SpainAEPD Enforcement, GDPR Article 82 and LOPDGDD Título IX
Regulation (EU) 2016/679, Arts. 82-83; LOPDGDD, Art. 47, Arts. 70-78
In force since , effective .
An enforcement supervision rule binding public and private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Compensate any person in Spain who suffered material or non-material damage from your infringement, as controller or processor, under General Data Protection Regulation (GDPR) Article 82.
These lines are LexLint's reading of the law's text. Also read by: Case C-300/21 UI v Österreichische Post AG, judgment of (Third Chamber) (recorded ).
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Codigo Penal (Ley Organica 10/1995) Article 197, outside the LOPDGDD entirely, criminalises unauthorised interference with recorded personal data. Article 197(2) punishes, with the same penalty as paragraph 1 (imprisonment of one to four years and a fine of twelve to twenty-four months), a person who, without authorisation and to the detriment of a third party, seizes, uses, or modifies reserved personal or family data of another recorded in a computerised, electronic, or telematic file or medium, or in any other public or private archive or register, and imposes the same penalty on a person who accesses such data by any means without authorisation, or who alters or uses the data to the detriment of the data subject or a third party. Article 197(3) raises the penalty to two to five years' imprisonment where the data or discovered facts are disseminated, revealed, or transferred to third parties. Article 197(4) raises it further to three to five years where the offender is the person in charge of or responsible for the file, or where the offence is carried out through unauthorised use of the victim's personal data, with the upper half of the range applying if the data was also disseminated or transferred. Article 197(5) applies the upper half of the range where the data reveals ideology, religion, beliefs, health, racial origin, or sexual life, or where the victim is a minor or a person with a disability needing special protection, and Article 197(6) applies the upper half, or four to seven years where sensitive data under paragraph 5 is also involved, where the offence is committed for profit.
Penalty structure
GDPR Article 83(5) sets the higher administrative-fine tier the AEPD applies, up to EUR 20,000,000 or 4 percent of total worldwide annual turnover of the preceding financial year, whichever is higher; Article 83(4) sets the narrower EUR 10,000,000 or 2 percent tier. LOPDGDD (Ley Organica 3/2018) Title IX does not restate these figures with a different Spanish ceiling; instead its Article 71 defines an infraction as any conduct within GDPR Article 83(4) to (6) or the LOPDGDD itself, and Articles 72 to 74 classify infractions as very serious (muy graves, tied to Article 83(5)), serious (graves, tied to Article 83(4)), or minor (leves), a classification that also fixes the limitation period of the infraction (three, two and one year respectively) rather than a separate monetary cap. Article 78 fixes the limitation period of an imposed sanction by its amount (one year up to EUR 40,000, two years from EUR 40,001 to EUR 300,000, three years above). Article 77 replaces the fine with a declaratory resolution for public bodies and the other controllers it lists.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 20,000,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
Agencia Espanola de Proteccion de Datos (AEPD), Spain's national supervisory authority, exercising the GDPR Article 57 functions and Article 58 powers. Several autonomous communities (among them Catalonia, the Basque Country, and Andalusia) maintain their own regional data protection authorities with jurisdiction over their own regional and local public-sector bodies; LOPDGDD Article 47 recognises both the AEPD and these autoridades autonomicas as competent to approve binding corporate rules.
Enforcement record
The Agency's 2025 annual report counts 325 fines in final resolutions and EUR 48,108,765 in total for 2025, against 281 fines and EUR 35,592,200 for 2024. Counts public fines only; private filings are not counted.
- As of
- Trend
- Rising
- Currency
- EUR
- Source link
- https://www.aepd.es/memorias/memoria-aepd-2025.pdf
- Fines per year
- 48,108,765
- Actions per year
- 325
Settledness
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0300
- Case citation
- Case C-300/21 UI v Österreichische Post AG, judgment of (Third Chamber)
- Open questions
- Does a representative of a non-EU controller or processor answer jointly and severally for an Article 82 damages claim under article 30(2) of Ley Orgánica 3/2018, although Article 82 of Regulation (EU) 2016/679 names only the controller and the processor?
What it reaches
How the hook was established
express
What makes it apply
Operator establishment, Market targeting, User location, Place of effect
Obligation class
Governance
Applicability criteria
- As of
- Combinator
- Any of
- Criteria
- the processing of personal data is in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not
- a controller or processor not established in the Union processes the personal data of data subjects who are in the Union, where the processing activities are related to the offering of goods or services to such data subjects in the Union
- a controller or processor not established in the Union processes the personal data of data subjects who are in the Union, where the processing activities are related to the monitoring of their behaviour as far as their behaviour takes place within the Union
What it makes you log
Who may demand the log
Regulator
Logging duty
Having no record of processing activities, and failing to make it available to the authority on request, are each a serious infraction.
- Kind
- Implicit
- As of
- Provision
- LOPDGDD, Art. 73(n) and (ñ), applying Regulation (EU) 2016/679, Art. 30
- Trigger
- personal_data_processing
What this law does
The AEPD is Spain's supervisory authority; LOPDGDD Titulo IX (Arts. 70-78) sorts infractions into muy graves, graves, and leves, each defined by direct cross-reference to a General Data Protection Regulation (GDPR) Article 83 tier rather than an independent Spanish fine scale, confirmed against the text. GDPR Article 82 arms an individual with a direct private right of action.
LOPDGDD's Disposicion final septima only amends Article 15 bis of the Civil Procedure Act, on the intervention of authorities in competition and data-protection proceedings, and does not create a class-action mechanism.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .