Real AEPD fines on SMEs: cases and lessons

Contents

1. How many fines does the AEPD impose, and for how much?
2. Does the AEPD also fine small businesses?
3. Case 1 — What happened with a bar's camera and no sign?
4. Case 2 — What happened when a defaulters register was searched without cause?
5. Case 3 — What happened with an unsolicited sales call?
6. What do the three cases have in common?
7. Can a fine be reduced once the case file is open?
8. How do you stay off this list?
9. Frequently asked questions
10. Sources and methodology

How many fines does the AEPD impose, and for how much?

In 2024 the AEPD issued 281 decisions imposing a fine, 23 % fewer than in 2023 (367), but the total amount rose by 19 %: from 29,817,410 € to 35,592,200 € (Memoria Anual 2024 de la AEPD, section 9.1). That year the AEPD received 18,855 complaints (13 % fewer than in 2023).

The largest fines of 2024 —several million euros— are on banks, energy companies and telecoms operators: CaixaBank, Iberdrola, Telefónica, BBVA, Orange. Those figures reach the press and make a lot of noise, but they do not represent what happens to a small business. Fines above 1 million euros on legal persons are also published in the Boletín Oficial del Estado, the state gazette, as the LOPDGDD (Spain's data protection act) requires.

Does the AEPD also fine small businesses?

Yes. Among the 281 decisions of 2024 there are bars, small security firms, shops and self-employed people, with fines of hundreds or a few thousand euros for specific failures: a CCTV sign put up wrong, a sales call without consent, a piece of data used with no legal basis. We have not found an official AEPD statistic breaking down exactly what percentage of those 281 fines falls on SMEs and self-employed people rather than large companies, so we do not state it as a settled figure. What we can show is real, verifiable cases, with the public decision for each one.

Case 1 — What happened with a bar's camera and no sign?

Case file EXP202316991 (decision PS-00161-2024). The events took place in 2022 and 2023; the AEPD decided the file in 2025.

A nightlife venue had two cameras recording the whole room: the bar, the tables and the customer area. The information sign was incomplete: it did not say who the data controller was, or how to exercise your rights. On top of that, some images from the cameras ended up published on Facebook without anyone giving their consent.

The AEPD imposed two fines of 500 € each: one for capturing more area than necessary (art. 5.1.c RGPD, the minimisation principle) and one for failing to inform properly through the sign (art. 13 RGPD). Total: 1,000 €. It also ordered the business to point the cameras at the till and the entrance only, not at the whole room. The AEPD closed the part of the complaint about the Facebook post without further action, as it could not establish who had uploaded it.

Read the full decision (PDF, aepd.es)

Case 2 — What happened when a defaulters register was searched without cause?

Case file EXP202312994 (decision PS-00034-2024), May 2024.

A company (Arrendamientos Deudores, S.L., with a turnover of 157,978 € in 2020, clearly an SME) looked up a person's data in ASNEF, a credit-default file, to assess a financial risk. When the AEPD asked it to justify that search, the company could not produce any contract or prior relationship with that person to justify it: without that relationship, searching the file had no legal basis (art. 6.1 RGPD).

The starting fine was 2,000 €. It was reduced by 40 % —20 % for admitting liability and 20 % for voluntary payment within the deadline— and came down to 1,200 €.

Read the full decision (PDF, aepd.es)

Case 3 — What happened with an unsolicited sales call?

Case file EXP202312711 (decision PS-00084-2024). The call was made in 2023; the AEPD opened penalty proceedings in May 2024.

A marketing company (Adverbis Spain, S.L.) made an automated call to a number that was on the Lista Robinson, the register of people who do not want advertising. The person who took the call asked them to stop. Adverbis argued that it was a B2B call, with no commercial intent towards consumers, and that the number was in public directories. The AEPD did not accept this: the call breached the Ley General de Telecomunicaciones, Spain's telecoms act (art. 66.1.b), a rule the AEPD also applies in cases of this kind.

The fine: 5,000 €.

Read the full decision (PDF, aepd.es)

What do the three cases have in common?

Three things, and none of them is "bad luck":

• The failure is specific and visible from outside. A half-filled-in sign, a call that should never have been made, a search with no written justification. You do not need a big security breach to end up in a decision: one missing piece of paper is enough.
• The file almost always starts with a complaint from one specific person, not with a surprise inspection. All three cases start with someone —a customer, a neighbour, the person who took the call— filing a complaint with the AEPD.
• The amount is proportionate to the size of the failure, not to how frightening the word "RGPD" sounds. 500 €, 1,000 €, 1,200 €, 5,000 €: a long way from the 20 million sometimes quoted as a headline. The RGPD sets those maximums in article 83 (up to 10 million euros or 2 % of annual worldwide turnover, and up to 20 million or 4 %, depending on the infringement), but they are the legal ceiling, not what is usual for a small business that answers when it is asked.

Can a fine be reduced once the case file is open?

Yes, and case 2 shows it with real numbers. When the AEPD opens penalty proceedings, the business can admit liability and pay the proposed fine within the deadline. Each of those two actions gives a reduction of 20 %, and they stack: up to 40 % off the starting amount (art. 85 of the Ley 39/2015, del Procedimiento Administrativo Común, Spain's general administrative procedure act, as applied by the AEPD in its decisions). This does not replace the advice of your gestoría (the Spanish adviser small businesses use for admin and tax) if a notice from the AEPD reaches you: it is general information, not an instruction for your case.

How do you stay off this list?

The three cases in this article could have been avoided with documents that take minutes to prepare, not weeks:

• If you have cameras, the information sign has to carry the three details the AEPD asks for: who the controller is, where to exercise your rights and where to find fuller information. What your CCTV sign has to carry, according to the AEPD.
• If you send advertising or call customers, check first that you have their consent for that specific channel and that they are not on the Lista Robinson.
• If you search a credit-default file or any third party's data, put the legal basis in writing before you do it, not after you are asked about it.

Tranquilia generates these documents and the rest of your RGPD folder from a 15-minute questionnaire, with the legal basis for each one already written. Try it free with 2 companies, no card and no time limit.

Frequently asked questions

How much money can the AEPD fine an SME?

It depends on the infringement and on how the business responds. In the three real cases in this article, the fines range from 500 € to 5,000 €. The RGPD sets legal maximums of up to 10 million euros or 2 % of worldwide turnover, and up to 20 million or 4 %, under article 83 of the RGPD, but those figures are the ceiling, not what is usual for a small business.

Does the AEPD inspect businesses at random?

In the three cases in this article, the file starts with a complaint from one specific person, not with a surprise inspection. The AEPD can also act on its own initiative, but the most common origin in these cases is a complaint.

Can I reduce a fine if I admit the failure?

Yes. Admitting liability and paying within the deadline can reduce the fine by up to 40 % in total, as case 2 in this article shows (from 2,000 € to 1,200 €).

Where are the AEPD's real decisions published?

In the decision search tool at aepd.es, with the file number and the full text. Fines above 1 million euros on companies are also published in the BOE.

Does this mean Tranquilia leaves you "legal" in the eyes of the AEPD?

No. Tranquilia organises the work and prepares the right documents, with the legal references for each one. The decision and the signature are yours or your gestoría's. It is not an official certification or a legal opinion.

Sources and methodology

The three cases in this article are public AEPD decisions, cited with their file number and linked to the original PDF on aepd.es. The 2024 figures (281 fines, 35,592,200 €, 18,855 complaints) come from the Memoria Anual 2024 de la AEPD. The legal maximums in article 83 come from the text of the RGPD on EUR-Lex. We include no figure, case or statistic that we have not been able to verify against an official source: if a fact was not confirmed, we left it out instead of approximating it.

Article prepared by Tranquilia by GRAC SA. Publication date: 16 July 2026. Last reviewed: 16 July 2026. This content is for information purposes and does not constitute individual legal advice.