BULLETIN №083Last updated · 09 Aug 2026
Fine Tracker.
A public register of regulatory fines issued under EU compliance directives. Updated as decisions are published by national supervisory authorities.
5,273 entries
- Total fines
- €8.6bn
- Decisions
- 5,273
- Jurisdictions
- 33
- Regulators
- 74
- Avg monthly
- €162.5m
- YoY volume
- -23.1%
| Imposed | Company | Country | Authority | Type | Amount | ↗ |
|---|---|---|---|---|---|---|
| 01 Jan 2022 | ANIVERSALIA NETWORKS, S.L.ANIVERSALIA NETWORKS, S.L. was fined €2,000 by the AEPD. The authority found that the website did not provide adequate contact information for individuals to exercise their data protection rights. | ES | AEPD | GDPR | €2,000 | ↗ |
| 01 Oct 2024 | IBERCAJA BANCO, S.A.Ibercaja Banco, S.A. accessed personal data in the BADEXCUG EXPERIAN file 47 times without consent after the contractual relationship ended. The AEPD found this to be a breach of data protection rules and imposed a 300,000 EUR fine. | ES | AEPD | GDPR | €300,000 | ↗ |
| 21 Sept 2022 | GUUDJOB WORLDWIDE S.L.GUUDJOB WORLDWIDE S.L. failed to delete personal data after a data subject request, breaching GDPR Articles 12 and 17. The AEPD imposed a fine of EUR 1,000, reduced to EUR 800 for early payment. | ES | AEPD | GDPR | €1,000 | ↗ |
| 01 Jan 2023 | OPEN BANK, S.A.Openbank was fined by the AEPD for opening a bank account without the individual's authorization. The account was later used for fraudulent activities, indicating failures in verification and data protection controls. | ES | AEPD | GDPR | €70,000 | ↗ |
| 01 Jan 2024 | DIGI SPAIN TELECOM, S.L.DIGI SPAIN TELECOM, S.L. was fined by the AEPD 120,000 EUR for a data protection breach involving unauthorized SIM card duplication. The incident enabled fraudulent activity, and the authority found that the company had not implemented sufficient preventive measures. | ES | AEPD | GDPR | €120,000 | ↗ |
| 29 Jun 2020 | VODAFONE ESPAÑA, S.A.U.VODAFONE ESPAÑA, S.A.U. was fined by the AEPD EUR 60,000 for unauthorized processing of personal data. The case involved a fraudulent contract and the porting of a customer's phone line without a valid legal basis. | ES | AEPD | GDPR | €60,000 | ↗ |
| 29 Sept 2020 | PLAY ORENES, S.L.PLAY ORENES, S.L. was fined by the AEPD €20,000 for improperly positioning surveillance cameras. The cameras captured public areas, which breached data protection rules. | ES | AEPD | GDPR | €20,000 | ↗ |
| 20 Jul 2020 | CABRERA & GIL ABOGADOS, S.L.P.CABRERA & GIL ABOGADOS, S.L.P. was fined by the AEPD €2,000 for disclosing personal data without consent. The case concerns Article 6 GDPR, which requires a valid legal basis for processing personal data. | ES | AEPD | GDPR | €2,000 | ↗ |
| 01 Jan 2015 | Doña C.C.C.Doña C.C.C. was fined EUR 1,000 by the AEPD. The sanction concerned sending unsolicited commercial communications without a valid opt-out mechanism, in breach of Article 21 of the LSSI. | ES | AEPD | ePrivacy | €1,000 | ↗ |
| 24 Feb 2014 | DTS DISTRIBUIDORA DE TELEVISION DIGITAL, S.A.DTS DISTRIBUIDORA DE TELEVISION DIGITAL, S.A. was fined by the AEPD in the amount of EUR 37,000 for continuing to send unsolicited emails to a former customer. The conduct occurred after the customer requested deletion of their data and breached Article 21 of the LSSI. | ES | AEPD | ePrivacy | €37,000 | ↗ |
| 09 Jul 2025 | VODAFONE ESPAÑA, S.A.U.VODAFONE ESPAÑA, S.A.U. was fined by the AEPD 150,000 EUR for issuing a SIM card duplicate without proper consent. The incident led to unauthorized bank transfers and involved processing personal data without a lawful basis. | ES | AEPD | GDPR | €150,000 | ↗ |
| 17 May 2021 | Vodafone Servicios, S.L.U.The AEPD fined Vodafone Servicios, S.L.U. 50,000 EUR for processing personal data without proper consent. The breach led to unauthorized charges on a customer's bank account. | ES | AEPD | GDPR | €50,000 | ↗ |
| 31 May 2021 | AUTOMECANICA JÉREZ, S.L.AUTOMECANICA JÉREZ, S.L. was fined EUR 4,000 by the AEPD. The authority found that the company sent a mass email without masking personal data and sent commercial emails and SMS messages without consent. | ES | AEPD | ePrivacy | €4,000 | ↗ |
| 06 Apr 2022 | VODAFONE ESPAÑA, S.A.U.VODAFONE ESPAÑA, S.A.U. was fined by the AEPD EUR 70,000 for processing personal data without consent. The case concerned a contract being formalized without the complainant’s consent, which breached lawful processing requirements. | ES | AEPD | GDPR | €70,000 | ↗ |
| 01 Jul 2020 | CAFÉ RESTAURANTE B.B.B.The entity installed a surveillance camera facing a public space, despite recommendations from the local police. This breached data protection regulations. | ES | AEPD | GDPR | €1,500 | ↗ |
| 01 Jan 2016 | SYS N PROCS FR EXPS, S.L.SYS N PROCS FR EXPS, S.L. was fined 2,000 EUR by the AEPD. The authority found that the company sent unsolicited commercial emails without prior consent, in breach of Article 21.1 of the LSSI. | ES | AEPD | ePrivacy | €2,000 | ↗ |
| 04 May 2010 | A.A.A.A.A.A. was fined by the AEPD EUR 600 for sending unsolicited commercial emails without the recipients’ consent. The conduct breached Article 21.1 of the LSSI, which governs electronic marketing communications. | ES | AEPD | ePrivacy | €600 | ↗ |
| 30 Jan 2024 | HUELLAS AVENTURA, S.L.The company was fined by the AEPD for tying consent for a school trip service to acceptance of data protection policies and commercial communications. The authority also found that users were not given an option to object to the processing of minors' images. | ES | AEPD | GDPR | €10,000 | ↗ |
| 15 Sept 2016 | SELF TRADE BANK, SAUSELF TRADE BANK, SAU was fined by the AEPD EUR 2,000 for sending unsolicited commercial emails to a customer. The customer had not authorized the use of their personal data for promotional purposes, which breached Article 21.1 of the LSSI. | ES | AEPD | ePrivacy | €2,000 | ↗ |
| 03 May 2023 | VODAFONE ESPAÑA, S.A.U.Vodafone España was fined EUR 20,000 by the AEPD for irregularities in the cookie policy on its website. The authority found a breach of Article 22.2 of the LSSI. | ES | AEPD | ePrivacy | €20,000 | ↗ |