Skip to content
BOE-A-2026-14010 ·27 June 2026 ·Resolution Low impact
Data & GDPR

Spanish Data Protection Agency: publication of fines exceeding one million euros

The Spanish Data Protection Agency (AEPD) publishes sanctions imposed on legal entities that exceed one million euros, in accordance with the mandate of Article 76.4 of Organic Law 3/2018 (Art. 76.4 LOPDGDD). This resolution details GDPR-related infringements committed by companies in the telecommunications and technology services sectors. The measure aims to ensure transparency regarding data protection regulatory non-compliance by large corporations.

In 2 key points

  1. Mandatory publication of sanctions exceeding 1,000,000 EUR for legal entities, Art. 76.4 LOPDGDD (art. 76.4)
  2. 14,400,000 EUR fine imposed on AMADEUS IT GROUP, SA for infringements of Articles 6 and 14 of the GDPR, Annex (Anexo)

How it affects those involved

For large companies (legal entities), failure to comply with GDPR standards entails not only the financial burden of the fine but also the public exposure of their infringement (Art. 76.4 LOPDGDD). In this instance, sanctions of up to 14,400,000 euros have been recorded for violations of Articles 6 and 14 of the GDPR (Annex).

Lifecycle

2026-06-27PublishedPublished in the BOE
Official text Based on BOE data (boe.es). Information, not advice.

Does this provision affect you?

The data & gdpr team reviews your specific situation.

Talk to the data & gdpr team
This analysis is informational only and does not constitute legal advice or create a client-adviser relationship. BM Consulting.
Email
Contact