#
Enforcement activity is vigorous and well-documented, but AEPD's own reporting flags a capacity/resourcing strain relative to caseload growth.
Sub-modules (6)
Regulator Powers And PenaltiesGreen
AEPD exercises Art 58 GDPR corrective powers (reprimand, corrective order, processing bans/limits, fines) through the LOPDGDD sanctioning procedure, governed subsidiarily by LPACAP; decisions are appealable via recurso de reposición or directly to the Audiencia Nacional.
Claims (2):
- AEPD sanctioning procedures are governed by GDPR (Regulation (EU) 2016/679), LOPDGDD, its implementing regulatory provisions and, subsidiarily, general Spanish administrative procedure rules.
- AEPD resolutions ending the administrative pathway may be challenged via a discretionary recurso de reposición before the AEPD Presidency/Director, or directly via recurso contencioso-administrativo before the Audiencia Nacional's Contentious-Administrative Chamber.
Enforcement Activity IndexAmber
2025 saw record enforcement activity: 30,931 complaints filed (+64% YoY), 77 breach-related sanctioning/reprimand procedures (+157% YoY, ≈€19.8m fines), plus headline 2026 fines against Gesternova (€220k) and CaixaBank (€500k/€400k).
Claims (4):
- In 2025, AEPD received 30,931 complaints, the highest number in the Agency's history, a 64% increase over the prior year.
- AEPD led 47 cross-border cases as lead authority in 2025 (+114% vs 2024) and cooperated as concerned authority in 419 cases (+20%); of 38 Audiencia Nacional judgments on AEPD-resolution appeals in 2025, 76% were dismissed or rejected, i.e. upheld the Agency's decisions.
- AEPD fined Gesternova, S.A. €220,000 in January 2026 for processing personal data without a valid legal basis and failing to provide mandatory transparency information at collection.
- AEPD confirmed a €500,000 fine (reduced to €400,000 on voluntary payment) against CaixaBank in March 2026 for repeated data breaches between 2022-2024 stemming from systemic design and organisational deficiencies rather than isolated human errors.
Regulator Funding And CapacityAmber
AEPD's own 2025 annual report states that growing workload across most subdirectorates has not been matched by proportional staffing growth, a constraint the Agency flags in its 2025-2030 Strategic Plan.
Claims (1):
- AEPD's 2025 annual report states that the growing workload reflected across most of its subdirectorates and divisions has not been matched by a proportional increase in staffing, prompting a technology-supported, impact-prioritised supervision strategy under its 2025-2030 Strategic Plan.
Collective Redress And Class ActionsAmber
No ES-specific GDPR-related collective-redress/class-action mechanism beyond general Spanish civil procedure and EU Representative Actions Directive transposition was evidenced in this research pass.
Absence provenance: unavailable. Searched: AEPD accion colectiva proteccion datos demanda.
Private Right Of ActionAmber
Data subjects and controllers alike may challenge AEPD resolutions via recurso de reposición or directly via recurso contencioso-administrativo before the Audiencia Nacional's Contentious-Administrative Chamber.
Claims (1):
- Any interested party may lodge a recurso contencioso-administrativo against a final AEPD resolution before the Audiencia Nacional's Contentious-Administrative Chamber within two months of notification.
Recent Developments 180DAmber
Within the last 180 days: AEPD published its 2025 annual report (May 2026) showing record complaint volumes and sanctioning activity; AEPD confirmed the €500k/€400k CaixaBank fine (March 2026); Spain's Council of Ministers approved a draft Organic Law on AI governance (May 2026); AESIA continued publishing AI guidelines through mid-2026.
Claims (3):
- AEPD presented its Memoria de actuación 2025 on 6 May 2026, disclosing record complaint volumes, a 157% rise in breach-related sanctioning/reprimand procedures, and approximately €19.8 million in resulting fines.
- AEPD confirmed a €500,000 fine (reduced to €400,000 on voluntary payment) against CaixaBank in March 2026 for repeated data breaches between 2022-2024 stemming from systemic design and organisational deficiencies rather than isolated human errors.
- On 26 May 2026, Spain's Council of Ministers approved a draft Organic Law on the proper use and governance of AI, designating notifying and market-surveillance authorities with AESIA as single point of contact, and sent it to Congress for parliamentary processing.
Enforcement & Redress
The AEPD's enforcement activity remained materially active in the period under review. Its record EUR 18 million fine against Amadeus IT Group, S.A., reported in May 2026, concerned a traveller-profiling pilot project the regulator found was conducted without adequate legal basis or sufficient information to data subjects, addressing breaches of Articles 6 and 14 of the GDPR. The AEPD is also reported to have fined Vodafone EUR 750,000, reported 25 September 2026, in connection with a data breach and inadequate security measures, and to have fined 23andMe EUR 2.4 million, reported 10 August 2026, for security and breach-notification failures affecting 2,642 individuals. Separately, the AEPD fined a security-alarm and video-surveillance company EUR 100,000 for obstructing the exercise of data-subject rights via a chargeable phone line, a decision reported 22 September 2026. Across this enforcement activity, the AEPD is understood to consistently apply the proportionality principle under Article 83(1) of the GDPR, giving considerable weight to the fact that most respondents before it are small and medium-sized enterprises; no change to the underlying maximum-fine tiers was found this cycle.
Outlook
The Amadeus decision, as the largest fine identified in this period, is likely to remain a reference point in AEPD enforcement reasoning on profiling conducted without adequate legal basis. Continued proportionality-weighted treatment of SME respondents suggests the AEPD's fine levels for smaller entities will likely remain calibrated below headline GDPR maximums, even as enforcement volume continues at a sustained pace.
2 earlier distinct update(s)
Enforcement & Redress
The Audiencia Nacional, Spain's national court competent to review AEPD sanction decisions, held in a judgment reported as issued on 24 September 2026 that the AEPD may not liquidate suspensive interest that accrues during the period a sanction decision remains suspended pending appeal. This is a narrowing of one specific collection mechanism available to the regulator once a fine is contested, not a change to the AEPD's underlying power to impose sanctions or to the level of fines it may impose. The finding is sourced via law-firm commentary (Picón y Asociados) describing the ruling; the primary judgment text, including its docket reference, was not independently retrieved this cycle, so the precise legal reasoning and scope of application remain to be confirmed against the original source.
Alongside this development, the AEPD's statutory fine-tier maxima remain unchanged: sanctions for the lower infraction tier under the GDPR's own penalty framework, as applied domestically, continue to carry a ceiling of up to EUR 10 million or 2% of total annual global turnover, and the higher tier continues to carry a ceiling of up to EUR 20 million or 4%. No development this cycle alters either ceiling or the AEPD's general sanctioning authority; the change is confined to a procedural detail of how accessory interest on a suspended sanction may be collected.
The practical significance for entities with a sanction currently under appeal is that the regulator's ability to add suspensive interest to the eventual collected amount appears to be constrained by this ruling, though the exact mechanics, including whether the ruling applies to sanctions already under appeal or only to future cases, were not established in the material reviewed this cycle.
Outlook
Confirmation of the underlying Audiencia Nacional judgment text, including its docket reference, is the clearest item likely to sharpen this finding in a future cycle. Until that confirmation is obtained, the practical scope of the suspensive-interest limitation for entities with pending AEPD appeals should be treated as provisional.
Enforcement & Redress
The AEPD's sanctioning powers remain grounded in GDPR article 83, permitting administrative fines of up to EUR20 million or 4% of global annual turnover, whichever is higher, and LOPDGDD article 77 mandates publication of final sanctioning resolutions once they become firm. This cycle's biometric enforcement wave -- the Yoti, Aena and FC Barcelona fines -- illustrates the AEPD exercising this authority at a range of scales, from EUR500,000 up to over EUR10 million, depending on the severity and sectoral context of the underlying violation.
Of particular note for the redress dimension is the active contestation of the Yoti sanction. The AEPD rejected Yoti's request for reconsideration on 2 March 2026, and Yoti has since escalated its challenge to a full appeal before the Spanish High Court, the Audiencia Nacional, disputing both the substantive findings and the adequacy of the AEPD's notification procedure. This is a live, unresolved legal proceeding rather than a settled enforcement outcome, and it represents the clearest current test of how far Spanish courts will support the AEPD's interpretive approach to biometric special-category data and consent validity under the current enforcement wave.
Outlook
The Audiencia Nacional's eventual ruling on Yoti's appeal is the single most consequential redress-related development to track, since it will either validate or narrow the AEPD's current enforcement approach to biometric data, with direct implications for how durable the accompanying Aena and FC Barcelona DPIA-adequacy findings prove to be if similarly challenged.
1 further periodic run re-emitted the standing brief unchanged and is not shown.
Sources and claims (7)
- ConfirmedAgencia Española de Protección de Datos — AEPD sanctioning procedures are governed by GDPR (Regulation (EU) 2016/679), LOPDGDD, its implementing regulatory provisions and, subsidiarily, general Spanish administrative procedure rules.observed
- ConfirmedAgencia Española de Protección de Datos — AEPD resolutions ending the administrative pathway may be challenged via a discretionary recurso de reposición before the AEPD Presidency/Director, or directly via recurso contencioso-administrativo before the Audiencia Nacional's Contentious-Administrative Chamber.observed
- ConfirmedAgencia Española de Protección de Datos — In 2025, AEPD received 30,931 complaints, the highest number in the Agency's history, a 64% increase over the prior year.observed
- ConfirmedAgencia Española de Protección de Datos — AEPD led 47 cross-border cases as lead authority in 2025 (+114% vs 2024) and cooperated as concerned authority in 419 cases (+20%); of 38 Audiencia Nacional judgments on AEPD-resolution appeals in 2025, 76% were dismissed or rejected, i.e. upheld the Agency's decisions.observed
- ConfirmedAgencia Española de Protección de Datos — AEPD's 2025 annual report states that the growing workload reflected across most of its subdirectorates and divisions has not been matched by a proportional increase in staffing, prompting a technology-supported, impact-prioritised supervision strategy under its 2025-2030 Strategic Plan.observed
- ConfirmedAgencia Española de Protección de Datos — Any interested party may lodge a recurso contencioso-administrativo against a final AEPD resolution before the Audiencia Nacional's Contentious-Administrative Chamber within two months of notification.observed
- ConfirmedAgencia Española de Protección de Datos — AEPD presented its Memoria de actuación 2025 on 6 May 2026, disclosing record complaint volumes, a 157% rise in breach-related sanctioning/reprimand procedures, and approximately €19.8 million in resulting fines.observed