BULLETIN №081Last updated · 28 Jul 2026
Fine Tracker.
A public register of regulatory fines issued under EU compliance directives. Updated as decisions are published by national supervisory authorities.
5,273 entries
- Total fines
- €8.6bn
- Decisions
- 5,273
- Jurisdictions
- 33
- Regulators
- 74
- Avg monthly
- €162.7m
- YoY volume
- -20.7%
| Imposed | Company | Country | Authority | Type | Amount | ↗ |
|---|---|---|---|---|---|---|
| 09 Mar 2021 | NBQ TECHNOLOGY, S.A.U.NBQ TECHNOLOGY, S.A.U. was fined by the AEPD €20,000 for processing personal data without a legal basis. The case was related to identity theft in a microcredit contract. | ES | AEPD | GDPR | €20,000 | ↗ |
| 24 Jun 2021 | B.B.B.The entity was fined by the AEPD EUR 1,000 for installing a surveillance camera in a hair salon without informing individuals about the video surveillance area. The authority found this to be a breach of Article 13 of the GDPR. | ES | AEPD | GDPR | €1,000 | ↗ |
| 30 Sept 2016 | UNITECO PROFESIONAL, CORREDURIA DE SEGUROS, S.L.UNITECO PROFESIONAL was fined EUR 1,000 by the AEPD for sending unsolicited commercial emails without providing recipients with an opt-out option. The authority found this to be a breach of Article 21 of the LSSI. | ES | AEPD | ePrivacy | €1,000 | ↗ |
| 01 Jul 2020 | COMUNIDAD DE PROPIETARIOS R.R.R.COMUNIDAD DE PROPIETARIOS R.R.R. was fined by the AEPD for publishing a resident’s personal data on a community notice board. The conduct breached data protection rules. | ES | AEPD | GDPR | €10,000 | ↗ |
| 01 May 2025 | ALBOR ENERGÍA S.L.ALBOR ENERGÍA S.L. was fined by the AEPD in the amount of 20,000 EUR for a data protection breach. The case concerned unauthorized subcontracting without informing the responsible party, as required by Article 28 of the GDPR. | ES | AEPD | GDPR | €20,000 | ↗ |
| 07 Feb 2022 | DESPACHO IBERFORO MADRID SLPDESPACHO IBERFORO MADRID SLP was fined EUR 1,000 by the AEPD for failing to comply with a decision concerning the right to erasure. The authority found a breach of Article 58(2) GDPR. | ES | AEPD | GDPR | €1,000 | ↗ |
| 29 Apr 2016 | CRUZ ROJA ESPAÑOLACRUZ ROJA ESPAÑOLA was fined by the AEPD EUR 1,100 for sending unsolicited commercial emails to a recipient who had previously requested data cancellation. The authority found a breach of Article 21.1 of the LSSI. | ES | AEPD | ePrivacy | €1,100 | ↗ |
| 01 Jan 2022 | ORANGE ESPAGNE, S.A.U.ORANGE ESPAGNE, S.A.U. was fined by the AEPD 70,000 EUR for processing personal data without consent. The conduct led to unauthorized contracts and credit reporting issues. | ES | AEPD | GDPR | €70,000 | ↗ |
| 05 Feb 2020 | XFERA MÓVILES, S.A.XFERA MÓVILES, S.A. was fined EUR 75,000 by the AEPD for processing personal data without a legal basis. The authority found a breach of Article 6(1) GDPR. | ES | AEPD | GDPR | €75,000 | ↗ |
| 02 Oct 2013 | ASOCIACION ESPAÑOLA DE ABOGADOS URBANISTASThe entity was fined by the AEPD €1,800 for sending unsolicited commercial emails without prior consent. This conduct breached Article 21.1 of the LSSI, which requires prior consent for such communications. | ES | AEPD | ePrivacy | €1,800 | ↗ |
| 29 May 2023 | B.B.B.The entity was fined by the AEPD for failing to remove a viral video from Twitter that breached data protection rules. The case indicates a lack of timely action in response to content processing personal data without a lawful basis. | ES | AEPD | GDPR | €2,000 | ↗ |
| 22 Jul 2019 | VODAFONE ESPAÑA, S.A.U.VODAFONE ESPAÑA, S.A.U. was fined by the AEPD 50,000 EUR for sending an SMS to a third party with a link to a customer's purchase summary. This disclosed personal data without proper authorization. | ES | AEPD | GDPR | €50,000 | ↗ |
| 22 Feb 2023 | ENERGÍA COLECTIVA, S.L.ENERGÍA COLECTIVA, S.L. was fined by the AEPD 70,000 EUR for changing an individual's electricity provider without consent. The authority found a breach of Article 6 GDPR, which requires a lawful basis for processing personal data. | ES | AEPD | GDPR | €70,000 | ↗ |
| 23 Jun 2022 | B.B.B.The entity was fined EUR 300 by the AEPD for positioning surveillance cameras so that they captured public spaces without justification. The authority found this to be a breach of data protection rules. | ES | AEPD | GDPR | €300 | ↗ |
| 08 Jun 2020 | B.B.B.B.B.B. was fined by the AEPD 1,500 EUR for maintaining a video surveillance camera directed toward common areas without justified cause. The conduct caused anxiety to the complainant and was treated as a data protection breach. | ES | AEPD | GDPR | €1,500 | ↗ |
| 23 Apr 2021 | Vodafone España, S.A.U.Vodafone España, S.A.U. was fined by the AEPD EUR 70,000 for allowing unauthorized access to a customer's personal data. The data was then used to fraudulently contract mobile lines without the customer's consent. | ES | AEPD | GDPR | €70,000 | ↗ |
| 01 Jan 2024 | HIGHCLIFFE ESTATES MARBELLA, S.L.HIGHCLIFFE ESTATES MARBELLA, S.L. was fined by the AEPD 8,500 EUR for publishing personal data, including names and images, on its website without the data subjects’ consent. The authority found this to be a breach of Article 6(1) GDPR. | ES | AEPD | GDPR | €8,500 | ↗ |
| 23 Aug 2023 | GAFAS EN RED DE ÓPTICAS, S.L.GAFAS EN RED DE ÓPTICAS, S.L. was fined by the AEPD 5,000 EUR for sending commercial emails to a complainant after they had opted out. The authority treated this as a breach of data protection rules. | ES | AEPD | ePrivacy | €5,000 | ↗ |
| 25 Oct 2017 | TICKETMASTER SPAIN S.A.Ticketmaster Spain S.A. was fined 17,000 EUR by the AEPD for failing to provide adequate information and obtain valid consent for the use of cookies on its website. The authority found that this conduct breached data protection and privacy rules. | ES | AEPD | ePrivacy | €17,000 | ↗ |
| 16 Jun 2020 | SAUNIER-TEC, MANTENIMIENTOS DE CALOR Y FRIO, S.LSAUNIER-TEC was fined EUR 6,000 by the AEPD for a data breach. The incident involved unauthorized access to personal data and bank account information, breaching GDPR Articles 33 and 34. | ES | AEPD | GDPR | €6,000 | ↗ |