Complaints and claims for privacy breaches increase by 123% since 2022

The Catalan Data Protection Authority (APDCAT) has registered 1,374 complaints and claims in 2025, 21% more than in 2024. The figures show that the upward trend of recent years is maintained, and since 2022 the increase has been 123%. These are complaints and claims related to violations of data protection regulations in entities included within the scope of competence of the APDCAT. This increase reflects that citizens are more aware of aspects related to the protection of their data and, also, that they know their rights better in this matter. All this, the result of the dissemination campaigns carried out and also due to the work carried out by the APDCAT in particular.

The Catalan Data Protection Authority has registered 1,374 complaints and claims for non-compliance with data protection in public and private bodies that perform public functions in 2025, 21% more than in 2024, and has imposed 126 sanctions, including declarations of infringements and fines.

The total number of cases investigated and investigated by the APDCAT during 2025 was 837 (471 complaints and 366 claims for protection of rights), once those that were transferred to the Spanish Data Protection Agency were excluded because it was the competent authority. This represents a 31% increase compared to 2024. Specifically, the number of complaints that the APDCAT investigated in 2025 (471) represents a 16% increase compared to the previous year, and a 144% increase compared to 2022. Meanwhile, the number of claims for protection of rights that have been processed has increased compared to the previous year by 58%, and compared to 2022, by 197%.

Regarding the number of sanctioning procedures initiated, in 2025 it reaches 138, 23 more than the previous year. Likewise, the increase in the number of resolutions that have ended sanctioning procedures is noteworthy, which have been 126 in 2025, compared to 112 in 2024. Of the 126 resolutions, in 110 it was concluded that at least one infringement typified by data protection regulations had been committed, while in four cases the dismissal or expiration was declared.

Of these 126 resolutions, 110 correspond to processing carried out by public entities, where a financial penalty is not imposed, but a declaration of the infringement, in accordance with current regulations. In these procedures, in addition to the declaration of an infringement, in some cases measures are required to correct the effects of the infringement (art. 21.2 Law 32/2010)

The remaining 12 sanctioning resolutions refer to processing carried out by privately owned entities and in all cases entailed financial sanctions, as well as corrective measures, if necessary.

Fines worth more than 409,000 euros

The total amount of fines imposed reaches 409,352 euros in 2025. At the time of writing the APDCAT report, 10 of the 12 sanctioned entities have paid the financial penalty imposed.

At the time of writing the report, 3 sanctioned entities have filed a contentious administrative appeal.

The majority of sanctioning procedures resolved this 2025 in which it is determined that at least one infringement has been committed are against city councils and related entities. They are followed by sanctioning procedures resolved against the Administration of the Generalitat and its related entities, private law entities, consortia, universities, public law corporations, and provincial councils. The areas of human resources, the exercise of administrative powers, health, internet/social networks, education, and the provision of services to citizens, among others, stand out.