BULLETIN №082Last updated · 29 Jul 2026
Fine Tracker.
A public register of regulatory fines issued under EU compliance directives. Updated as decisions are published by national supervisory authorities.
5,273 entries
- Total fines
- €8.6bn
- Decisions
- 5,273
- Jurisdictions
- 33
- Regulators
- 74
- Avg monthly
- €162.7m
- YoY volume
- -21%
| Imposed | Company | Country | Authority | Type | Amount | ↗ |
|---|---|---|---|---|---|---|
| 22 Jan 2024 | CAJA RURAL DE SORIA, S.C.C.CAJA RURAL DE SORIA, S.C.C. was fined by the AEPD 15,000 EUR for breaching personal data protection principles. The case involved a failure to protect confidentiality and integrity, resulting in unauthorized access following a data breach. | ES | AEPD | GDPR | €15,000 | ↗ |
| 21 Jul 2023 | B.B.B.B.B.B. was fined by the AEPD 300 EUR for installing surveillance cameras without the required authorization. The cameras captured public areas and a neighbor's property, which breached data protection rules. | ES | AEPD | GDPR | €300 | ↗ |
| 21 Aug 2014 | GROUPON SPAIN, S.L.U.Groupon Spain, S.L.U. was fined by the AEPD EUR 30,000 for sending unsolicited commercial emails to the complainant. The authority found that the conduct breached the Spanish LSSI requirements governing marketing communications. | ES | AEPD | ePrivacy | €30,000 | ↗ |
| 07 Jun 2024 | AXA REAL ESTATE INVESTMENT MANAGERS IBERICA S.A.AXA Real Estate Investment Managers Iberica S.A. was fined by the AEPD for failing to implement adequate security measures. The deficiency resulted in a data breach involving personal data stored on an encrypted USB drive. | ES | AEPD | GDPR | €100,000 | ↗ |
| 21 May 2024 | B.B.B.B.B.B. was fined 2,000 EUR by the AEPD for unlawfully processing personal data. The case concerned the inclusion of data in the ASNEF credit information system without meeting the legal requirements under GDPR. | ES | AEPD | GDPR | €2,000 | ↗ |
| 20 Dec 2010 | DAI SOFTWARE CENTRE S.L.DAI SOFTWARE CENTRE S.L. was fined by the AEPD in the amount of €600 for sending unsolicited commercial emails. The case concerned a breach of Article 21.1 of the LSSI, which prohibits marketing communications without prior consent. | ES | AEPD | ePrivacy | €600 | ↗ |
| 29 Jul 2024 | IBERINFORMIBERINFORM was fined by the AEPD €1,000,000 for processing personal data of self-employed individuals without a proper legal basis. The authority also found that the data were used beyond professional relationships, including for marketing and online exposure. | ES | AEPD | GDPR | €1,000,000 | ↗ |
| 26 Sept 2022 | HERON CITY VALENCIA MANAGEMENT S.L.HERON CITY VALENCIA MANAGEMENT S.L. was fined by the AEPD in the amount of 10,000 EUR for refusing to provide access to surveillance footage. This conduct breached the data subject’s rights, in particular the right of access under Article 15 of the GDPR. | ES | AEPD | GDPR | €10,000 | ↗ |
| 01 Jan 2015 | LA QUINIELA INTELIGENTE S.L.LA QUINIELA INTELIGENTE S.L. was fined by the AEPD 2,600 EUR for sending unsolicited commercial emails. The authority found that recipients were not given a means to object to further communications, breaching Article 21 of the LSSI. | ES | AEPD | ePrivacy | €2,600 | ↗ |
| 05 Dec 2019 | VODAFONE ESPAÑA, S.A.U.VODAFONE ESPAÑA, S.A.U. was fined by the AEPD EUR 30,000 for inaccurately processing personal data. The company claimed a debt for a service that had already been terminated and had no outstanding balance. | ES | AEPD | GDPR | €30,000 | ↗ |
| 15 Jul 2022 | FEDERACIÓN DE ATENCIÓN A LA CIUDADANÍA DE LA UNIÓN SINDICAL OBRERA (FAC-USO)The organization continued sending emails to an individual after they requested deletion of their personal data. The AEPD found a breach of Article 6 of the GDPR and imposed a EUR 3,000 fine. | ES | AEPD | GDPR | €3,000 | ↗ |
| 11 Jun 2013 | MUNDO TOUR ESPAÑA, S.L.MUNDO TOUR ESPAÑA, S.L. was fined by the AEPD EUR 1,200 for sending commercial emails without the recipients’ consent. The conduct breached Article 21.2 of the LSSI on unsolicited commercial communications. | ES | AEPD | ePrivacy | €1,200 | ↗ |
| 01 Jan 2024 | INCIBEINCIBE was fined EUR 2,000 by the AEPD for failing to implement data protection by design and by default, in breach of Article 25 GDPR. The procedure concerning the alleged breach of Article 5(1)(f) was dismissed because no serious threat to rights and freedoms was found. | ES | AEPD | GDPR | €2,000 | ↗ |
| 04 Dec 2019 | VODAFONE ESPAÑA, S.A.U.VODAFONE ESPAÑA, S.A.U. was fined 5,000 EUR by the AEPD for failing to provide requested information. The case concerns a breach of obligations under data protection rules. | ES | AEPD | GDPR | €5,000 | ↗ |
| 01 Sept 2021 | COMUNIDAD DE PROPIETARIOS C/ ***DIRECCIÓN.1The community of property owners was fined by the AEPD 2,000 EUR for publishing personal data on a public notice board. This conduct breached data protection rules. | ES | AEPD | GDPR | €2,000 | ↗ |
| 10 Apr 2013 | VIRTUALIZZA S.L.VIRTUALIZZA S.L. was fined EUR 600 by the AEPD for sending unsolicited commercial emails without proper consent. The authority also found that the company failed to provide an effective opt-out mechanism, in breach of Article 21 of the LSSI. | ES | AEPD | ePrivacy | €600 | ↗ |
| 04 May 2022 | DIGI SPAIN TELECOM, S.L.DIGI SPAIN TELECOM, S.L. was fined by the AEPD 70,000 EUR for issuing a SIM card duplicate without verifying the requester’s identity. The failure enabled unauthorized access to a bank account and caused financial loss to the complainant. | ES | AEPD | GDPR | €70,000 | ↗ |
| 12 Jan 2020 | VODAFONE ESPAÑA, S.A.U.The AEPD fined VODAFONE ESPAÑA, S.A.U. 100,000 EUR for charging a customer for a service that had not been contracted. The case concerned non-compliance with consent requirements linked to data processing and service billing. | ES | AEPD | GDPR | €100,000 | ↗ |
| 01 Jan 2022 | VODAFONE ONO, S.A.U.VODAFONE ONO, S.A.U. was fined by the AEPD 70,000 EUR for unlawfully accessing a creditworthiness file. The company used an individual's tax ID without legitimate grounds, breaching data protection rules. | ES | AEPD | GDPR | €70,000 | ↗ |
| 01 Jan 2021 | ASOCIACIÓN ESPAÑOLA PARA LA ENSEÑANZA ONLINEThe entity was fined by the AEPD for sending advertising emails without the recipients’ consent. It also failed to comply with a request to delete personal data from its databases. | ES | AEPD | ePrivacy | €5,000 | ↗ |