Order report
BULLETIN №081Last updated · 27 Jul 2026

Fine Tracker.

A public register of regulatory fines issued under EU compliance directives. Updated as decisions are published by national supervisory authorities.

5,273 entries

Total fines
€8.6bn
Decisions
5,273
Jurisdictions
33
Regulators
74
Avg monthly
€162.7m
YoY volume
-20.7%
Country
Type
Date range
ImposedCompanyCountryAuthorityTypeAmount↗
26 Sept 2012DIGITARAN, S.L.U.DIGITARAN, S.L.U. was fined by the AEPD 3,000 EUR for sending unsolicited advertising SMS messages to a user registered on the Robinson List. The conduct breached Article 21 of the LSSI on marketing communications without prior consent.ESAEPDePrivacy€3,000↗
19 May 2016GRUPO YAMM COMIDA A DOMICILIO, S.L.GRUPO YAMM COMIDA A DOMICILIO, S.L. was fined by the AEPD €1,400 for sending unsolicited commercial emails to a complainant despite requests to stop. The case concerns a breach of the LSSI rules on marketing communications.ESAEPDePrivacy€1,400↗
24 Jan 2024CAJA RURAL DEL SUR, S.C.C.CAJA RURAL DEL SUR, S.C.C. was fined EUR 20,000 by the AEPD for breaching data protection principles. The authority found that confidentiality and integrity of personal data were not adequately ensured, resulting in unauthorized access by third parties.ESAEPDGDPR€20,000↗
08 Sept 2020XFERA MÓVILES, S.A.XFERA MÓVILES, S.A. was fined by the AEPD €40,000 for processing personal data without a legal basis. The case involved fraudulent contracts created in individuals’ names without their consent, breaching the principle of lawful processing.ESAEPDGDPR€40,000↗
24 Jul 2024MONUMENTAL FORMA SPORT, S.L.MONUMENTAL FORMA SPORT, S.L. was fined EUR 5,000 by the AEPD for sending unsolicited commercial SMS messages without recipient consent. The case concerned Article 21 of the LSSI, which requires prior consent for electronic marketing communications.ESAEPDePrivacy€5,000↗
09 Jan 2023TELEFÓNICA MÓVILES ESPAÑA, S.A.U.TELEFÓNICA MÓVILES ESPAÑA, S.A.U. was fined by the AEPD 200,000 EUR after a SIM swapping incident enabled unauthorized bank transactions. The authority found a breach of Article 6(1) of the GDPR.ESAEPDGDPR€200,000↗
16 Apr 2025COMUNIDAD DE PROPIETARIOS ***COMUNIDAD.1The community of property owners was fined by the AEPD for publishing personal data on a notice board. The authority found a breach of the confidentiality principle under GDPR.ESAEPDGDPR€1,000↗
08 Apr 2024VODAFONE ESPAÑA, S.A.U.The AEPD imposed a fine of 250,000 EUR on VODAFONE ESPAÑA, S.A.U. for failing to implement adequate measures to prevent unauthorized access to personal data. The authority found a breach of the GDPR confidentiality requirements.ESAEPDGDPR€250,000↗
01 Jan 2013ALLCUPONE ESPAÑA S.L.ALLCUPONE ESPAÑA S.L. was fined by the AEPD in the amount of 600 EUR for sending unsolicited commercial emails. This conduct breached Article 21 of Spain’s LSSI, which restricts marketing communications without prior consent.ESAEPDePrivacy€600↗
04 Oct 2024DIAMOND FERVA, S.L.DIAMOND FERVA, S.L. was fined by the AEPD 1,000 EUR for installing a surveillance camera without properly informing data subjects and without the required authorization. The authority treated this as a breach of the information obligations under GDPR Article 13.ESAEPDGDPR€1,000↗
12 Jun 2015JAZZ TELECOM S.A.U.JAZZ TELECOM S.A.U. was fined by the AEPD EUR 2,900 for continuing to send advertising SMS messages to a user despite multiple requests to stop. The authority found a breach of Article 21 of the LSSI on unsolicited marketing communications.ESAEPDePrivacy€2,900↗
04 Mar 2024EXESRIVAS GESTIÓN PATRIMONIALThe entity sent unsolicited commercial messages via WhatsApp despite the complainant's explicit refusal to receive such communications. AEPD found a breach of Article 21 of the LSSI and imposed a 300 EUR fine.ESAEPDePrivacy€300↗
19 Nov 2024CLUB ESPORTIU VILA OLÍMPICAThe club pressured a parent to obtain consent for collecting images of a minor child. AEPD found this to be a breach of data protection rules.ESAEPDGDPR€1,000↗
28 Mar 2023DENTAL REY-GAR, S.L.DENTAL REY-GAR, S.L. was fined by the AEPD EUR 1,000 for failing to comply with a resolution concerning the right of access to personal data. The authority found a breach of Article 58(2) of the GDPR.ESAEPDGDPR€1,000↗
10 Jun 2024KAFFA KOFFEE ORGANISATION, S.L.KAFFA KOFFEE ORGANISATION, S.L. was fined by the AEPD EUR 2,000 for sending an email to more than 400 recipients without using BCC. This exposed other recipients’ email addresses and breached GDPR Articles 5(1)(f) and 32.ESAEPDGDPR€2,000↗
30 Jul 2025ONEY SERVICIOS FINANCIEROS EFC, S.A.The AEPD fined ONEY Servicios Financieros EFC, S.A. 150,000 EUR for failing to adequately protect personal data. The breach led to a security incident in which a third party accessed a customer's account through a vishing attack.ESAEPDGDPR€150,000↗
11 Jan 2021RIPOBRUNA 2007, S.L.RIPOBRUNA 2007, S.L. was fined by the AEPD 2,000 EUR for installing surveillance cameras directed toward public spaces without justified cause. The authority found this processing to be contrary to data protection principles.ESAEPDGDPR€2,000↗
30 Jul 2014ORANGE ESPAGNE S.A.U.ORANGE ESPAGNE S.A.U. was fined by the AEPD EUR 1,500 for sending unsolicited commercial SMS messages. The recipient had previously requested removal from the advertising list, and the conduct breached Article 21.1 of the LSSI.ESAEPDePrivacy€1,500↗
09 Sept 2021B.B.B.B.B.B. was fined by the AEPD for installing a CCTV system in a café that recorded public areas without proper signage. The authority found this to be a breach of data protection rules.ESAEPDGDPR€1,000↗
15 Jul 2024ASNEF-EQUIFAX, SERVICIOS DE INFORMACIÓN SOBRE SOLVENCIA Y CRÉDITO, S.L.ASNEF-EQUIFAX was fined by the AEPD 200,000 EUR for failing to properly handle a data subject’s request for deletion and for processing personal data without a legal basis. The case concerns breaches of core data protection obligations.ESAEPDGDPR€200,000↗