Spain's data protection authority, the AEPD, has issued 1,048 published GDPR fines, more than any other regulator in Europe, according to the CMS GDPR Enforcement Tracker Report 2025/2026, which tracks enforcement through a March 1, 2026 cutoff. That count has held the top spot for seven straight years, but Spain's fines run small: most cases end in a four-or-five-figure penalty rather than the eight-figure sums that make headlines elsewhere in Europe.
How many GDPR fines has Spain's AEPD issued?
1,048 fines is the current published count, per the CMS GDPR Enforcement Tracker Report 2025/2026, out of 2,685 fines recorded across every country the report tracks. No other single country comes close: Italy, Romania, and Poland, the next most active regulators by count, have together published fewer fines than Spain alone, according to the same report.
Figure 1: Spain accounts for 39% of every published GDPR fine tracked in Europe. Source: CMS GDPR Enforcement Tracker Report 2025/2026, cutoff March 1, 2026.
That 39% share is a count, not a euro total. Ireland's Data Protection Commission, by contrast, has issued far fewer fines but the largest cumulative value in Europe, a split covered in more detail in our GDPR fines totals for 2026.
Why does Spain's AEPD fine more often than other regulators?
The AEPD runs what the Spanish Compliance Institute's 2026 review of AEPD enforcement patterns describes as a volume-first model: hundreds of smaller sanctions against businesses of every size, rather than a handful of large corporate cases. Part of the reason is complaint volume. The agency logged 21,590 complaints in 2023, a 43% jump from 2022, and 18,855 in 2024, the second-highest total in its history, per that same review of CMS enforcement data.
Figure 2: AEPD fines issued per year. Case volume more than doubled from 2019 to 2022 before easing back in 2024. Source: CMS GDPR Enforcement Tracker Report, Spain country data.
The AEPD also enforces GDPR across every sector, not just companies headquartered in Spain, and the agency's posture shifted from cautious to assertive starting in 2021, the year it fined Vodafone Spain EUR 8.15 million over telemarketing consent failures, according to the Spanish Compliance Institute's analysis. Sites that collect personal data from Spanish residents can close the most common gap by keeping consent and disclosure language current with a privacy policy generator built for GDPR compliance.
Frequent enforcement does not mean severe enforcement. The next two sections show why the AEPD's high case count and its fine amounts tell two very different stories.
How does the AEPD's average fine change from year to year?
The AEPD's average fine per case has swung sharply from year to year: EUR 48,073 in 2019, up to EUR 135,911 in 2021, then back down to roughly EUR 47,000 to EUR 81,000 across 2022 through 2024, according to the CMS GDPR Enforcement Tracker Report's Spain country data. There is no steady upward trend the way total fine counts show; a single larger corporate case can move the yearly average sharply in either direction.
Figure 3: AEPD average fine per case by year, in EUR thousands. 2021's spike reflects a small number of larger corporate fines. Source: CMS GDPR Enforcement Tracker Report, Spain country data.
2025 fines already exceed EUR 40 million in total value, per the same report, though the report does not yet publish a confirmed case count for that year, so treat 2025's average as provisional until the next edition's cutoff.
How small are Spain's fines next to the EU-wide average?
Very small. The AEPD's 2024 average fine of EUR 46,900 is a fraction of the EUR 2,277,122 average across all 2,685 GDPR fines tracked EU-wide as of March 2026, according to the CMS report. That EU-wide figure is skewed upward by a small number of mega-fines, including Ireland's EUR 1.2 billion case against Meta, so Spain's low average reflects a genuinely different enforcement strategy rather than a data quirk.
Figure 4: Spain's average fine per case is a fraction of the EU-wide average across all tracked GDPR cases. Source: CMS GDPR Enforcement Tracker Report 2025/2026.
Even Spain's larger cases stay modest by European standards. DLA Piper's GDPR Fines and Data Breach Survey (January 2026) notes the AEPD issued two fines totaling EUR 6.2 million against a single bank in 2025 for inadequate security measures, a large case for Spain but still well below the country's own record.
What is the largest fine the AEPD has ever issued?
Figure 5: The AEPD's largest confirmed fine to date. Source: CMS GDPR Enforcement Tracker Report 2025/2026.
EUR 10,043,002 is the AEPD's largest confirmed fine, issued against Aena, S.M.E., S.A., the operator of Spain's airports, for processing biometric data without first completing a required data protection impact assessment. It is the clearest example of the AEPD stepping outside its usual small-fine pattern, and it landed in the sector the CMS report flags as a growing enforcement focus: biometric identity checks at airports and other high-traffic venues.
How does Spain compare with the rest of Europe by fine count?
| Country or region | Published fines (2026) | Share of EU total |
|---|---|---|
| Spain (AEPD) | 1,048 | 39% |
| Rest of Europe, combined | 1,637 | 61% |
| All countries tracked | 2,685 | 100% |
Source: CMS GDPR Enforcement Tracker Report 2025/2026, cutoff March 1, 2026.
AEPD fines by year: the full breakdown
| Year | Fines issued | Total fine value | Average fine |
|---|---|---|---|
| 2019 | 167 | EUR 8,018,800 | EUR 48,073 |
| 2021 | 258 | EUR 35,074,800 | EUR 135,911 |
| 2022 | 378 | EUR 20,775,361 | EUR 54,980 |
| 2023 | 367 | EUR 29,817,410 | EUR 81,289 |
| 2024 | 281 | EUR 13,180,800 | EUR 46,900 |
Source: CMS GDPR Enforcement Tracker Report, Spain country data. 2020 is omitted because the report's Spain page does not publish a figure for that year, and 2025 is excluded because only a total value, not a confirmed case count, is available so far.
The Bottom Line
Spain's AEPD leads Europe in GDPR fine count, 1,048 published cases and 39% of every fine the CMS Enforcement Tracker Report tracks, but its average fine, EUR 46,900 in 2024, is a fraction of the EUR 2,277,122 EU-wide average. That combination reflects a deliberate enforcement style: high complaint volume, broad sector coverage, and a preference for many smaller sanctions over a handful of mega-fines. For a business handling Spanish residents' data, the practical risk is not a billion-euro headline case, it is the routine, high-volume review that catches an outdated consent notice or a missing biometric data assessment. Keeping a privacy policy generator built for GDPR compliance current is the cheapest way to stay off that list.
Frequently Asked Questions
How many GDPR fines has Spain's AEPD issued? 1,048 published fines, according to the CMS GDPR Enforcement Tracker Report 2025/2026 (cutoff March 1, 2026), the highest count of any European data protection regulator for the seventh year running.
Why does Spain fine companies more often than other EU countries? The AEPD runs a high-volume, lower-amount enforcement model and fields far more public complaints than most peer regulators, including 18,855 complaints in 2024 alone, according to the Spanish Compliance Institute's review of AEPD enforcement patterns.
Is the average AEPD fine large or small? Small. The AEPD's average fine was EUR 46,900 in 2024, according to the CMS Enforcement Tracker Report, versus an EU-wide average of EUR 2,277,122 across all 2,685 tracked GDPR fines as of March 2026.
What is the largest fine the AEPD has ever issued? EUR 10,043,002, issued against Aena, S.M.E., S.A. for processing biometric data without first completing a required data protection impact assessment, per the CMS GDPR Enforcement Tracker Report.
Where the Numbers Come From
- CMS International Law Firm. (2026). "Data Protection Laws and GDPR Enforcement in Spain." GDPR Enforcement Tracker Report 2025/2026, Spain country data: 1,048 published fines, year-by-year totals, and the EUR 10,043,002 Aena record fine.
- CMS International Law Firm. (2026). "Numbers and Figures." GDPR Enforcement Tracker Report 2025/2026: 2,685 total fines, EUR 6.11 billion cumulative, EUR 2,277,122 average fine, cutoff March 1, 2026.
- DLA Piper. (2026). "GDPR Fines and Data Breach Survey, January 2026." Confirms Spain's 1,048-fine lead for the seventh consecutive year and the EUR 6.2 million bank case.
- Spanish Compliance Institute. (2026). "Why Spain's AEPD Issues More GDPR Fines Than Other EU Regulators." Complaint volume figures (21,590 in 2023, 18,855 in 2024) and the 2021 Vodafone Spain case, drawn from its review of CMS enforcement data.
Note: All figures verified as of March 2026. AEPD enforcement data is refreshed at least twice a year as the CMS GDPR Enforcement Tracker Report publishes new editions.
