A company was sanctioned for failing to respond to information requests from a supervisory authority, illustrating that the failure to comply with the cooperation obligation constitutes a separate and serious infringement, regardless of the merits of the initial complaint.

Facts and context

The Spanish Data Protection Agency (AEPD) today published a sanction decision against TECHORRO SPAIN, S.L. (including the imposition of a €3,000 fine) for breaches related to its obligation to cooperate with the supervisory authority.

The case originated from a complaint filed against the company, which led the authority to initiate an investigation and issue several information requests.

Grounds for the decision

• Obligation to provide the information requested by the supervisory authority (Article 58(1) of the GDPR): The authority found that the company did not respond to three successive information requests, duly notified on 9 December 2025, 2 January 2026, and 3 February 2026. The AEPD considered that this lack of response constituted an obstruction to its investigative powers, which are essential to supervise the effective application of the GDPR. Based on the criteria of Article 83(2) of the GDPR, the authority qualified the breach as intentional, emphasizing that the company showed no willingness to cooperate despite the mandatory nature of the requests. To determine the severity, the authority also took into account the European Data Protection Board (EDPB) Guidelines 04/2022 on the calculation of administrative fines.

Authority's decision

Consequently, the authority imposed a €3,000 fine on TECHORRO SPAIN, S.L. However, as the company made a voluntary payment before the final resolution, the amount was reduced by 20% to €2,400.

Furthermore, the authority ordered the company to provide, within ten working days, all the information requested during the initial investigation.

Lessons learned

This decision confirms / clarifies / recalls that:

• Failure to comply with the obligation to cooperate with a supervisory authority by not responding to its information requests constitutes a separate and punishable infringement in itself, regardless of the subject of the initial investigation.
• Failure to respond to formal and repeated requests from an authority can be qualified as intentional, which is an aggravating factor in determining the amount of the sanction.
• Obstructing the investigative powers of a supervisory authority is considered a serious infringement, as it prevents the authority from fulfilling its mission to monitor the application of the GDPR.
• Voluntary payment of a proposed fine may allow for significant reductions, but it does not prevent the authority from issuing a formal decision and ordering corrective measures.