▲ Enforcement Tracker

3,788 GDPR enforcement decisions from 64 countries, updated daily.

Total fines · last 12 months

€202.5B

+18231% vs previous year

Decisions · last 12 months

612

51 per month avg

Largest · last 90 days

€200.0B

HDPA (Greece) · Greece

Most active authority

Italian Data Protection Authority (Garante)

114 decisions · Italy

Monthly fine totals · last 12 months

NovDecJanFebMarAprMayJunJulAugSepOct

Date ↓	Company / party	Authority	Articles	Fine
2026-11-17	AEPD fines DGT for unnecessary app data transmission to push notification provider	🇪🇸 AEPD (Spain)	Art. 51 Art. 5	—
2026-10-02	AEPD: RFEF requiring school certificate as additional residence proof may breach GDPR	🇪🇸 AEPD (Spain)	Art. 51 Art. 5	€100,000
2026-10-01	ANSPDCP (Romania) - TIP TOP FOOD INDUSTRY SRL	🇷🇴 ANSPDCP (Romania)	Art. 51 Art. 5 Art. 9	€26,236
2026-10-01	Italian DPA rules on video surveillance transparency at meteorological research institute	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 121 Art. 12	€10,000
2026-09-30	Italian DPA: Municipality of Aprilia unlawfully disclosed whistleblower data to employer	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 51 Art. 51	€5,000
2026-09-30	Icelandic DPA opens formal proceedings against Isavia over ANPR parking cameras at	🇮🇸 Persónuvernd (Island)	Art. 51 Art. 5 Art. 12 Art. 13	—
2026-09-29	Garante: Bologna University Hospital rightly refused erasure of recruitment ranking data	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 5 Art. 6 Art. 9	€30,000
2026-09-23	AEPD sanctions Vodafone España for inadequate Super WiFi processor agreement and oversight	🇪🇸 AEPD (Spain)	Art. 51 Art. 5 Art. 28 Art. 32	€750,000
2026-09-23	Italian DPA: employer breached Art. 15 GDPR by ignoring access request over disciplinary	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 12 Art. 13 Art. 15	€39,000
2026-09-23	Persónuvernd: Icelandic Farmers’ Association breached GDPR by disclosing owner data to	🇮🇸 Persónuvernd (Iceland)	Art. 51 Art. 5 Art. 14	—
2026-09-22	IMY fines Miljödata SEK for Article 32 GDPR violation after ransomware breach of 2.2M	🇸🇪 IMY (Sweden)	Art. 321 Art. 32	€1,800,000
2026-09-21	Google Ireland Limited Insufficient legal basis for data processing	🇮🇪 Data Protection Commission (DPC)	Art. 5 Art. 6 Art. 12 Art. 13	€403,000,000
2026-09-17	Commissioner (Cyprus) - Online Platform “Agora”	🇨🇾 Commissioner (Cyprus)	Art. 31 Art. 35 Art. 36 Art. 582	€6,000
2026-09-17	Icelandic DPA: City of Reykjavik cannot request bank statements from NPA disabled service	🇮🇸 Persónuvernd (Iceland)	Art. 51 Art. 5 Art. 61 Art. 6	—
2026-09-16	Garante fines BBVA Italy for ignoring in-app objection, violating Arts. 5, 12, 21 GDPR	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 12 Art. 21	€5,508,000
2026-09-16	AEPD sanctions Iberdrola Clientes for improper identity verification and unauthorized	🇪🇸 AEPD (Spain)	Art. 24 Art. 32 Art. 321 Art. 582	€1,000,000
2026-09-16	ANSPDCP (Romania) - Fine against Homelux SRL	🇷🇴 ANSPDCP (Romania)	Art. 321 Art. 32 Art. 322	€108,570
2026-09-16	Italian DPA probes University Health Agency Friuli over EHR access and missing logs	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 51 Art. 51	€24,000
2026-09-16	AEPD fines El Español for publishing video of minor assailant without anonymization	🇪🇸 AEPD (Spain)	Art. 51 Art. 5 Art. 52 Art. 25	€20,000
2026-09-16	AEPD fines MÁS SOL ENERGÍA for marketing call to Robinson List subscriber	🇪🇸 AEPD (Spain)	Art. 411 Art. 4 Art. 52 Art. 5	€10,000
2026-09-16	Italian DPA: pool locker surveillance lawful but retention must be 12/24 hours	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 51 Art. 61	€8,000
2026-09-16	Italian DPA: Municipality of Rieti breached GDPR by publishing 31,000 taxpayers' waste	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 51 Art. 51	€6,000
2026-09-16	AEPD fines DIGI Telecom for issuing duplicate SIM to impersonator without consent	🇪🇸 AEPD (Spain)	Art. 52 Art. 5 Art. 61 Art. 6	€140
2026-09-16	Italian DPA sanctions Experian Italia for incomplete Art. 15 GDPR access responses on	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 51 Art. 12	€120
2026-09-16	Austrian DSB reprimands editor for failing to redact accused's name in social media posts	🇦🇹 DSB (Austria)	Art. 51 Art. 5 Art. 85 Art. 10	—

1–25 of 3,788 next →