GDPR enforcement in 2026

156 decisions · €267.1M total fines · ← 2025

Date ↓	Company / party	Authority	Articles	Fine
2026-06-12	Națională Poșta Română Insufficient technical and organisational measures to ensure information security	🇷🇴 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 32	€5,000
2026-06-02	Minister of Justice Insufficient technical and organisational measures to ensure information security	🇵🇱 Polish National Personal Data Protection Office (UODO)	Art. 32	€23,540
2026-06-01	Elkjøp AS Insufficient legal basis for data processing	🇳🇴 Norwegian Supervisory Authority (Datatilsynet)	Art. 5 Art. 6 Art. 12	€1,820,000
2026-05-29	Blikk Kft. Insufficient legal basis for data processing	🇭🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)	Art. 6 Art. 9 Art. 12	€70,300
2026-05-29	Unicredit Bank SA Insufficient technical and organisational measures to ensure information security	🇷🇴 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 32 Art. 33	€12,000
2026-05-26	IQVIA OPERATIONS FRANCE Non-compliance with general data processing principles	🇫🇷 French Data Protection Authority (CNIL)	Art. 14 Art. 25	€5,000,000
2026-05-26	Mediaworks Hungary Zrt. Insufficient legal basis for data processing	🇭🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)	Art. 6 Art. 9	€140,500
2026-05-20	Elektronikus Egészségügyi Szolgáltatási Tér Insufficient technical and organisational measures to ensure information security	🇭🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)	Art. 5 Art. 6 Art. 9	€1,400
2026-05-12	Technology Company Insufficient legal basis for data processing	🇧🇪 Belgian Data Protection Authority (APD)	Art. 5 Art. 6 Art. 12 Art. 13	€177,000
2026-05-12	Isabel SA Insufficient fulfilment of data subjects rights	🇧🇪 Belgian Data Protection Authority (APD)	Art. 5 Art. 12 Art. 13 Art. 15	€120,000
2026-05-12	Société Wallonne des Eaux Insufficient legal basis for data processing	🇧🇪 Belgian Data Protection Authority (APD)	Art. 5 Art. 12 Art. 13 Art. 28	€86,000
2026-05-08	Permanent TSB Insufficient technical and organisational measures to ensure information security	🇮🇪 Data Protection Authority of Ireland	Art. 5 Art. 32 Art. 33	€277,500
2026-05-08	Law Firm Insufficient fulfilment of data subjects rights	🇧🇪 Belgian Data Protection Authority (APD)	Art. 5 Art. 12 Art. 13 Art. 14	€4,920
2026-05-07	South Staffordshire Plc Insufficient technical and organisational measures to ensure information security	🇬🇧 Information Commissioner (ICO)	Art. 5 Art. 32	€1,112,100
2026-04-30	BLUE PROJECTS INDUSTRIES S.R.L. Insufficient technical and organisational measures to ensure information security	🇷🇴 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 32	€2,500
2026-04-28	Crowd Entertainment Ltd Insufficient legal basis for data processing	🇷🇴 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 5	€35,000
2026-04-28	GATIGOS, S.L. Insufficient cooperation with supervisory authority	🇪🇸 Spanish Data Protection Authority (aepd)	Art. 58	€6,000
2026-04-28	SIPHONE 2020, S.L. Insufficient legal basis for data processing	🇪🇸 Spanish Data Protection Authority (aepd)	Art. 6 Art. 13	€4,000
2026-04-28	RESIDENCIAL ETXE-LAN, S.L. Insufficient cooperation with supervisory authority	🇪🇸 Spanish Data Protection Authority (aepd)	Art. 58	€1,800
2026-04-28	Non-Profit Foundation Insufficient cooperation with supervisory authority	🇧🇪 Belgian Data Protection Authority (APD)	Art. 31	€1,000
2026-04-28	Posada del León de Oro Non-compliance with general data processing principles	🇪🇸 Spanish Data Protection Authority (aepd)	Art. 5 Art. 13	€240
2026-04-23	Accountancy Firm Insufficient legal basis for data processing	🇧🇪 Belgian Data Protection Authority (APD)	Art. 5 Art. 6 Art. 12 Art. 17	€8,500
2026-04-22	KONECTA BTO, S.L. Insufficient technical and organisational measures to ensure information security	🇪🇸 Spanish Data Protection Authority (aepd)	Art. 5	€300,000
2026-04-17	Poste Italiane S.p.a. Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 13 Art. 25	€6,624,000
2026-04-17	Postepay S.p.a. Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 13 Art. 25	€5,877,000

1–25 of 156 next →