The Spanish authority sanctions a company for failure to cooperate, reminding that failure to respond to a request for information constitutes an obstruction to its investigative powers and a violation of the GDPR.

Facts and context

The Spanish Data Protection Authority (AEPD) today published a sanction decision against the company GL AI INVESTMENT SL (including the imposition of a fine of €600) for breaches related to its obligation to cooperate with the supervisory authority.

The procedure was initiated following a complaint and indications of non-compliance, leading the authority to send two requests for information to the company.

Grounds for the decision

• Obligation to cooperate with the supervisory authority (Article 58 of the GDPR): The authority found that the company did not respond to either of the two formal requests for information sent on 16 June and 25 July 2025. By refraining from providing the required information, the entity obstructed the investigative powers of the supervisory authority. The authority concluded that this failure to cooperate constitutes a breach of the obligation to provide access to the information necessary for the performance of its tasks, in violation of Article 58(1) of the GDPR, an infringement punishable under Article 83(5)(e) of the GDPR.

Decision of the authority

Consequently, the authority imposed a fine of €600 on GL AI INVESTMENT SL.

Furthermore, the authority ordered the company to provide the initially requested information within ten working days from the moment the decision becomes final.

Lessons learned

This decision reminds that:

• The duty to cooperate with the supervisory authority, as provided by the GDPR, is a mandatory obligation for every controller.
• Failure to respond to a formal request for information from a supervisory authority constitutes an infringement in itself, qualified as obstruction to its investigative powers.
• Failure to comply with the obligation to provide access to information under Article 58(1) of the GDPR is an infringement subject to the highest administrative fines, pursuant to Article 83(5) of the GDPR.
• A supervisory authority may carry out a sanction procedure to its conclusion and impose a fine even in the total absence of communication or arguments from the entity concerned.