How to File a Complaint with the AEPD in Spain (2026)

When a company or public body mishandles your data or ignores a request, the AEPD is where you turn. Filing a complaint is free and can be done online, but it helps to know what the AEPD will actually do with it, and what it will not.

Information last verified on 23 July 2026. This page provides general legal information about Spanish law and does not constitute legal advice in an individual case.

When to complain

The right to complain is in RGPD art. 77: anyone who considers that the processing of their personal data breaches the rules may lodge a complaint with a supervisory authority, which in Spain is the AEPD. The typical triggers are an organisation that has ignored a data request, refused it without a good reason, kept using your data after you objected, suffered a breach affecting you, or is processing your data with no lawful basis.

Try the controller first

Before going to the AEPD, ask the organisation itself to put it right, using the steps on the RGPD in Spain page. This matters for two reasons. First, many problems are resolved at that stage. Second, the AEPD generally expects you to have raised it with the controller, and a complaint that attaches your unanswered request and the deadline that passed is far stronger than one that starts cold.

How to file it

The complaint is a reclamación and it is free. You file it at the AEPD's sede electrónica with a digital certificate or the Cl@ve system, or on paper. You do not need a lawyer.

In it you identify the organisation, describe what happened, say which right or rule is affected, and attach your evidence: the request you sent, any reply or the absence of one, dates, and what data is involved. A clear, documented complaint is easier for the AEPD to act on.

What the AEPD can and cannot do

This is the part that most often surprises people. The AEPD can investigate, require the controller to bring its processing into line, and impose fines, which under RGPD art. 83 reach up to 20 million euros or 4% of worldwide turnover for the most serious infringements. What it cannot do is award you compensation, since its fines go to the public treasury.

If the breach caused you actual damage and you want to be paid for it, that is a separate claim in the civil courts under RGPD art. 82, which can run alongside or after the AEPD complaint.

So the honest framing is: complain to the AEPD to stop the conduct and see it sanctioned; go to a civil court if you want damages. For the wider structure, see the data protection overview.

This page is general legal information about Spanish data-protection law and does not constitute legal advice in an individual case. The controlling texts are the current versions in the BOE and the RGPD.

Frequently Asked Questions

How do I complain to the AEPD?

File a reclamación, for free, at the AEPD's sede electrónica using a digital certificate or Cl@ve, or on paper. Identify the organisation, describe what happened, say which right or rule is affected, and attach your evidence. You do not need a lawyer, and it is usually best to have first asked the organisation itself to fix the problem.

Does it cost anything to complain to the AEPD?

No. Filing a reclamación with the AEPD is free and you do not need a lawyer. The right to complain comes from RGPD art. 77. Beware of any service that offers to do it for a fee, since the process is designed to be used directly by the affected person at no cost.

Will the AEPD get me compensation?

No. The AEPD can investigate, order the organisation to comply and impose fines, but those fines go to the public treasury, not to you. If you have suffered actual damage and want to be compensated, that is a separate claim in the civil courts under RGPD art. 82, which you can pursue alongside or after the AEPD complaint.

Should I go to the controller before the AEPD?

Usually yes. Many issues are resolved once you ask the organisation directly, and the AEPD generally expects you to have raised it with the controller first. A complaint that shows your unanswered request and the deadline that passed is much stronger than one that has not tried that step.