The Spanish authority sanctioned a company for failing to respond to its information requests, emphasizing that obstruction of investigative powers constitutes a direct violation of the GDPR, regardless of any other substantive breaches.

Facts and context

The Spanish Data Protection Agency (AEPD) today published a sanction decision against AD735 DATA MEDIA ADVERTISING, S.L. (including the imposition of a fine of €1,200) for breaches related to its obligation to cooperate with the supervisory authority.

The case originated from the company's failure to respond to several information requests issued by the authority during an investigation.

Grounds for the decision

• Obligation to provide access to information necessary for the authority's mission (Article 58(1) of the GDPR): The authority found that the company, despite several reminders on 8 August 2025 and 10 October 2025 and the granting of additional deadlines, never provided the required information and documents. By refraining from responding, the company obstructed the authority's investigative powers, preventing it from carrying out its mission to monitor GDPR compliance. The authority qualified this breach as an infringement under Article 83(5)(e) of the GDPR, which penalizes failure to provide access in violation of Article 58(1).

Authority's decision

Consequently, the authority imposed a fine of €1,200 on AD735 DATA MEDIA ADVERTISING, S.L., after applying reductions for acknowledgment of responsibility and voluntary payment on an initial amount of €2,000.

Furthermore, the authority ordered the company to provide, within ten working days, the information initially requested.

Lessons learned

This decision confirms / specifies / recalls that:

• The obligation to cooperate with the supervisory authority, notably by responding to its information requests, constitutes an autonomous obligation whose non-compliance is sanctioned as such.
• Deliberately ignoring requests from a supervisory authority, even after extensions have been granted, constitutes obstruction of its investigative powers.
• The investigative powers granted to authorities by Article 58 of the GDPR are essential to their mission, and any obstruction to their exercise is considered a serious infringement.
• The use of acknowledgment of responsibility and voluntary payment procedures, where national legislation allows, can lead to a substantial reduction in the amount of the fine.