AEPD (Spain) - PS/00249/2025
Spain's AEPD fines solar company €10,000 for unsolicited marketing calls.
Spain's data protection authority (AEPD) has fined a solar energy company €10,000 for making unsolicited marketing calls without valid consent and failing to provide GDPR Article 14 information. The company could not prove the data subject had given consent, nor did it provide the applicable privacy policy at the time of consent.
AI summary of the linked source. Not reviewed by an editor. How this works
Run AEPD?
Get an email when a new story names AEPD, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA Spanish solar energy company was fined €10,000 by the AEPD after making unsolicited marketing calls without being able to demonstrate valid consent from the data subject. The company also failed to provide the required GDPR Article 14 transparency information at the time data was collected, a fundamental obligation when personal data is obtained indirectly. This case highlights that consent must be documented, provable, and accompanied by clear privacy notices — not simply assumed or asserted. Regulatory fines like this are avoidable when organisations build proper consent management and data subject notification processes into their marketing workflows from the outset.
What helps against this
How we list vendors- Compliance automation (GRC)
Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.