Spain

EXCEL HOTELS & RESORTS, S.A.

32,000 €

GDPR enforcement action by Spanish Data Protection Authority (aepd) on 2025-12-20.

Rank · Sector

#15

of 100 in Accomodation and Hospitality

Rank · Spain

#293

of 1,075

Rank · All fines

#876

of 3,050

Case details

Authority: Spanish Data Protection Authority (aepd)
Date: 2025-12-20
Controller / Processor: EXCEL HOTELS & RESORTS, S.A.
Sector: Accomodation and Hospitality
Quoted Articles: Art. 5 (1) f) GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Spanish DPA has imposed a fine of EUR 32,000 on EXCEL HOTELS & RESORTS, S.A. The controller used guards to control access to its facility. The guards regularly left documents containing personal data in their post, making them accessible to third parties. The original fine of EUR 40,000 was reduced to EUR 32,000 due to immediate payment.

Open original source Links to the regulator's original publication or another source.