BULLETIN №081Last updated · 26 Jul 2026
Fine Tracker.
A public register of regulatory fines issued under EU compliance directives. Updated as decisions are published by national supervisory authorities.
5,273 entries
- Total fines
- €8.6bn
- Decisions
- 5,273
- Jurisdictions
- 33
- Regulators
- 74
- Avg monthly
- €162.7m
- YoY volume
- -20.7%
| Imposed | Company | Country | Authority | Type | Amount | ↗ |
|---|---|---|---|---|---|---|
| 29 Jan 2024 | IDFINANCE SPAIN, S.A.U.The AEPD fined IDFINANCE SPAIN, S.A.U. 70,000 EUR for including personal data in credit information systems in connection with a disputed debt. The authority found that the processing breached Article 6 GDPR. | ES | AEPD | GDPR | €70,000 | ↗ |
| 01 Jan 2014 | COMERCIAL POLINDUS 21 S.L.COMERCIAL POLINDUS 21 S.L. was fined by the AEPD EUR 3,000 for sending unsolicited spam messages without providing an opt-out mechanism. The conduct breached Article 21 of the LSSI and failed to meet basic requirements for marketing communications. | ES | AEPD | ePrivacy | €3,000 | ↗ |
| 13 Oct 2022 | B.B.B.A tenant complained that the landlord installed a surveillance camera in the kitchen of the rented property without consent. The AEPD found a breach of data protection rules and imposed a EUR 4,000 fine. | ES | AEPD | GDPR | €4,000 | ↗ |
| 25 Jun 2024 | LOS NIÑOS DE MONTESSORI, S.L.The entity was fined for failing to provide information or obtain consent for the use of cookies on its website. This conduct breached the LSSI. | ES | AEPD | ePrivacy | €5,000 | ↗ |
| 01 Jan 2013 | IBERIA LÍNEAS AÉREAS DE ESPAÑA, SOCIEDAD ANÓNIMA OPERADORA, Sociedad UnipersonalIberia was fined by the AEPD EUR 1,200 for sending commercial emails without providing recipients with a simple and free way to opt out of further messages. The authority found a breach of Article 21.2 of the LSSI. | ES | AEPD | ePrivacy | €1,200 | ↗ |
| 01 Mar 2013 | QUARELY INDUSTRIAL S.L.QUARELY INDUSTRIAL S.L. was fined by the AEPD in the amount of EUR 600 for sending unsolicited commercial emails. The conduct breached Article 21 of the LSSI, which governs marketing communications without prior recipient consent. | ES | AEPD | ePrivacy | €600 | ↗ |
| 23 Apr 2021 | Vodafone España, S.A.U.Vodafone España, S.A.U. was fined by the AEPD 70,000 EUR for processing personal data without proper consent. The case involved a call to a customer about a service package that the customer had not authorized. | ES | AEPD | GDPR | €70,000 | ↗ |
| 02 Dec 2019 | GARANTIZA AUTOMOCIÓN, S.L.The company was fined by the AEPD in the amount of EUR 3,000 for failing to provide information or obtain consent for the use of cookies on its website. The breach concerned LSSI requirements on transparency and user consent. | ES | AEPD | ePrivacy | €3,000 | ↗ |
| 01 Jan 2022 | B.B.B.B.B.B. was fined 1,000 EUR by the AEPD. The authority found that the company shared individuals’ personal data in a WhatsApp group without consent, in breach of data protection rules. | ES | AEPD | GDPR | €1,000 | ↗ |
| 26 May 2022 | COMUNIDAD.1The owners’ community installed a video surveillance system in common areas without informed consent from all property owners. The AEPD found this to be a breach of data protection rules. | ES | AEPD | GDPR | €1,000 | ↗ |
| 05 Jun 2023 | HIPER STORE, S.L.HIPER STORE, S.L. was fined EUR 500 by the AEPD for not properly signposting its video surveillance system. The authority also found that the company failed to provide customers with the required data protection information under Article 13 GDPR. | ES | AEPD | GDPR | €500 | ↗ |
| 22 Oct 2025 | SPRINTER MEGACENTROS DEL DEPORTE, S.L.SPRINTER MEGACENTROS DEL DEPORTE, S.L. experienced a data breach affecting approximately 6.2 million individuals, involving unauthorized access and encryption of critical systems. The incident was intentional and involved data from multiple EU member states. | ES | AEPD | GDPR | €2,600,000 | ↗ |
| 01 Jan 2023 | THE RED KIWI, S.L.THE RED KIWI, S.L. was fined 30,000 EUR by the AEPD. The breach involved adding clients’ phone numbers to a WhatsApp group without consent, which enabled unauthorized access to personal data. | ES | AEPD | GDPR | €30,000 | ↗ |
| 04 May 2021 | CLUB GIMNASIA RÍTMICA SAN ANTONIOThe club was fined by the AEPD for publishing images of minors on social media without proper consent. The authority found a breach of GDPR Article 6 on lawful processing. | ES | AEPD | GDPR | €5,000 | ↗ |
| 01 Jan 2016 | EASYVOYAGE SASEASYVOYAGE SAS was fined by the AEPD in the amount of 20,000 EUR for sending unsolicited commercial emails. The conduct continued despite requests for data cancellation, which breached Article 21.1 of the LSSI. | ES | AEPD | ePrivacy | €20,000 | ↗ |
| 09 Mar 2023 | B.B.B.A camera was installed in a community garage without prior authorization and without proper signage. The AEPD found this to be a breach of Article 13 GDPR and imposed a EUR 300 fine. | ES | AEPD | GDPR | €300 | ↗ |
| 01 Jan 2022 | ALPA 57 PRODUCCIONES, S.L.ALPA 57 PRODUCCIONES, S.L. was fined by the AEPD 10,000 EUR for processing personal data without a legal basis. The company impersonated another energy provider and used personal data without consent. | ES | AEPD | GDPR | €10,000 | ↗ |
| 06 Mar 2025 | SERVICIOS DE INTEGRACIÓN DE ANDALUCÍASERVICIOS DE INTEGRACIÓN DE ANDALUCÍA was fined €2,000 by the AEPD for adding an employee’s personal phone number to a work WhatsApp group without consent. The authority found a breach of the GDPR lawful-basis requirement under Article 6(1). | ES | AEPD | GDPR | €2,000 | ↗ |
| 29 Aug 2025 | EXTRA MADRID, S.L.EXTRA MADRID, S.L. sent personalized postal advertising without the recipient’s consent. The AEPD found this to be a breach of Article 6 GDPR and imposed a fine of 1,000 EUR. | ES | AEPD | GDPR | €1,000 | ↗ |
| 08 Aug 2022 | EUROPYMES SERVICIOS INTEGRALES S.L.EUROPYMES SERVICIOS INTEGRALES S.L. failed to comply with a data deletion request, which constitutes a breach of Article 17 GDPR. The AEPD imposed a fine of EUR 1,000, later reduced due to early payment. | ES | AEPD | GDPR | €1,000 | ↗ |