GDPR enforcement in 2026

402 decisions · €202.4B total fines · ← 2025

Date ↓	Company / party	Authority	Articles	Fine
2026-10-05	Tietosuojavaltuutetun toimisto (Finland) - TSV/5059/2023	🇫🇮 Office of the Data Protection Ombudsman		—
2026-10-05	HDPA (Greece) - 7/2026	🇬🇷 Hellenic Data Protection Authority		—
2026-10-02	DSB (Austria) - 2025-0.626.844	🇦🇹 Datenschutzbehörde		—
2026-10-02	AEPD (Spain) - PS/00339/2024	🇪🇸 Agencia Española de Protección de Datos		—
2026-10-01	AEPD (Spain) - ps-00287-2025	🇪🇸 Agencia Española de Protección de Datos		—
2026-10-01	AKI (Estonia) - 2.1.-4/26/1106-2333-4	🇪🇪 Andmekaitse Inspektsioon		—
2026-10-01	Garante per la protezione dei dati personali (Italy) - 10297167	🇮🇹 Garante per la protezione dei dati personali		—
2026-10-01	DSB (Austria) - 2026-0.690.562	🇦🇹 Datenschutzbehörde	Art. 5	—
2026-09-30	Italian DPA: Municipality of Aprilia unlawfully disclosed whistleblower data to employer	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 51 Art. 51	€5,000
2026-09-30	Icelandic DPA opens formal proceedings against Isavia over ANPR parking cameras at	🇮🇸 Persónuvernd (Island)	Art. 51 Art. 5 Art. 12 Art. 13	—
2026-09-29	Garante: Bologna University Hospital rightly refused erasure of recruitment ranking data	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 5 Art. 6 Art. 9	€30,000
2026-09-23	AEPD sanctions Vodafone España for inadequate Super WiFi processor agreement and oversight	🇪🇸 AEPD (Spain)	Art. 51 Art. 5 Art. 28 Art. 32	€750,000
2026-09-23	Italian DPA: employer breached Art. 15 GDPR by ignoring access request over disciplinary	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 12 Art. 13 Art. 15	€39,000
2026-09-23	Persónuvernd: Icelandic Farmers’ Association breached GDPR by disclosing owner data to	🇮🇸 Persónuvernd (Iceland)	Art. 51 Art. 5 Art. 14	—
2026-09-22	IMY fines Miljödata SEK for Article 32 GDPR violation after ransomware breach of 2.2M	🇸🇪 IMY (Sweden)	Art. 321 Art. 32	€1,800,000
2026-09-21	Google Ireland Limited Insufficient legal basis for data processing	🇮🇪 Data Protection Commission (DPC)	Art. 5 Art. 6 Art. 12 Art. 13	€403,000,000
2026-09-17	Icelandic DPA: City of Reykjavik cannot request bank statements from NPA disabled service	🇮🇸 Persónuvernd (Iceland)	Art. 51 Art. 5 Art. 61 Art. 6	—
2026-09-16	Garante fines BBVA Italy for ignoring in-app objection, violating Arts. 5, 12, 21 GDPR	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 12 Art. 21	€5,508,000
2026-09-16	AEPD sanctions Iberdrola Clientes for improper identity verification and unauthorized	🇪🇸 AEPD (Spain)	Art. 24 Art. 32 Art. 321 Art. 582	€1,000,000
2026-09-16	ANSPDCP (Romania) - Fine against Homelux SRL	🇷🇴 ANSPDCP (Romania)	Art. 321 Art. 32 Art. 322	€108,570
2026-09-16	Italian DPA probes University Health Agency Friuli over EHR access and missing logs	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 51 Art. 51	€24,000
2026-09-16	AEPD fines El Español for publishing video of minor assailant without anonymization	🇪🇸 AEPD (Spain)	Art. 51 Art. 5 Art. 52 Art. 25	€20,000
2026-09-16	AEPD fines MÁS SOL ENERGÍA for marketing call to Robinson List subscriber	🇪🇸 AEPD (Spain)	Art. 411 Art. 4 Art. 52 Art. 5	€10,000
2026-09-16	Italian DPA: pool locker surveillance lawful but retention must be 12/24 hours	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 51 Art. 61	€8,000
2026-09-16	Italian DPA: Municipality of Rieti breached GDPR by publishing 31,000 taxpayers' waste	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 51 Art. 51	€6,000

1–25 of 402 next →