BULLETIN №081Last updated · 26 Jul 2026
Fine Tracker.
A public register of regulatory fines issued under EU compliance directives. Updated as decisions are published by national supervisory authorities.
5,273 entries
- Total fines
- €8.6bn
- Decisions
- 5,273
- Jurisdictions
- 33
- Regulators
- 74
- Avg monthly
- €162.7m
- YoY volume
- -20.7%
| Imposed | Company | Country | Authority | Type | Amount | ↗ |
|---|---|---|---|---|---|---|
| 23 Jan 2024 | CAJA RURAL GRANADA, S.C.C.CAJA RURAL GRANADA was fined by the AEPD EUR 15,000 for breaching data protection principles. The authority found that unauthorized access to personal data occurred due to a security incident, affecting confidentiality and integrity. | ES | AEPD | GDPR | €15,000 | ↗ |
| 30 May 2022 | DIGITECNIA SOLUTIONS, S.L.DIGITECNIA SOLUTIONS, S.L. was fined by the AEPD 2,000 EUR for publishing an image on its website without authorization. The authority found this to be a breach of Article 6 of the GDPR. | ES | AEPD | GDPR | €2,000 | ↗ |
| 01 Jan 2023 | PHONE HOUSEPHONE HOUSE was fined by the AEPD for failing to ensure data integrity and confidentiality. The breach resulted in a data incident caused by a cyberattack. | ES | AEPD | GDPR | €6,500,000 | ↗ |
| 27 Apr 2022 | 20 MINUTOS EDITORA, S.L.20 MINUTOS EDITORA, S.L. was fined by the AEPD 50,000 EUR for publishing audio of a victim’s court statement in a high-profile case. The authority found a breach of data protection rules. | ES | AEPD | GDPR | €50,000 | ↗ |
| 13 Nov 2021 | IMPERIUM C.B.IMPERIUM C.B. was fined by the AEPD in the amount of 1,500 EUR for failing to provide informational signage about its video surveillance system. The authority found a breach of Article 13 GDPR because individuals on the premises were not given the required notice. | ES | AEPD | GDPR | €1,500 | ↗ |
| 01 Jan 2012 | THE LEADER NEWSPAPER, S.L.THE LEADER NEWSPAPER, S.L. was fined by the AEPD EUR 2,000 for sending commercial emails without prior recipient consent. The authority found this conduct breached Article 21 of the LSSI. | ES | AEPD | ePrivacy | €2,000 | ↗ |
| 23 Aug 2021 | VODAFONE ESPAÑA, S.A.U.Vodafone España was fined by the AEPD for breaching data protection principles. The case involved issuing SIM card duplicates to unauthorized individuals, which compromised data integrity and confidentiality. | ES | AEPD | GDPR | €4,000,000 | ↗ |
| 22 Mar 2024 | NH HOTEL GROUP S.A.NH HOTEL GROUP S.A. was fined by the AEPD EUR 10,000 for using cookies on its website without obtaining user consent. The authority found this to be a breach of the LSSI rules on cookie consent. | ES | AEPD | ePrivacy | €10,000 | ↗ |
| 16 Mar 2017 | ABELHAS.PT LIMITEDABELHAS.PT LIMITED was fined EUR 5,000 by the AEPD for failing to provide the required information and procedures to reject data processing on its website. The authority found a breach of Article 22.2 of the LSSI. | ES | AEPD | ePrivacy | €5,000 | ↗ |
| 23 Apr 2021 | Vodafone España, S.A.U.The AEPD fined Vodafone España, S.A.U. EUR 70,000 for failing to adequately prevent identity theft. As a result, unauthorized phone line contracts were entered into using a customer's personal data. | ES | AEPD | GDPR | €70,000 | ↗ |
| 11 May 2012 | PLEGADOS IRUÑA S.L.PLEGADOS IRUÑA S.L. was fined by the AEPD 600 EUR for sending unsolicited commercial emails. The conduct breached Article 21.1 of the LSSI, which restricts marketing communications without prior consent. | ES | AEPD | ePrivacy | €600 | ↗ |
| 17 Jan 2023 | ENDESA ENERGÍA, S.A.U.ENDESA ENERGÍA, S.A.U. was fined by the AEPD 70,000 EUR for processing personal data without valid consent. The case concerned a contract entered into in the name of a deceased person without authorization. | ES | AEPD | GDPR | €70,000 | ↗ |
| 01 Mar 2017 | A.A.A.A.A.A. was fined €3,000 by the AEPD. The authority found that cookies were installed on its websites without prior information and consent, in breach of Article 22.2 of the LSSI. | ES | AEPD | ePrivacy | €3,000 | ↗ |
| 07 Mar 2022 | DIGI SPAIN TELECOM, S.L.DIGI SPAIN TELECOM, S.L. was fined by the AEPD for improperly handling a SIM card duplication request. The failure led to unauthorized transactions on a customer's bank account and was found to breach Article 6(1) GDPR. | ES | AEPD | GDPR | €70,000 | ↗ |
| 30 May 2022 | ASOCIACIÓN CONTRA LA CORRUPCION Y EN DEFENSA DE LA ACCIÓN PÚBLICAACODAP was fined EUR 10,000 by the AEPD for publishing complainants’ personal data on its website without anonymization. The authority found this conduct to be contrary to GDPR Article 5(1)(b). | ES | AEPD | GDPR | €10,000 | ↗ |
| 15 Mar 2022 | PRODESSPA DECORATIUS I PINTURES, S.L.PRODESSPA DECORATIUS I PINTURES, S.L. was fined by the AEPD 15,000 EUR for unlawfully processing personal data. The company included a former employee’s data in a credit information system without proper legal justification. | ES | AEPD | GDPR | €15,000 | ↗ |
| 14 Apr 2023 | ESTUDIO VILLALBA ANTIQUE, S.L.ESTUDIO VILLALBA ANTIQUE, S.L. was fined by the AEPD for processing personal data without consent. The authority found a breach of the lawfulness principle under Article 6(1) GDPR. | ES | AEPD | GDPR | €5,000 | ↗ |
| 04 Oct 2021 | AD735 DATA MEDIA ADVERTISING S.L.The entity was fined by the AEPD for breaching data protection rules. It continued sending commercial emails despite repeated requests from the complainant to delete their data. | ES | AEPD | ePrivacy | €6,000 | ↗ |
| 31 Jan 2024 | MARINA SALUD, S.A.MARINA SALUD, S.A. was fined by the AEPD 500,000 EUR for failing to comply with data processing agreement obligations under Article 28 GDPR. The case involved the handling of sensitive health data, which increased the compliance risk. | ES | AEPD | GDPR | €500,000 | ↗ |
| 01 Jan 2019 | ZHANG BORDETA 2006, S.L.ZHANG BORDETA 2006, S.L. was fined EUR 6,000 by the AEPD for disproportionate video surveillance of public areas. The authority also found that no informational notice was provided inside the establishment, breaching data protection rules. | ES | AEPD | GDPR | €6,000 | ↗ |