Agencia Española de Protección de Datos
Data protection authority of Spain
Total Actions
1,275
Total Fines
€224.0M
Average Fine
€185K
Among actions with fines
Enforcement Factor
1.80
Moderately active
About Agencia Española de Protección de Datos
The Agencia Española de Protección de Datos is Spain's data protection authority and an active enforcer of GDPR and ePrivacy requirements. Agencia Española de Protección de Datos has taken 1275 enforcement actions resulting in €224,019,792 in total penalties, with an average fine of €185K per sanctioned entity. The authority maintains a balanced enforcement approach (enforcement factor: 1.8), combining deterrent fines with corrective orders. Its most significant action was a €18,000,000 fine against Amadeus IT Group, S.A. in 2026. Key enforcement areas include cookies placed before consent, unclear cookie information, no reject button. The most frequently cited legal basis in Agencia Española de Protección de Datos's decisions is Art. 13(GDPR) and Art. 6(1) GDPR.
Largest Fines by Agencia Española de Protección de Datos
View all actionsRecent Actions by Agencia Española de Protección de Datos
View all actionsEnforcement by Year
| Year | Actions | Total Fines |
|---|---|---|
| 2019 | 45 | €1.3M |
| 2020 | 168 | €8.8M |
| 2021 | 224 | €27.8M |
| 2022 | 223 | €21.1M |
| 2023 | 255 | €32.8M |
| 2024 | 155 | €43.9M |
| 2025 | 174 | €67.4M |
| 2026 | 31 | €21.0M |
Most Enforced Violations
Most Cited GDPR Articles
Frequently Asked Questions
How many GDPR and ePrivacy actions has Agencia Española de Protección de Datos issued?
Agencia Española de Protección de Datos has issued 1275 enforcement actions related to GDPR and ePrivacy, totaling €224.0M.
What is Agencia Española de Protección de Datos's largest GDPR and ePrivacy fine?
The largest was a €18.0M fine against Amadeus IT Group, S.A. on 2026-04-07.
What violations does Agencia Española de Protección de Datos enforce most?
The most commonly enforced violations by Agencia Española de Protección de Datos are cookies placed before consent, unclear cookie information, no reject button.