Consequences of Non-Compliance

Key Concept 6 — Consequences of Non-Compliance

Fines are only one of the risks — trust is often the bigger loss.

Most enforcement cases start with something avoidable: a security gap, a missing legal basis, an unanswered request from a customer or a complaint from an employee.

Typical consequences

Fines by the data protection authority, often based on turnover or on a fixed unit
Orders from authorities: stop a processing activity, delete data, change a system — which can halt a business process overnight
Claims for damages by the affected people, in some countries also through class actions or consumer associations
Loss of trust of customers, employees and business partners, and negative press
Business impact: lost tenders, failed due diligence and stricter requirements from customers
Personal liability of managers and employees under some laws

Sanctions in your jurisdiction

Spain

Supervisory authority: Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD)

Fines of up to €20 million or 4% of worldwide annual turnover, whichever is higher
Orders by the authority, e.g. to stop or change a processing activity
Claims for material and non-material damages (Art. 82 GDPR)