BULLETIN №081Last updated · 27 Jul 2026
Fine Tracker.
A public register of regulatory fines issued under EU compliance directives. Updated as decisions are published by national supervisory authorities.
5,273 entries
- Total fines
- €8.6bn
- Decisions
- 5,273
- Jurisdictions
- 33
- Regulators
- 74
- Avg monthly
- €162.7m
- YoY volume
- -20.7%
| Imposed | Company | Country | Authority | Type | Amount | ↗ |
|---|---|---|---|---|---|---|
| 11 Sept 2024 | NEGOCIOS R&R 2020 S.L.NEGOCIOS R&R 2020 S.L. was fined by the AEPD 12,000 EUR for failing to provide access under Article 58(1) of the GDPR. The authority treated this as a serious breach of data protection obligations. | ES | AEPD | GDPR | €12,000 | ↗ |
| 01 Jan 2024 | B.B.B.The entity “Amor Ideal”, a personal relationship agency, was fined EUR 600 by the AEPD. The authority found that it failed to provide the required information about personal data processing, which constitutes a breach of Article 13 GDPR. | ES | AEPD | GDPR | €600 | ↗ |
| 18 Feb 2026 | ALÍA GESTIÓN INTEGRAL DE SERVICIOS, S.L.ALÍA GESTIÓN INTEGRAL DE SERVICIOS, S.L. was fined EUR 250,000 by the AEPD for a data protection breach. The incident involved unauthorized access to the internal network after VPN credentials were compromised. | ES | AEPD | GDPR | €250,000 | ↗ |
| 06 Oct 2021 | Telefónica de España, S.A.U.Telefónica de España, S.A.U. was fined by the AEPD EUR 15,000 for sending commercial emails without meeting the requirements of Article 21 of the LSSI. The authority noted that the messages were sent despite the recipient's objection. | ES | AEPD | ePrivacy | €15,000 | ↗ |
| 06 Feb 2020 | VODAFONE ESPAÑA, S.A.U.VODAFONE ESPAÑA, S.A.U. was fined 70,000 EUR by the AEPD for a personal data breach. An error in assigning identification numbers allowed one customer to access another customer's personal data. | ES | AEPD | GDPR | €70,000 | ↗ |
| 19 Apr 2021 | AD735 DATA MEDIA ADVERTISING S.L.AD735 DATA MEDIA ADVERTISING S.L. was fined EUR 15,000 by the AEPD. The authority found that the company failed to comply with a data subject's right to erasure and sent commercial communications without the recipient's explicit consent. | ES | AEPD | ePrivacy | €15,000 | ↗ |
| 20 Oct 2021 | PLUSVECINOS, S.L.PLUSVECINOS, S.L. was fined by the AEPD in the amount of 3,000 EUR for sending commercial emails without prior consent from recipients. The conduct breached Article 21 of the LSSI. | ES | AEPD | ePrivacy | €3,000 | ↗ |
| 07 Mar 2024 | CAIXABANK, S.A.CAIXABANK, S.A. was fined by the AEPD EUR 2,000,000 for pre-setting consent to share data with the Social Security Treasury without giving customers the option to refuse. The authority found this practice breached GDPR requirements for valid consent. | ES | AEPD | GDPR | €2,000,000 | ↗ |
| 01 Jan 2021 | RECLAMADOR, S.L.RECLAMADOR, S.L. was fined €2,000 by the AEPD for sending a commercial electronic communication after the recipient had exercised the right to erasure. The authority found this conduct breached GDPR and LSSI requirements. | ES | AEPD | GDPR | €2,000 | ↗ |
| 31 Aug 2023 | B.B.B.B.B.B. was fined 300 EUR by the AEPD after a complaint about a surveillance camera installed by a neighbor. The authority found that the device could have captured images of a private property and a private street, creating a potential data protection breach. | ES | AEPD | GDPR | €300 | ↗ |
| 24 Oct 2023 | FIBRA ÓPTICA MÁLAGA, S.L.FIBRA ÓPTICA MÁLAGA, S.L. changed a customer's contact email and bank account details without consent. The AEPD found a breach of GDPR Article 6(1) and imposed a 70,000 EUR fine. | ES | AEPD | GDPR | €70,000 | ↗ |
| 05 Nov 2025 | COFIDIS S.A., SUCURSAL EN ESPAÑACOFIDIS S.A., Sucursal en España was fined €5,000 by the AEPD for mixing a complainant’s personal data with unrelated information and sending a third party’s debt statement. The case concerns a breach of the data accuracy principle. | ES | AEPD | GDPR | €5,000 | ↗ |
| 01 Jan 2017 | Happy Social Media LTD.Happy Social Media LTD. was fined by the AEPD EUR 2,000 for sending advertising emails to individuals who had opted out of receiving them. The case concerned Article 21.1 of the LSSI and the obligation to respect objections to marketing communications. | ES | AEPD | ePrivacy | €2,000 | ↗ |
| 01 May 2025 | CURENERGÍA COMERCIALIZADOR DE ÚLTIMO RECURSO S.A.U.CURENERGÍA was fined EUR 10,000 by the AEPD for sharing personal data with IBERDROLA without the data subject’s consent. The disclosure led to a contract offer at a higher price than requested. | ES | AEPD | GDPR | €10,000 | ↗ |
| 28 Jan 2022 | SEAN SERIOS S.L.SEAN SERIOS S.L. was fined by the AEPD 12,000 EUR for publishing personal data of candidates from a selection process on its website without a legal basis. The authority found a breach of GDPR Article 6(1). | ES | AEPD | GDPR | €12,000 | ↗ |
| 01 Jan 2015 | MAKRO AUTOSERVICIO MAYORISTA, S.A.U.MAKRO AUTOSERVICIO MAYORISTA, S.A.U. was fined by the AEPD €5,000 for sending unsolicited commercial SMS messages. The authority found that no simple opt-out mechanism was provided, in breach of article 21.2 of the LSSI. | ES | AEPD | ePrivacy | €5,000 | ↗ |
| 29 Jun 2023 | FORKMERGE S.L.FORKMERGE S.L. was fined by the AEPD EUR 2,000 for failing to comply with a data subject’s request to remove personal data from search engine results. The authority found this to be a breach of Article 17 GDPR. | ES | AEPD | GDPR | €2,000 | ↗ |
| 03 Aug 2016 | WOLTERS KLUWER ESPAÑA, S.A.WOLTERS KLUWER ESPAÑA, S.A. was fined by the AEPD EUR 1,000 for sending unsolicited commercial emails to a complainant after confirming the cancellation of their data. The authority found this conduct breached Article 21.1 of the LSSI. | ES | AEPD | ePrivacy | €1,000 | ↗ |
| 18 Jan 2021 | INDUSTRIAS METÁLICAS ANRO, S.L.INDUSTRIAS METÁLICAS ANRO, S.L. was fined by the AEPD for failing to comply with cookie policy requirements on its website. The breach concerned Article 22.2 of the LSSI. | ES | AEPD | ePrivacy | €2,000 | ↗ |
| 05 Jun 2020 | FURNISHYOURSPACE SL.FURNISHYOURSPACE SL. was fined by the AEPD EUR 3,000 for failing to provide information or obtain consent regarding data storage and retrieval devices on its websites. The authority found a breach of Article 22.2 of the LSSI. | ES | AEPD | ePrivacy | €3,000 | ↗ |