Filing a data-protection complaint with the AEPD

Terms used

• DNI — The DNI is the national identity card of Spanish citizens.
• Recurso de reposición — The recurso de reposición is an optional appeal asking the AEPD itself to reconsider its own decision.
• Abogado — An abogado is a lawyer.
• Procurador — A procurador is a court representative who files and handles paperwork for you in court.
• Cl@ve — Cl@ve is Spain's government system for proving your identity and signing procedures online.

Key rules

• Cost: Filing a complaint with the AEPD is free.
• Rights requests: Write to the company first if your complaint is about a rights request; other complaints need no prior contact.
• Compensation: The AEPD cannot award you compensation; damages must be claimed in the civil courts.
• Appeal deadlines: After a rejection you have one month for a reposición or two months for a court appeal, counted from notification.
• Silence: If the AEPD does not decide a rights claim in six months, it is treated as rejected.

When to go to the AEPD

Go to the AEPD (Spain's data-protection agency) when a company has ignored or refused your data request, or has misused your data. Filing is free.

Your first step depends on what you are complaining about:

• A rights request (access, erasure and similar): write to the company first. You can complain once it has refused, or once its time to answer has run out. The deadline for the company's answer is set out in the page on data rights requests; the checklist below shows where it fits.
• Other problems, such as unlawful use of your data, a security breach or unwanted marketing: you do not have to write to the company first. The AEPD may still send your complaint to the company's data protection officer, or ask the company to respond first.

What to prepare

The documents list below has the full set. In short, you need:

• Your identity and contact details, and the company's name and address.
• A clear description of what happened, the date, and the right or rule you think was broken.
• Evidence: emails, screenshots, contracts, advertising messages, call logs.
• For a rights complaint, your request with proof it was sent, and the company's reply or proof that none came.

How to file

1. Online (the main route). Use the AEPD's electronic office (sede electrónica). You sign with a digital certificate, electronic DNI or Cl@ve. Some urgent matters have their own dedicated channels, so check the AEPD site for your case.
2. On paper. Hand it in or post it at the AEPD in Madrid or at any public registry.

Sign, submit and keep the receipt. The AEPD then checks whether your complaint can be admitted. If something is missing, it asks you to correct it. Answer quickly.

When to file

File as soon as you can. For a rights complaint, wait until the company has answered or its time has run out. For other complaints, you can file straight away.

Infringements lapse after a set time: one year for minor ones, two for serious ones and three for very serious ones. The clock runs from the violation, or from when an ongoing violation ends. Late filing can cost you the case.

What to expect

• Admission. The AEPD must decide whether to admit your complaint within three months. If it says nothing, the complaint counts as admitted. Cross-border cases follow a different timetable.
• Rights-protection claims. These have a maximum of six months. If no decision arrives, the claim is treated as rejected by silence.
• Sanction procedures. These generally last up to nine months and lapse if not finished in time. A prior investigation can take up to twelve months.
• Outcome. The AEPD can order the company to comply (answer your request, delete data, stop processing), warn or reprimand it, and fine it. It cannot award you compensation. Claim damages separately in the civil courts.
• Your role. In a sanction procedure you are usually not a party to the case. You are told about admission and the final decision, but you cannot appeal against the level of the fine.

If the AEPD rejects or closes your claim

Read the decision for its dates. You have two routes, and the decision block below compares them.

• Recurso de reposición. An optional appeal to the AEPD itself, within one month of the day after you are notified. If the AEPD does not answer within one month, it counts as rejected.
• Contencioso-administrativo appeal. An appeal to the National High Court (Audiencia Nacional), within two months of notification, or of the rejection of the reposición. If you file a reposición, wait for its result first.

You normally need a lawyer (abogado) and a court representative (procurador) for the court route. Deadlines run from notification, so confirm the exact dates in your decision.

Regulators for sectors such as banking or telecoms are covered in the consumer complaint pages.

Choosing between options

What should you do after the AEPD rejects or closes your claim?

• Ask the AEPD to reconsider: You want a cheaper, simpler second look. File a recurso de reposición within 1 month of the day after notification.

• Go to court: You want a judge to review the decision. File within 2 months of notification (or of the rejection of your reposición) before the Audiencia Nacional, with a lawyer and a court representative.

• Claim damages in the civil courts: You want money for harm caused. The AEPD cannot award compensation, so this is a separate claim.

If you file a reposición, wait for its result before going to court. If the AEPD does not answer within 1 month, it counts as rejected and the 2 months for court start.

Timeline and deadlines

• For a complaint about a rights request, wait for the company's answer: one month after your request, or up to two further months if the company told you why it needs more time

• File your complaint, as soon as you can: within three years of a very serious violation, two years of a serious one or one year of a minor one, counted from the violation or from when it ends

• Wait for the AEPD to decide whether to admit your complaint: within three months of the AEPD receiving it; no decision means it is treated as admitted

• Wait for the outcome of a rights-protection claim: up to six months; with no resolution in that time it is treated as rejected

• Wait for the outcome of a sanction procedure: generally up to nine months from the start agreement; if it takes longer the procedure lapses

• Ask the AEPD to reconsider a rejected or closed claim (recurso de reposición): within 1 month of the day after you are notified; no answer in 1 month counts as rejection

Documents you need

• A copy of your ID, or your electronic identification if you file online.

• A copy of your request to the company, with proof it was sent (needed for complaints about rights requests).

• The company's reply, or proof that no reply came (needed for complaints about rights requests).

• Evidence of the violation, such as emails, screenshots, contracts, advertising messages and call logs.

• Proof that you may act for the other person, if you file on someone else's behalf.

• A digital certificate, electronic DNI or Cl@ve, to sign and send the complaint online. Without one, you can file on paper.

Checklist

• Send your request to the company first if your complaint is about a rights request such as access or erasure, and keep proof of sending.

• Wait for the company's reply, and keep it or note that none came.

• Write the name and address of the company and describe the facts, the date and the right or rule you think was broken.

• Choose how to file: online with a digital certificate, electronic DNI or Cl@ve, or on paper in person or by post at the AEPD in Madrid or any public registry.

• Reply quickly if the AEPD asks you to correct or add missing items.

• Read any rejection or closure decision for its dates, and note the deadline for an appeal.

What to watch out for

• Filing a rights complaint too early: A complaint about a rights request is admissible when the company denied it or did not answer in time. If you file before then, the AEPD may send it back or ask the company to respond first. Send your request to the company, keep proof, and file once the reply period has passed. Attach your request, proof it was sent and any reply or proof of silence.

• Silence can mean rejection: If a rights claim gets no resolution within six months, it is treated as rejected. If you then do nothing, you lose the chance to challenge it. Note the date you filed and act as soon as the period ends. Count the appeal deadline from the day after you are notified, and check the dates in the decision.

• Missing the appeal deadlines: If the AEPD rejects or closes your claim, you have 1 month to ask it to reconsider and 2 months to go to court. If you ask for reconsideration, you cannot go to court until it is resolved. Court appeals normally need a lawyer (abogado) and a court representative (procurador). Speak to a lawyer well before the deadline.

What if a company ignores your data request or breach notice

What counts as being ignored

A company has ignored your data request if any of these happens:

• No answer in time. You get nothing within one month. The company can stretch this by two further months only if it tells you why within the first month.
• A partial answer. It sends some of the data or covers some of what you asked for, and leaves the rest out.
• A refusal with no reasons. Even a "no" must come in time, explain why, and tell you that you can complain to the AEPD and go to court.

What counts as ignoring a breach notice

If a company has a data breach that puts people at risk, it must report it to the AEPD within 72 hours. When the risk to you is high, it must also tell you without undue delay. If you have reason to think your data was exposed and you heard nothing, treat that silence the same way.

How to escalate to the AEPD

1. Make sure the company has your request in writing. For a rights request, the AEPD generally expects you to have asked the company first. Keep a copy of your message and any proof it was sent or received.
2. Wait for the deadline to pass, or for the company's refusal or partial answer.
3. File a claim with the AEPD through its electronic office. For a rights request, this is called a "reclamación de tutela de derechos". Attach your original request, the company's reply (if any) and anything showing the date.
4. Let the AEPD take it from there. It asks the company to respond, then decides whether your right was properly met. If not, it can order the company to comply and open a sanction procedure.

What to expect

Rights-protection cases generally take up to 6 months.

For a breach, the AEPD can open an investigation and sanction the company. It can also act on its own and order the company to notify the people affected. You do not need to be sure a breach happened before you complain. Describe what you know and what you were never told.

Frequently asked questions

Can the AEPD get me compensation?

No, the AEPD cannot award you compensation. It can order the company to comply, issue warnings and impose fines, but damages must be claimed separately in the civil courts.

Is there a time limit for filing a complaint after the violation?

Yes, the time limit depends on how serious the violation is: three years for very serious ones, two years for serious ones and one year for minor ones. The clock runs from the date of the violation, or from when it ends if it continues. File as soon as you can.

Can I complain about unwanted marketing without writing to the company first?

Yes, for unlawful processing, a security breach or unwanted marketing you do not have to contact the company first.

Can I appeal if the AEPD fines the company but I disagree with the outcome?

Generally no, because in a sanction procedure you are not a party to the case. You are told when the complaint is admitted and when the resolution is issued, but you have no right to appeal its outcome.