BULLETIN №083Last updated · 08 Aug 2026
Fine Tracker.
A public register of regulatory fines issued under EU compliance directives. Updated as decisions are published by national supervisory authorities.
5,273 entries
- Total fines
- €8.6bn
- Decisions
- 5,273
- Jurisdictions
- 33
- Regulators
- 74
- Avg monthly
- €162.5m
- YoY volume
- -23.6%
| Imposed | Company | Country | Authority | Type | Amount | ↗ |
|---|---|---|---|---|---|---|
| 24 Feb 2025 | SCHOOL FITNESS HOLIDAY & FRANCHISING, S.L.SCHOOL FITNESS HOLIDAY & FRANCHISING, S.L. was fined by the AEPD 15,000 EUR for recording gym sessions without informing participants or obtaining their consent. The authority found this to be a breach of GDPR rules on consent and personal data processing. | ES | AEPD | GDPR | €15,000 | ↗ |
| 05 Nov 2020 | DR MARÍN CIRUGIA PLÁSTICA, S.L.P.DR MARÍN CIRUGIA PLÁSTICA, S.L.P. was fined EUR 4,000 by the AEPD. The authority found that the company failed to provide a privacy policy on its website and used personal data for marketing purposes without consent. | ES | AEPD | ePrivacy | €4,000 | ↗ |
| 24 Jul 2018 | TELEFONICA MOVILES ESPAÑA, S.A.U.TELEFONICA MOVILES ESPAÑA, S.A.U. was fined by the AEPD 8,100 EUR for sending unsolicited advertising emails without prior recipient consent. The case concerned a breach of Article 21 of the LSSI and reflects unlawful direct marketing practices. | ES | AEPD | ePrivacy | €8,100 | ↗ |
| 01 Jan 2024 | ORANGE BANK, S.A. SUCURSAL EN ESPAÑAOrange Bank was fined for a security breach that exposed personal data. The authority found a violation of Article 5(1)(f) of the GDPR. | ES | AEPD | GDPR | €1,500,000 | ↗ |
| 17 Dec 2019 | B.B.B.A private individual was fined by the AEPD for installing a camera aimed at a public space and a building entrance without justification. The authority found a breach of data protection principles. | ES | AEPD | GDPR | €2,000 | ↗ |
| 07 Oct 2014 | BANCO SANTANDER, S.A.Banco Santander was fined by the AEPD EUR 2,000 for sending commercial emails despite the recipient's objection. The authority found this breached Article 21 of the LSSI on unsolicited electronic communications. | ES | AEPD | ePrivacy | €2,000 | ↗ |
| 07 Jun 2021 | EFS MANTENIMIENTO Y SERVICIOS TÉCNICOS, S.L.EFS MANTENIMIENTO Y SERVICIOS TÉCNICOS, S.L. was fined EUR 1,000 by the AEPD for improperly sharing an employee’s personal data with the company committee. The authority found a breach of data protection rules. | ES | AEPD | GDPR | €1,000 | ↗ |
| 09 Jan 2024 | 20 MINUTOS EDITORA, S.L.20 MINUTOS EDITORA, S.L. was fined 45,000 EUR by the AEPD for publicly exposing the image of a victim of an alleged crime. The authority found that this constituted a breach of data protection rules. | ES | AEPD | GDPR | €45,000 | ↗ |
| 17 Feb 2025 | CLUB DE GOLF VILLA DE CUÉLLARCLUB DE GOLF VILLA DE CUÉLLAR was fined by the AEPD EUR 400 for failing to inform an employee about the installation and operation of surveillance cameras. The authority found a breach of Article 13 GDPR. | ES | AEPD | GDPR | €400 | ↗ |
| 20 Jul 2020 | CENTRO DE INVESTIGACIÓN Y ESTUDIO PARA LA OBESIDAD, S.L.The entity unlawfully transferred personal data without consent, in breach of Article 6 of the GDPR. The case resulted in an administrative fine of 50,000 EUR. | ES | AEPD | GDPR | €50,000 | ↗ |
| 01 Jan 2024 | COMUNIDAD DE PROPIETARIOS L.L.L.COMUNIDAD DE PROPIETARIOS L.L.L. was fined by the AEPD 2,000 EUR for posting a list of debtor co-owners in a publicly accessible area and for sending erroneous debtor lists by email without justification. The authority found that these actions breached data protection principles. | ES | AEPD | GDPR | €2,000 | ↗ |
| 01 Jan 2015 | JYCTEL ESPAÑA SLJYCTEL ESPAÑA SL was fined by the AEPD in the amount of 3,000 EUR for sending unsolicited SMS and WhatsApp messages. The company did not provide information on how to exercise the right to object, which breaches Article 21 of the LSSI. | ES | AEPD | ePrivacy | €3,000 | ↗ |
| 09 Sept 2021 | PACKLINK SHIPPING S.L.PACKLINK SHIPPING S.L. was fined by the AEPD €2,000 for using non-essential cookies on its website without providing the required information or obtaining explicit user consent. The authority treated this as a breach of data protection rules. | ES | AEPD | ePrivacy | €2,000 | ↗ |
| 01 Jan 2025 | B3C CONSULTORÍA DE SERVICIOS 2010 S.L.B3C CONSULTORÍA DE SERVICIOS 2010 S.L. was fined by the AEPD EUR 800 for subcontracting TELCO without authorization from the data controller, AIRE NETWORKS. The company also failed to impose the required contractual obligations on TELCO, breaching GDPR Articles 28.2 and 28.4. | ES | AEPD | GDPR | €800 | ↗ |
| 20 Dec 2025 | JOMAFRAN 2013, S. LJOMAFRAN 2013, S. L was fined by the AEPD EUR 1,400 for sending unsolicited commercial emails without prior consent. The authority found this conduct breached Article 21.1 of the LSSI. | ES | AEPD | ePrivacy | €1,400 | ↗ |
| 22 Jan 2024 | CAJASIETE, CAJA RURAL SOCIEDAD COOPERATIVA DE CREDITOCAJASIETE was fined by the AEPD in the amount of 250,000 EUR for a data security incident. The incident compromised the confidentiality and integrity of personal data, breaching GDPR Article 5(1)(f). | ES | AEPD | GDPR | €250,000 | ↗ |
| 01 Jan 2013 | CONSORCIO PARA LA INNOVACION Y FORMACION EMPRESARIAL S.L.L.The entity was fined by the AEPD in the amount of 1,200 EUR for sending unsolicited commercial emails. This conduct breached Article 21 of the LSSI, which prohibits unwanted marketing communications. | ES | AEPD | ePrivacy | €1,200 | ↗ |
| 10 Apr 2023 | BIROU GAS, S.L.BIROU GAS, S.L. was fined EUR 60,000 by the AEPD for breaching Article 58(1) of the GDPR. The company did not respond to information requests from the supervisory authority. | ES | AEPD | GDPR | €60,000 | ↗ |
| 22 Jul 2022 | MAX2PROTECT, S.L.MAX2PROTECT, S.L. was fined EUR 4,000 by the AEPD for sending commercial emails without the required authorization. The case concerned a breach of Article 21 of the LSSI and involved unauthorized marketing communications. | ES | AEPD | ePrivacy | €4,000 | ↗ |
| 04 Oct 2021 | ENDESA ENERGÍA, S.A.U.ENDESA ENERGÍA, S.A.U. was fined by the AEPD 50,000 EUR for breaching GDPR data accuracy principles. The case involved identity theft and false documentation in a request to transfer an electricity contract. | ES | AEPD | GDPR | €50,000 | ↗ |