BULLETIN №083Last updated · 07 Aug 2026
Fine Tracker.
A public register of regulatory fines issued under EU compliance directives. Updated as decisions are published by national supervisory authorities.
5,273 entries
- Total fines
- €8.6bn
- Decisions
- 5,273
- Jurisdictions
- 33
- Regulators
- 74
- Avg monthly
- €162.5m
- YoY volume
- -23.7%
| Imposed | Company | Country | Authority | Type | Amount | ↗ |
|---|---|---|---|---|---|---|
| 22 Apr 2022 | CÍTRICOS TANTA, S.L.CÍTRICOS TANTA, S.L. was fined by the AEPD for processing personal data without consent. The case involved registering an individual in the Social Security system without their knowledge or agreement. | ES | AEPD | GDPR | €5,000 | ↗ |
| 28 Nov 2022 | GAVANOVA DE IMMOBLES, S.L.GAVANOVA DE IMMOBLES, S.L. was fined by the AEPD 2,000 EUR for failing to provide an adequate privacy policy on its website. The authority also found that personal data was shared with a cleaning company without the data subjects’ consent. | ES | AEPD | GDPR | €2,000 | ↗ |
| 30 Apr 2014 | COMERCIAL POLINDUS 21 S.L.COMERCIAL POLINDUS 21 S.L. was fined by the AEPD 3,000 EUR for sending unsolicited and misleading commercial messages by electronic means. The authority found a breach of Article 21 of the LSSI on marketing communications without prior consent. | ES | AEPD | ePrivacy | €3,000 | ↗ |
| 09 Jul 2023 | PROSULTING, S.L.N.E.PROSULTING, S.L.N.E. was fined by the AEPD in the amount of 1,000 EUR for failing to provide data subjects with the information required under Article 13 GDPR. The case concerned a lack of proper notice about the processing of personal data. | ES | AEPD | GDPR | €1,000 | ↗ |
| 01 Jan 2021 | MAX2PROTECT, S.L.MAX2PROTECT, S.L. was fined by the AEPD 4,000 EUR for sending spam emails without recipient consent. The authority also found unlawful processing of personal data collected from public websites without proper legal basis. | ES | AEPD | GDPR | €4,000 | ↗ |
| 20 Apr 2016 | TELEFÓNICA DE ESPAÑA, S.A.U.Telefónica de España, S.A.U. was fined by the AEPD in the amount of 12,000 EUR for continuing to send advertising to a complainant despite repeated requests to stop. The authority found this conduct breached Article 21 of the LSSI. | ES | AEPD | ePrivacy | €12,000 | ↗ |
| 22 Jan 2024 | ASILO DE ANCIANOS SANTO DOMINGO Y SANTA ELOISAThe organization was fined for repeatedly sending emails with visible recipient addresses. The case involved a breach of data protection principles and a failure to implement adequate security measures. | ES | AEPD | GDPR | €1,000 | ↗ |
| 25 May 2018 | Banco Bilbao Vizcaya Argentaria SABanco Bilbao Vizcaya Argentaria SA was fined by the AEPD for sending unsolicited commercial SMS messages to a non-customer without consent. The case concerns a breach of direct marketing rules and the requirement to obtain prior consent. | ES | AEPD | ePrivacy | €3,300 | ↗ |
| 31 May 2023 | D.D.D.The entity installed surveillance cameras without authorization, breaching Article 5(1)(c) of the GDPR. The AEPD imposed a fine of EUR 500. | ES | AEPD | GDPR | €500 | ↗ |
| 31 May 2024 | CUMACA MOTOR, S.L.CUMACA MOTOR, S.L. was fined EUR 7,500 by the AEPD for requiring customers to provide a copy of their identity document without a valid justification. The authority found that this breached the GDPR data minimization principle. | ES | AEPD | GDPR | €7,500 | ↗ |
| 11 Oct 2023 | CONSULTORÍA PERITACIONES ALMERIENSES, S.L.The company was fined by the AEPD 1,000 EUR for not having a privacy policy on its website. The issue arose because it collected personal data through a contact form, triggering the information duties under GDPR Article 13. | ES | AEPD | GDPR | €1,000 | ↗ |
| 28 Feb 2025 | DYNAMIC EXPRESS COURIER S.LDYNAMIC EXPRESS COURIER S.L was fined 15,000 EUR by the AEPD for subcontracting without prior authorization and for failing to put proper contracts in place with subcontractors. The authority found this conduct breached GDPR Article 28 on processor arrangements. | ES | AEPD | GDPR | €15,000 | ↗ |
| 01 Jan 2022 | BOOKSY INTERNATIONAL SPOLKA, S.L.BOOKSY INTERNATIONAL SPOLKA, S.L. was fined by the AEPD €500 for sending unsolicited commercial SMS messages. The recipient was registered on the Robinson List, which constituted a breach of Article 21 of the LSSI. | ES | AEPD | ePrivacy | €500 | ↗ |
| 27 Jul 2016 | MUDICOM IMPORT S.L.MUDICOM IMPORT S.L. was fined by the AEPD EUR 1,000 for sending unsolicited commercial emails without the recipient's consent. The authority found this conduct breached Article 21.1 of the LSSI. | ES | AEPD | ePrivacy | €1,000 | ↗ |
| 21 Oct 2020 | HEREDAD DE UREÑA, S.L.HEREDAD DE UREÑA, S.L. was fined by the AEPD EUR 4,000 for not having a privacy policy on its website, lacking a cookies policy, and sending unsolicited marketing emails without consent. The case indicates failures in basic transparency obligations and consent requirements for electronic communications. | ES | AEPD | GDPR | €4,000 | ↗ |
| 25 Mar 2024 | KUR KLINIKUM, S.L.KUR KLINIKUM, S.L. was fined EUR 1,000 by the AEPD for failing to comply with a data protection authority resolution. The case concerned the right of access to personal data. | ES | AEPD | GDPR | €1,000 | ↗ |
| 08 Mar 2023 | RING RING CLIN S.L.RING RING CLIN S.L. was fined 500 EUR by the Spanish Data Protection Agency (AEPD). The case concerned the failure to provide requested information, which breaches Article 58.1 of the GDPR. | ES | AEPD | GDPR | €500 | ↗ |
| 19 Feb 2018 | AVIS ALQUILE UN COCHE S.A.AVIS ALQUILE UN COCHE S.A. was fined by the AEPD 10,000 EUR for improper handling of personal data. This led to the wrongful publication of an individual's details in the Official State Gazette as the responsible party for a traffic violation they did not commit. | ES | AEPD | GDPR | €10,000 | ↗ |
| 09 Mar 2020 | OLIVEROS USTRELL, S.L.OLIVEROS USTRELL, S.L. was fined 10,000 EUR by the AEPD for unauthorized processing of a customer's personal and banking data. The case involved a fraudulent mobile contract and number portability carried out without a valid legal basis. | ES | AEPD | GDPR | €10,000 | ↗ |
| 01 Jan 2021 | VODAFONE ESPAÑA, S.A.U.VODAFONE ESPAÑA, S.A.U. was fined by the AEPD 50,000 EUR for breaching data protection rules. The case concerned deficiencies in the security and integrity of data processing. | ES | AEPD | GDPR | €50,000 | ↗ |