165 Data Controller1854 Law Enforcement1541 IP Address1278 Security1007 Supervision854 Monitoring523 Consent498
Spain AEPD (Spain) - EXP202103746 Facts — A complaint is filed against the controller for having six surveillance cameras facing public highway and private spaces without authorisation. In addition to the claim,… Video Surveillance Retention Period Monitoring Jul 17, 2026
Spain · €200,000 AEPD (Spain) - PS-00020-2025 Facts — Alkora, S.A., the controller, is an insurance broker that was victim of a ransomware attack. The controller notified the DPA of a personal data breach after a ransomware… Privacy Impact Assessment DPIA Security Jul 16, 2026
Spain AEPD (Spain) - EXP202102529 Facts — A student handed in a complaint against the University of Navarra because they asked the students to fill in their vaccination status. The complainant understands this as… Consent Health Data Healthcare Jul 16, 2026
Spain AEPD (Spain) - E/03783/2020 Facts — The Directorate for National Security of the Ministry of Interior issued guidelines for the police forces to monitor news and social networks to spot fake news and… Social Media Monitoring Personal Data Jul 15, 2026
Spain · €140 AEPD (Spain) - EXP202310345 Facts — On December 28, 2022, DIGI Telecom, the controller, delivered a duplicate SIM card to an unauthorized third party without the consent of the original line holder (the data… Telecommunications Controllers Accountability Jul 13, 2026
aepd · €240 Posada del León de Oro: Non-compliance with general data processing principles Spanish Data Protection Authority (aepd) fined Posada del León de Oro €240 on 2026-04-28 for: Non-compliance with general data processing principles. Employees IP Address Processing Apr 28, 2026
aepd · €1,800 RESIDENCIAL ETXE-LAN, S.L.: Insufficient cooperation with supervisory authority Spanish Data Protection Authority (aepd) fined RESIDENCIAL ETXE-LAN, S.L. €1,800 on 2026-04-28 for: Insufficient cooperation with supervisory authority. Supervisory Authorities Supervision Apr 28, 2026
aepd · €4,000 SIPHONE 2020, S.L.: Insufficient legal basis for data processing Spanish Data Protection Authority (aepd) fined SIPHONE 2020, S.L. €4,000 on 2026-04-28 for: Insufficient legal basis for data processing. IP Address Employees Processing Apr 28, 2026
aepd · €6,000 GATIGOS, S.L.: Insufficient cooperation with supervisory authority Spanish Data Protection Authority (aepd) fined GATIGOS, S.L. €6,000 on 2026-04-28 for: Insufficient cooperation with supervisory authority. Supervisory Authorities Supervision Apr 28, 2026
aepd · €300,000 KONECTA BTO, S.L.: Insufficient technical and organisational measures to ensure information security Spanish Data Protection Authority (aepd) fined KONECTA BTO, S.L. €300,000 on 2026-04-22 for: Insufficient technical and organisational measures to ensure information security. Security Supervisory Authorities Apr 22, 2026
aepd · €400,000 CAIXABANK, S.A.: Insufficient technical and organisational measures to ensure information security The Spanish Data Protection Authority (AEPD) fined Caixabank, S.A. €400,000 for failing to implement sufficient technical and organizational measures to ensure information… Privacy by Default Privacy by Design Accountability Apr 15, 2026
aepd · €150,000 ALÍA GESTIÓN INTEGRAL DE SERVICIOS, S.L.: Insufficient technical and organisational measures to ensure information security The Spanish Data Protection Authority (AEPD) fined ALÍA GESTIÓN INTEGRAL DE SERVICIOS, S.L. €150,000 for failing to implement sufficient technical and organizational measures to… Integrity and Confidentiality Principle Security Personal Data Mar 20, 2026
aepd · €600 CENTRO MEDICO REY FERNANDO, S.L.P.: Insufficient fulfilment of data subjects rights Spanish Data Protection Authority (aepd) fined CENTRO MEDICO REY FERNANDO, S.L.P. €600 on 2026-03-13 for: Insufficient fulfilment of data subjects rights. Healthcare Personal Data Supervisory Authorities Mar 13, 2026
aepd · €600 SERVICIOS INMOBILIARIOS Y GESTIÓN RCL MADRID, S.L.: Insufficient cooperation with supervisory authority Spanish Data Protection Authority (aepd) fined SERVICIOS INMOBILIARIOS Y GESTIÓN RCL MADRID, S.L. €600 on 2026-03-13 for: Insufficient cooperation with supervisory authority. Supervisory Authorities Supervision Mar 13, 2026
aepd · €18,000 RAMÓN GRAU, S.L.: Insufficient legal basis for data processing Spanish Data Protection Authority (aepd) fined RAMÓN GRAU, S.L. €18,000 on 2026-03-13 for: Insufficient legal basis for data processing. Employees Processing Supervisory Authorities Mar 13, 2026
aepd · €450 Housing Association: Insufficient cooperation with supervisory authority Spanish Data Protection Authority (aepd) fined Housing Association €450 on 2026-03-13 for: Insufficient cooperation with supervisory authority. Supervisory Authorities Supervision Mar 13, 2026
aepd · €650,000 IBERIA LÍNEAS AÉREAS DE ESPAÑA, S.A. OPERADORA: Insufficient technical and organisational measures to ensure information security Spanish Data Protection Authority (aepd) fined IBERIA LÍNEAS AÉREAS DE ESPAÑA, S.A. OPERADORA €650,000 on 2026-03-11 for: Insufficient technical and organisational measures to… Security Supervisory Authorities Mar 11, 2026
aepd · €6,000 CUMACA MOTOR, S.L.: Insufficient legal basis for data processing Spanish Data Protection Authority (aepd) fined CUMACA MOTOR, S.L. €6,000 on 2026-03-10 for: Insufficient legal basis for data processing. Processing Supervisory Authorities Mar 10, 2026
aepd · €200,000 ARES CAPITAL, S.A.: Insufficient legal basis for data processing Spanish Data Protection Authority (aepd) fined ARES CAPITAL, S.A. €200,000 on 2026-03-04 for: Insufficient legal basis for data processing. Employees Processing Supervisory Authorities Mar 4, 2026
aepd · €900 ORNITOLÓGICA DE ANDALUCÍA FOA: Non-compliance with general data processing principles Spanish Data Protection Authority (aepd) fined ORNITOLÓGICA DE ANDALUCÍA FOA €900 on 2026-03-02 for: Non-compliance with general data processing principles. IP Address Processing Supervisory Authorities Mar 2, 2026
aepd · €2,000 MALAGASUITE SHOWROOM, S.L.: Insufficient fulfilment of data subjects rights Spanish Data Protection Authority (aepd) fined MALAGASUITE SHOWROOM, S.L. €2,000 on 2026-03-02 for: Insufficient fulfilment of data subjects rights. Personal Data Supervisory Authorities Healthcare Mar 2, 2026
aepd · €8,500 HIGHCLIFFE ESTATES MARBELLA, S.L.: Insufficient legal basis for data processing Spanish Data Protection Authority (aepd) fined HIGHCLIFFE ESTATES MARBELLA, S.L. €8,500 on 2026-03-02 for: Insufficient legal basis for data processing. Processing Supervisory Authorities Mar 2, 2026
aepd · €1,000 Spain DPA: Non-compliance with general data processing principles Spanish Data Protection Authority (aepd) fined an unnamed party €1,000 on 2026-03-01 for: Non-compliance with general data processing principles. Processing Agreement IP Address Supervisory Authorities Mar 1, 2026
aepd · €12,000 HOLY MARY CATHOLIC SCHOOL, S.L.: Insufficient legal basis for data processing Spanish Data Protection Authority (aepd) fined HOLY MARY CATHOLIC SCHOOL, S.L. €12,000 on 2026-03-01 for: Insufficient legal basis for data processing. Education Public Authority Processing Mar 1, 2026
Spain · €150,000 AEPD (Spain) - EXP202306354 (PS/00312/2024) Facts — The Spanish Data Protection Agency (AEPD) investigated Vodafone España, S.A.U. as controller after a SIM swapping incident. On 21 September 2021, an unknown third party… Personal Data Integrity and Confidentiality Principle Controllers Feb 11, 2026
aepd · €1,800 Landlord: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 1,800 on a Landlord. The landlord used video surveillance in rental apartments without having a sufficient legal basis. The original fine… Video Surveillance Controllers Processing Agreement Feb 6, 2026
aepd · €10,000 FREE TECHNOLOGIES EXCOM, S.L.: Insufficient technical and organisational measures to ensure information security The Spanish DPA has imposed a fine of EUR 10,000 on FREE TECHNOLOGIES EXCOM, S.L. The controller had reset user passwords and communicated the new passwords to the clients via… Encryption Integrity and Confidentiality Principle Security Feb 3, 2026
aepd · €1,200 Dental Clinic: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 1,200 on a dental clinic. The controller used video surveillance in its clinic for security purposes, including a camera in the doctor's… Video Surveillance Controllers Employees Jan 19, 2026
aepd · €8,000 KVIKU SPAIN, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 8,000 on KVIKU SPAIN, S.L.The controller requires customers to send a photo of themselves holding their ID card when verifying their… Retention Period IP Address Controllers Jan 10, 2026
aepd · €500 VOX ESPAÑA: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 500 on VOX ESPAÑA. The controller, a political party, posted a picture of of a receipt on its Facebook page. The picture of the recipt… Personal Data Controllers Social Media Jan 10, 2026
aepd · €10,000 Ikea Ibérica: Onvoldoende juridische basis voor de verwerking van persoonsgegevens. Boete van €10.000 - Spaanse Autoriteit voor Gegevensbescherming (AEPD). Personal Data Cookies Processing NL Dec 30, 2025
aepd · €5,000 Vodafone España, S.A.U.: Non-compliance with general data processing principles The spanish telecommunications and informations agancy (SETSI) decided Vodafone had to reimburse a customer for costs he was wrongfully charged for. Nevertheless, Vodafone… Accuracy Telecommunications Personal Data Dec 30, 2025
aepd · €60,000 Incassobureau (GESTIÓN DE COBROS, YO COBRO SL): Onvoldoende juridische basis voor de verwerking van persoonsgegevens. Boete van 60.000 euro - Spaanse Autoriteit voor Gegevensbescherming (AEPD). Personal Data Processing Insurance NL Dec 30, 2025
aepd · €27,000 Vodafone España, S.A.U.: Onvoldoende naleving van de rechten van betrokkenen bij de verwerking van persoonsgegevens. Een boete van 27.000 euro - opgelegd door de Spaanse autoriteit voor gegevensbescherming (AEPD). Personal Data Processing Telecommunications NL Dec 30, 2025
aepd · €60,000 ENDESA (energy supplyer): Insufficient legal basis for data processing The complainant's bank account was charged by ENDESA, the beneficiary of which was a third party, who had been convicted under criminal law and imposed with a two-year restraining… Integrity and Confidentiality Principle Confidentiality Obligations and Requirements Professional Secrecy Dec 30, 2025
aepd · €12,000 Madrileña Red de Gas: Insufficient technical and organisational measures to ensure information security The gas company did not have appropriate measures in place to verify the identity of the data subject. The person who filed the complaint alleges that the company e-mailed his… Security Personal Data Law Enforcement Dec 30, 2025
aepd · €27,000 Vodafone España, S.A.U.: Insufficient fulfilment of data subjects rights Although the complainant (a former Vodafone customer) had requested Vodafone to delete his data in 2015 and this request had been confirmed by the company, he received more than… Telecommunications Personal Data Supervisory Authorities Dec 30, 2025
aepd · €10,000 Ikea Ibérica: Insufficient legal basis for data processing The company installed cookies on an end users terminal device without prior consent of the data subject. Cookies Consent Personal Data Dec 30, 2025
aepd · €9,600 Restaurant (SANTI 3000, S.L.): Onvoldoende juridische basis voor de verwerking van persoonsgegevens. Boete van €9.600 - Spaanse Autoriteit voor Gegevensbescherming (AEPD). Processing Personal Data IP Address NL Dec 30, 2025
aepd · €9,600 Restaurant (SANTI 3000, S.L.): Insufficient legal basis for data processing A restaurant wanted to impose disciplinary sanctions on an employee using images from a mobile phone video which was recorded by another employee in the restaurant for evidence… Processing Employees IP Address Dec 30, 2025
aepd · €5,000 Vodafone España, S.A.U.: Overtreding van de algemene principes voor gegevensverwerking. Een boete van 5.000 euro - opgelegd door de Spaanse Autoriteit voor Gegevensbescherming (AEPD). Accuracy Processing IP Address NL Dec 30, 2025
aepd · €12,000 Madrileña Red de Gas: Onvoldoende technische en organisatorische maatregelen om de informatiebeveiliging te waarborgen. 12.000 euro boete - Spaanse Autoriteit voor Gegevensbescherming (AEPD). Security Personal Data Privacy by Design & Default NL Dec 30, 2025
aepd · €60,000 ENDESA (energieleverancier): Onvoldoende juridische basis voor de verwerking van gegevens. Een boete van 60.000 euro - opgelegd door de Spaanse autoriteit voor gegevensbescherming (AEPD). Professional Secrecy Integrity and Confidentiality Principle Confidentiality Obligations and Requirements NL Dec 30, 2025
aepd · €60,000 Debt collecting agancy (GESTIÓN DE COBROS, YO COBRO SL): Insufficient legal basis for data processing After the claimant did alledgedly not pay back a microcredit to an online credit agany, the claim was assigned to the debt collecting agancy. Subsequently, the latter startet… Insurance Processing Supervisory Authorities Dec 30, 2025
aepd · €1,600 NAROBESA INV, S.L.: Onvoldoende samenwerking met de toezichthoudende instantie. 1.600 euro boete - Spaanse Autoriteit voor Gegevensbescherming (AEPD). Supervisory Authorities Controllers Supervision NL Dec 29, 2025
aepd · €1,600 NAROBESA INV, S.L.: Insufficient cooperation with supervisory authority The Spanish DPA has imposed a fine of EUR 1,600 on NAROBESA INV, S.L. The controller failed to react to requests made by the DPA. The original fine of EUR 2,000 was reduced to EUR… Supervisory Authorities Supervision Law Enforcement Dec 29, 2025
aepd · €500,000 CURENERGÍA COMERCIALIZADOR DE ÚLTIMO RECURSO S.A.U.: Insufficient technical and organisational measures to ensure information security The Spanish DPA has imposed a fine of EUR 500,000 on CURENERGÍA COMERCIALIZADOR DE ÚLTIMO RECURSO S.A.U. The controller used a communication tool that was not designed in… Security Processing Agreement IP Address Dec 22, 2025
aepd · €500,000 CURENERGÍA COMERCIALIZADOR DE ÚLTIMO RECURSO S.A.U.: Onvoldoende technische en organisatorische maatregelen om de informatiebeveiliging te waarborgen. Een boete van 500.000 euro - opgelegd door de Spaanse autoriteit voor gegevensbescherming (AEPD). Privacy by Default Privacy by Design Security NL Dec 22, 2025
aepd · €6,000 BLUE TEAM FLIGHT SCHOOL, S.L.: Insufficient cooperation with supervisory authority The Spanish DPA has imposed a fine of EUR 6,000 on BLUE TEAM FLIGHT SCHOOL, S.L. The controller failed to react to requests made by the DPA. Supervisory Authorities Supervision Controllers Dec 20, 2025
aepd · €300 SPAIN, DPA: Onvoldoende samenwerking met de toezichthoudende instantie. Een boete van 300 euro - Spaanse Autoriteit voor Gegevensbescherming (AEPD). Supervisory Authorities Controllers Supervision NL Dec 20, 2025