What is the maximum GDPR fine?

Art. 83 GDPR sets two tiers: (1) minor infringements, up to EUR 10 million or 2% of annual worldwide turnover (whichever is greater); (2) serious and very serious infringements, up to EUR 20 million or 4% of annual worldwide turnover.

What factors does the AEPD consider when grading the penalty?

The AEPD assesses criteria from Art. 83(2) GDPR and Art. 76 LOPDGDD: intentionality or negligence, categories of data affected, number of data subjects, prior technical and organisational measures, cooperation with the authority, recidivism, financial benefit obtained and adherence to codes of conduct.

What is the difference between GDPR and LOPDGDD?

The GDPR (EU Regulation 2016/679) is the directly applicable European regulation. The LOPDGDD (Organic Law 3/2018) is the Spanish law that complements it, classifying infringements as minor (Art. 74), serious (Art. 73) and very serious (Art. 72), and adding specific graduation criteria (Art. 76).

Can an AEPD penalty be appealed?

Yes. The AEPD sanctioning resolution can be appealed before the Audiencia Nacional (National Court) via administrative litigation within 2 months of notification. It is also possible to request precautionary suspension of the penalty (Art. 130 LJCA).

GDPR/LOPDGDD Penalties Calculator Spain 2026

Organisation data

Annual worldwide turnover (EUR)

Art. 83 GDPR: the maximum is calculated on the worldwide turnover of the corporate group

Number of employees

Size: SME (11-50)

Type of infringement

Specific infringement

Severity (LOPDGDD Arts. 72-74)

Processing without valid consent, failure to notify breaches to AEPD within 72h, failure to conduct DPIA, international transfers without safeguards, etc.

Legal limits (Art. 83 GDPR)

Absolute maximum: 20.000.000 EUR

Revenue-based maximum: 40.000 EUR (4%)

Applicable maximum (the greater): 20.000.000 EUR

Graduation factors (Art. 83(2) GDPR + Art. 76 LOPDGDD)

Repeat offender (prior infraction within 2-3 years)+30%

Aggravating factors

Intentional or gross negligenceArt. 83(2)(b) GDPR

+25%

Special category data affectedArt. 83(2)(g) GDPR

+20%

Previous infringement historyArt. 83(2)(e) GDPR

+30%

Large number of data subjects affectedArt. 83(2)(a) GDPR

+15%

Direct financial benefit obtainedArt. 76(2)(b) LOPDGDD

+15%

Mitigating factors

Cooperation with the AEPDArt. 83(2)(f) GDPR

-15%

Prior technical/organisational measuresArt. 83(2)(d) GDPR

-20%

Proactive breach notificationArt. 83(2)(h) GDPR

-10%

Adherence to approved codes of conductArt. 83(2)(j) GDPR

-15%

First infringement with no historyArt. 76(2) LOPDGDD

-10%

Penalty estimate

Estimated penalty

200.000 EUR

Range: 40.000 - 20.000.000 EUR

40.000 EUR20.000.000 EUR

SeriousNet factor: +0%

Legal disclaimer

This calculator provides an indicative estimate based on Art. 83 of Regulation (EU) 2016/679 (GDPR) and Arts. 72-76 of Organic Law 3/2018 (LOPDGDD). The final penalty amount depends on the individualised assessment by the AEPD (Spanish DPA), which takes into account circumstances that cannot be modelled (e.g., specific impact on data subjects, detailed financial situation). This does not constitute legal advice. Consult a data protection specialist lawyer.

GDPR Penalties Calculator

Organisation data

Type of infringement

Graduation factors (Art. 83(2) GDPR + Art. 76 LOPDGDD)

Aggravating factors

Mitigating factors

Penalty estimate

Questions about GDPR and AEPD sanctions?

Related resources

Related articles

Have a legal issue?

Are you a lawyer? Professional tools

GDPR Penalties Calculator

Organisation data

Type of infringement

Graduation factors (Art. 83(2) GDPR + Art. 76 LOPDGDD)

Aggravating factors

Mitigating factors

Penalty estimate

Questions about GDPR and AEPD sanctions?

Related resources

Related articles

Have a legal issue?

Are you a lawyer? Professional tools

Weekly legal updates