The Spanish authority sanctions a company for failing to respond to its information requests, emphasizing that obstruction of investigative powers constitutes a separate violation of the GDPR, subject to the highest fines.

Facts and context

The Spanish Data Protection Authority (AEPD) today published a sanction decision against CONSULTORÍAS BARRIANO, S.A.S. (including the imposition of a 600 € fine) for breaches related to its obligation to cooperate with the supervisory authority.

The case originated from a complaint filed with the AEPD, which led to the opening of a preliminary investigation against the company.

Grounds for the decision

The authority found a single breach against the company:

• Obligation to cooperate with the supervisory authority (Article 58(1) of the GDPR): The authority found that the company did not respond to two successive information requests, sent on 12 and 31 July 2025 as part of its investigation. Under its investigative powers, a supervisory authority may require the controller to provide any information necessary to carry out its tasks. The total absence of response constitutes a direct breach of this cooperation obligation, qualified as an infringement under Article 83(5) of the GDPR.

Authority's decision

Consequently, the authority imposed a fine of 600 € on CONSULTORÍAS BARRIANO, S.A.S.

Furthermore, the authority ordered the company to provide the requested information within ten working days.

Lessons learned

This decision reminds that:

• Failure to respond to a supervisory authority's information request constitutes an autonomous infringement of the GDPR, regardless of the merits of the initial complaint.
• Obstruction of the authority's investigative powers is a serious violation, subject to the highest sanction regime under the GDPR (Article 83(5)).
• The obligation to cooperate applies to any organization, including those established outside the European Union, as long as they fall within the scope of the GDPR.
• A supervisory authority may impose corrective measures, such as an order to provide information, in addition to a financial penalty.