Spanish DPA fines Securitas Direct €100,000 for charging phone line for data subject rights
The enforcement underscores that charging fees for exercising GDPR data subject rights is prohibited.
ADTP Regulatory Watch· September 22, 2026· Spanish Data Protection Agency (AEPD)
ImpactModerate 59
Type💰 Fine
Statusdecidedcase outcome
JurisdictionEU-ES
Effective1 February 2023
Comply by1 February 2024
What happened
The Spanish Data Protection Agency (AEPD) issued a final decision on 1 February 2023 finding Securitas Direct in breach of GDPR Article 12(2) by directing data subjects to a chargeable 902 telephone number to exercise their rights. The agency imposed a fine of 100 000 EUR and ordered the company to replace the notices within 12 months. The decision confirms that data subject rights must be exercisable free of charge.
Penalty
imposed a fine of 100 000 EUR on Securitas Direct
Why it matters for trust and compliance
Its status is decided. The case has an outcome that others may cite.
The enforcement underscores that charging fees for exercising GDPR data subject rights is prohibited.
Takes effect February 1, 2023.
Compliance deadline February 1, 2024.
Penalty: imposed a fine of 100 000 EUR on Securitas Direct.
It relates to GDPR. The regulations library explains what that law requires.
Who is affected
technologycontrollerSecuritas Direct
Recommended actions
Check that privacy notices describe the practices this addresses.
Confirm access, correction, deletion and opt-out requests are handled within the required time.