GDPR enforcement in 2025
723 decisions · €1.2B total fines · ← 2024 · 2026 →
| Date ↓ | Company / party | Authority | Articles | Fine |
|---|---|---|---|---|
| 2025-09-04 | Company Insufficient fulfilment of data breach notification obligations | 🇪🇺 Austrian Data Protection Authority (dsb) | Art. 33 | €870 |
| 2025-09-04 | Company Insufficient fulfilment of data breach notification obligations | 🇪🇺 Austrian Data Protection Authority (dsb) | Art. 33 | €870 |
| 2025-09-02 | ILVA A/S Non-compliance with general data processing principles | 🇪🇺 Danish Data Protection Authority (Datatilsynet) | €200,900 | |
| 2025-09-02 | ILVA A/S Non-compliance with general data processing principles | 🇪🇺 Danish Data Protection Authority (Datatilsynet) | €200,900 | |
| 2025-09-01 | GOOGLE LLC Insufficient legal basis for data processing | 🇪🇺 French Data Protection Authority (CNIL) | Art. 82 | €200,000,000 |
| 2025-09-01 | GOOGLE LLC Insufficient legal basis for data processing | 🇪🇺 French Data Protection Authority (CNIL) | Art. 82 | €200,000,000 |
| 2025-09-01 | INFINITE STYLES SERVICES CO. LIMITED Insufficient legal basis for data processing | 🇪🇺 French Data Protection Authority (CNIL) | Art. 82 | €150,000,000 |
| 2025-09-01 | INFINITE STYLES SERVICES CO. LIMITED Insufficient legal basis for data processing | 🇪🇺 French Data Protection Authority (CNIL) | Art. 82 | €150,000,000 |
| 2025-09-01 | GOOGLE IRELAND LIMITED Insufficient legal basis for data processing | 🇪🇺 French Data Protection Authority (CNIL) | Art. 82 | €125,000,000 |
| 2025-09-01 | GOOGLE IRELAND LIMITED Insufficient legal basis for data processing | 🇪🇺 French Data Protection Authority (CNIL) | Art. 82 | €125,000,000 |
| 2025-09-01 | La Fântâna S.R.L. Insufficient technical and organisational measures to ensure information security | 🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) | Art. 32 | €10,000 |
| 2025-09-01 | La Fântâna S.R.L. Insufficient technical and organisational measures to ensure information security | 🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) | Art. 32 | €10,000 |
| 2025-09-01 | Primary School Insufficient legal basis for data processing | 🇭🇷 Croatian Data Protection Authority (azop) | Art. 5Art. 6 | €2,000 |
| 2025-09-01 | Company Insufficient legal basis for data processing | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 6 | €1,200 |
| 2025-09-01 | Company Insufficient legal basis for data processing | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 6 | €1,200 |
| 2025-08-31 | GESTIÓN DE VENTAS IBERIA S.L. Insufficient fulfilment of data subjects rights | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 14 | €2,000 |
| 2025-08-31 | GESTIÓN DE VENTAS IBERIA S.L. Insufficient fulfilment of data subjects rights | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 14 | €2,000 |
| 2025-08-29 | KVIKU SPAIN, S.L. Insufficient legal basis for data processing | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 6 | €2,400 |
| 2025-08-29 | KVIKU SPAIN, S.L. Insufficient legal basis for data processing | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 6 | €2,400 |
| 2025-08-29 | GOHIPOTECA, S.L. Insufficient legal basis for data processing | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 6 | €1,200 |
| 2025-08-29 | GOHIPOTECA, S.L. Insufficient legal basis for data processing | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 6 | €1,200 |
| 2025-08-26 | ING Bank Śląski Insufficient legal basis for data processing | 🇪🇺 Polish National Personal Data Protection Office (UODO) | Art. 5Art. 6 | €4,323,250 |
| 2025-08-26 | ING Bank Śląski Insufficient legal basis for data processing | 🇪🇺 Polish National Personal Data Protection Office (UODO) | Art. 5Art. 6 | €4,323,250 |
| 2025-08-26 | Driving School Insufficient fulfilment of information obligations | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 13 | €300 |
| 2025-08-26 | Driving School Insufficient fulfilment of information obligations | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 13 | €300 |