Complaints to the Spanish data protection agency are at an all-time high: up 64% in 2025

Greater awareness of users' rights and their ability to demand accountability, along with the use of artificial intelligence (AI) to draft complaints, are the main drivers behind this increase. The six areas of activity with the highest number of sanctioning cases and the issuance of warnings are video surveillance, internet services, personal data breaches, public administrations, business, transport and hospitality and, lastly, healthcare.

"Complaints are becoming increasingly complex because they involve new technological phenomena and growing threats to privacy, as well as cross-border procedures that must be carried out in coordination with European authorities," explained AEPD president, Lorenzo Cotino.

Breaches in personal data are one of the agency's biggest concerns, not so much because of their number relative to the total, but because of their severity. In this area, sanctioning procedures have risen by 157 per cent, from 30 to 77, resulting in fines amounting to 20 million euros. That's 40 per cent of total fines imposed by the AEPD (48 million euros). Two-thirds of the sanctioned cases are concentrated in three categories: internet services, business, also transport and hospitality. In addition to these are the security breaches.

Another pillar of the agency is the 'priority channel', where people can request the urgent removal of sexual or violent content published online if permission was not granted by the person(s) appearing in said content. This branch of the agency received 49 requests in 2025. Of these, 82 per cent of the requested content removals were actioned. "When we receive a complaint via this expedited mechanism, we send a request to the platform in question, which usually removes the content within 24-48 hours or, if it disagrees, it can then present its counter-argument," explained Francisco Pérez Bes, AEPD's deputy director .

Cotino, for his part, stressed the importance of the agency having more budgetary resources and more staff to address technological risks effectively. "We're not asking for more resources just for the sake of it. There are new threats and we need to increase our oversight."

As for AI, the AEPD director stated that the agency is receiving complaints about the widespread use of this new technology, "but fewer than expected". "We will initiate investigations where artificial intelligence is not complying with regulations."