Notification / complaint to the AEPD (Spanish data protection authority) over a personal data breach (GDPR art. 33)
Notification / complaint to the AEPD (Spanish data protection authority) over a personal data breach (GDPR art. 33) is filed with Sede Electrónica AEPD, Notificación de brechas. With Managora you do it 100% online: you answer a few questions, sign a digital mandato (power of representation) and we draft, sign and file your application for you. What we charge you: €250. Official tasa (government fee): No tasa (official fee).
We draft the notification of a personal data breach to the AEPD (Spanish data protection authority) without undue delay and, where feasible, within 72 hours (art. 33.1 GDPR). We check the categories of data affected (special-category data under art. 9, health, financial, children's data, biometric data, login credentials), the number of data subjects, the deadline and the reasons for any delay. We assess whether the breach must also be communicated to the data subjects (art. 34) and the risk of penalties under art. 83.4 GDPR: up to 10 M€ or 2 % of total worldwide annual turnover, whichever is higher.
Practical guide: Data protection: GDPR rights and claiming before the AEPD. Requirements, deadlines and the steps, explained.
- What we charge you
- €250
- Managora's fee
- €250.00 (21% VAT incl.)
- Tasa (official government fee)
- No tasa (official fee).
- Processing time
- Without undue delay and, where feasible, no later than 72 hours after becoming aware of the breach (art. 33.1 GDPR). The 72 hours are the ceiling, not the ordinary deadline. If that is exceeded, you notify anyway, stating the reasons for the delay. Notification is not required where the breach is unlikely to result in a risk, but every breach must still be documented (art. 33.5).
- Where it is filed
- Sede Electrónica AEPD, Notificación de brechas ↗
- What you receive
- Papeleta (official claim form) / written submission
Cost breakdown: Our fee €250.00 (21% VAT incl.), with no tasa (official fee) for notifying the data breach to the AEPD..
Notification / complaint to the AEPD (Spanish data protection authority) over a personal data breach (GDPR art. 33): how is it filed?
- 1Answer the questions in the chat (around 7 minutes).
- 2We check the 72-hour deadline and the categories of data affected.
- 3We determine whether the data subjects must also be notified.
- 4Payment of €250.00 (21% VAT incl.) for the advice and drafting.
- 5We hand you the notification ready for the AEPD online portal.
Which documents do you need?
- •DNI (Spanish national identity document), NIE (foreigner identity number) or CIF (company tax ID).
- •Documentation on the information system affected.
- •Logs / technical evidence.
- •Internal communication from the Data Protection Officer.
- •Template for notifying the data subjects (if applicable).
Legal basis and things to bear in mind
- Legal framework: arts. 33 and 34 GDPR, and arts. 73 and 74 of LO 3/2018 (LOPDGDD), which are what classify the infringements in Spain.
- Who notifies: the controller, to the AEPD. If you process data on behalf of another company you are a PROCESSOR, and your duty is a different one: to alert the controller without undue delay, with no 72-hour margin (art. 33.2 GDPR).
- Deadline to notify the AEPD: without undue delay and, where feasible, no later than 72 hours after becoming aware. The 72 hours are the ceiling, not the ordinary deadline.
- Communication to the data subjects: mandatory without undue delay where the breach is likely to result in a HIGH risk to them (art. 34.1). It falls away only if the data were protected so as to be unintelligible, for instance by encryption (art. 34.3.a), or if measures have since been taken that eliminate that high risk (art. 34.3.b). The third case does NOT exempt you: where individual communication would involve disproportionate effort, it must be replaced by a public communication or similar measure that is equally effective (art. 34.3.c). And the AEPD may require the communication even where the controller has not made it (art. 34.4).
- Penalties: breaching the notification duties of arts. 33 and 34 falls under art. 83.4.a) GDPR, which covers arts. 8, 11, 25 to 39, 42 and 43: up to 10 M€ or 2 % of total worldwide annual turnover of the preceding financial year, whichever is higher. Do not stop there: if the breach reveals that security measures were lacking, it may also engage the integrity and confidentiality principle of art. 5.1.f), which does sit in art. 83.5 (20 M€ or 4 %). And ignoring an AEPD order, such as the requirement under art. 34.4, falls under art. 83.6, likewise 20 M€ or 4 %.
- Classification in Spain (LO 3/2018): failing to notify the AEPD is SERIOUS and time-barred after two years (art. 73.r). Notifying late, incompletely or defectively is MINOR and time-barred after one year (art. 74.m). Failing to document a breach is MINOR in its own right (art. 74.n). Failing to communicate it to the data subject is MINOR (art. 74.ñ), unless the AEPD had already required it, in which case it is SERIOUS (art. 73.s). The order matters: being late costs you, staying silent costs more, and ignoring the Agency is what drives the amount up.
- A third bill, the one with no ceiling: besides the fine, any affected person may claim compensation for material and non-material damage (art. 82.1 GDPR), with no need for the AEPD to open proceedings. And where a controller and a processor were involved in the same operation, each may be held liable for the entire damage (art. 82.4).
- Natural companion procedures: reclamacion_aepd, denuncia_inspeccion_trabajo (if employment data are involved).
Notification / complaint to the AEPD (Spanish data protection authority) over a personal data breach (GDPR art. 33): frequently asked questions
Notification / complaint to the AEPD (Spanish data protection authority) over a personal data breach (GDPR art. 33): how much does it cost?
We charge you €250: our fee plus, where applicable, the fixed official tasa we advance. Our fee €250.00 (21% VAT incl.), with no tasa (official fee) for notifying the data breach to the AEPD.. Managora's fee is €250.00, 21% VAT included (€206.61 net + €43.39 VAT). The official tasa charged by the authority (a suplido paid on your behalf, no VAT) is: No tasa (official fee)..
Notification / complaint to the AEPD (Spanish data protection authority) over a personal data breach (GDPR art. 33): how long does it take?
Without undue delay and, where feasible, no later than 72 hours after becoming aware of the breach (art. 33.1 GDPR). The 72 hours are the ceiling, not the ordinary deadline. If that is exceeded, you notify anyway, stating the reasons for the delay. Notification is not required where the breach is unlikely to result in a risk, but every breach must still be documented (art. 33.5).
Notification / complaint to the AEPD (Spanish data protection authority) over a personal data breach (GDPR art. 33): which documents do I need?
You need to have to hand: DNI (Spanish national identity document), NIE (foreigner identity number) or CIF (company tax ID)., Documentation on the information system affected., Logs / technical evidence., Internal communication from the Data Protection Officer., Template for notifying the data subjects (if applicable).. You do not upload them here: we collect the details through the guided chat.
Who files the procedure?
Managora files it in your name with Sede Electrónica AEPD, Notificación de brechas. You only provide the details through the chat and sign a mandato (power of representation); we prepare, sign and register it.
Can it be done online?
Yes. The whole process is online: you answer a few questions in the guided chat, sign a simple mandato on screen and receive the receipt and the official documents by email, with full legal validity.
Related procedures
Based on the legislation in force and on the official site of the competent authority: Sede Electrónica AEPD, Notificación de brechas ↗.
Managora Gestion SL (company number B88823893) is a private company. We are not Sede Electrónica AEPD, Notificación de brechas, we are not affiliated with, authorised or endorsed by any public authority, and this website is not an official government portal. What you pay on this page is our fee for preparing, signing and filing the procedure on your behalf: it is separate from the official tasa, which where applicable belongs to the authority and is shown to you separately. You can carry out this procedure yourself, directly with Sede Electrónica AEPD, Notificación de brechas.
Shall we get started with «Notification / complaint to the AEPD (Spanish data protection authority) over a personal data breach (GDPR art. 33)»?
We file it for you, from start to finish.
Start now →