GDPR enforcement in 2026

230 decisions · €310.0M total fines · ← 2025

Date ↓	Company / party	Authority	Articles	Fine
2026-08-13	AEPD (Spain) - ps-00148-2025	🇪🇸 AEPD (Spain)	Art. 61 Art. 6	€200,000
2026-08-12	AEPD (Spain) - PS/00249/2025	🇪🇸 AEPD (Spain)	Art. 411 Art. 4 Art. 52 Art. 5	€10,000
2026-08-11	ANSPDCP (Romania) - Fine against Homelux SRL	🇷🇴 ANSPDCP (Romania)	Art. 321 Art. 32 Art. 322	€108,570
2026-08-11	Slovenian DPA fines controller €1,282 for missing Art. 28(3) processor contract	🇸🇮 IP (Slovenia)	Art. 283 Art. 28	€1,282
2026-08-03	AZOP (Croatia) - Decision 08-03-2022 (energy company)	🇭🇷 AZOP (Croatia)	Art. 153 Art. 15	€940,000
2026-07-29	ANSPDCP (Romania) - Fine against Orange Romania SA of July 17, 2026	🇷🇴 ANSPDCP (Romania)	Art. 251 Art. 25 Art. 321 Art. 32	€523,900
2026-07-27	AEPD fines El Español for disclosing minor's identity in assault video	🇪🇸 AEPD (Spain)	Art. 51 Art. 5 Art. 52 Art. 25	€20,000
2026-07-24	AEPD (Spain) - PS/00421/2020	🇪🇸 AEPD (Spain)	Art. 21	€5,000
2026-07-24	HDPA (Greece) 33/2020 — Employee's access and erasure claims against the American College	🇬🇷 HDPA (Greece)	Art. 47 Art. 4 Art. 5 Art. 12	€2,000
2026-07-24	ANSPDCP (Romania) - Fine against There's an AI for that S.R.L	🇷🇴 ANSPDCP (Romania)	Art. 4	€30
2026-07-24	HmbBfDI (Hamburg) - Einstellung Gerichtsverfahren in Sachen Videmo 360	🇩🇪 HmbBfDI (Hamburg)		—
2026-07-22	NAIH fines online store HUF 2M for unclear and incomplete privacy notice	🇭🇺 NAIH (Hungary)	Art. 121 Art. 12 Art. 131 Art. 13	€2,000,000
2026-07-22	Tietosuojavaltuutetun toimisto (Finland) - TSV/4630/2023	🇫🇮 Tietosuojavaltuutetun toimisto (Finland)	Art. 51 Art. 5 Art. 122 Art. 12	—
2026-07-21	AEPD sanctions ACVIL Aparcamientos for denying access to parking surveillance footage	🇪🇸 AEPD (Spain)	Art. 14 Art. 15	€90,000
2026-07-20	Italian DPA: Justice Ministry unlawful disclosure of employee health data in service order	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 49 Art. 4 Art. 410 Art. 415	€12,000
2026-07-18	Italian DPA: Enna Health Authority violated GDPR by publishing judicial data	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 5 Art. 51 Art. 51 Art. 6	€20,000
2026-07-17	CNIL fines energy supplier for mishandling data subject access and objection requests	🇫🇷 CNIL (France)	Art. 12 Art. 14 Art. 15 Art. 21	€1,000,000
2026-07-17	AEPD: No fine for surveillance cameras facing public road; no evidence of rights	🇪🇸 AEPD (Spain)	Art. 51 Art. 5 Art. 12 Art. 15	—
2026-07-17	BfDI: Legal uncertainty in German telecom data protection law (TKG/TMG) requires urgent	🇩🇪 BfDI (Germany)		—
2026-07-17	APDCAT sanctions Madremanya City Council for exposing applicants' sensitive data in tender	🇪🇸 APDCAT (Catalonia)	Art. 51 Art. 5 Art. 51 Art. 31	—
2026-07-16	AEPD fines Alkora, S.A. for ransomware breach exposing 40,000 individuals' data	🇪🇸 AEPD (Spain)	Art. 51 Art. 5 Art. 35 Art. 582	€200,000
2026-07-16	Italian Garante sanctions Calabrian agency for location tracking of remote workers	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 51 Art. 51	€50,000
2026-07-16	Italian Garante: OPI of Pisa must remove residential addresses from public register	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 1 Art. 51 Art. 5 Art. 51	€16,000
2026-07-16	AEPD investigates University of Navarra over student COVID-19 vaccination status requests	🇪🇸 AEPD (Spain)	Art. 415 Art. 4 Art. 51 Art. 5	—
2026-07-15	AEPD (Spain) - E/03783/2020	🇪🇸 AEPD (Spain)	Art. 2	—

1–25 of 230 next →