GDPR enforcement in 2026

402 decisions · €202.4B total fines · ← 2025

Date ↓	Company / party	Authority	Articles	Fine
2026-09-16	AEPD fines DIGI Telecom for issuing duplicate SIM to impersonator without consent	🇪🇸 AEPD (Spain)	Art. 52 Art. 5 Art. 61 Art. 6	€140
2026-09-16	Italian DPA sanctions Experian Italia for incomplete Art. 15 GDPR access responses on	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 51 Art. 12	€120
2026-09-15	ANSPDCP (Romania) - Fine against Dormeo Home S.R.L	🇷🇴 ANSPDCP (Romania)	Art. 21	€10,517
2026-09-15	APDCAT: Public body violated GDPR by disclosing audio recording to four extra recipients	🇪🇸 APDCAT (Catalonia)	Art. 51 Art. 5 Art. 6 Art. 12	€3,150
2026-09-15	AEPD: Data subject entitled to identity of professionals who accessed medical records	🇪🇸 AEPD (Spain)	Art. 51 Art. 5 Art. 52 Art. 12	—
2026-09-15	HDPA investigates Greek Infrastructure Ministry for SMS sent without consent or	🇬🇷 HDPA (Greece)	Art. 51 Art. 5 Art. 14	—
2026-09-10	AEPD: CaixaBank requested excessive inheritance documentation from heirs	🇪🇸 AEPD (Spain)	Art. 13 Art. 25 Art. 30	€408,000
2026-09-10	Italian DPA sanctions Top Secret Investigazioni for unjustified email forwarding after	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 51 Art. 51	€6,500
2026-09-09	Italian DPA finds Ministry of Education's disclosure of disciplinary dismissal excessive	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 61 Art. 6	€10,000
2026-09-08	ANSPDCP (Romania) - Fine against GEROCOSSEN S.R.L.	🇷🇴 ANSPDCP (Romania)	Art. 321 Art. 32 Art. 322	€26,236
2026-09-08	Garante per la protezione dei dati personali (Italy) - 551/2026	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 5 Art. 6 Art. 9	€10,000
2026-09-08	AEPD (Spain) - ps-00256-2025	🇪🇸 AEPD (Spain)	Art. 61 Art. 6	€2,000
2026-09-08	AEPD (Spain) - ps-0035-2025	🇪🇸 AEPD (Spain)	Art. 51 Art. 5	€160
2026-09-08	IP Slovenia: Controller breached Art. 15(1)(d) and 15(3) GDPR by denying storage info and	🇸🇮 IP (Slovenia)	Art. 12 Art. 151 Art. 15 Art. 153	—
2026-09-08	Garante warns ReLife Recycling for failing to timely respond to GDPR access request	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 123 Art. 12 Art. 124	—
2026-09-04	Finnish DPA orders Espoo to ensure pupil data protection in Google learning tools	🇫🇮 Tietosuojavaltuutetun toimisto (Finland)	Art. 61 Art. 6	—
2026-09-03	Banco Bilbao Vizcaya Argentaria S.A. Insufficient fulfilment of data subjects rights	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 12 Art. 21 Art. 24	€5,508,000
2026-09-03	Friuli Centrale University Health Authority Insufficient technical and organisational measures to ensure information security	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 9 Art. 25 Art. 32	€24,000
2026-09-03	Azienda Speciale per la Gestione degli Impianti Sportivi del Comune di Trento Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 12 Art. 13	€8,000
2026-09-02	Datatilsynet (Denmark) - 09-07-2026 (Lyngby Boldklub)	🇩🇰 Datatilsynet (Denmark)	Art. 91 Art. 9 Art. 92 Art. 35	—
2026-09-02	AEPD: Canals City Council breached Art. 5(1)(f) GDPR by discarding exam papers unshredded	🇪🇸 AEPD (Spain)	Art. 51 Art. 5	—
2026-09-02	Datatilsynet authorises AC Horsens facial recognition at matches under conditions	🇩🇰 Datatilsynet (Denmark)	Art. 91 Art. 9 Art. 92 Art. 35	—
2026-09-01	UODO fines controller PLN 31,507 for failing to provide information under Art. 58(1) GDPR	🇵🇱 UODO (Poland)	Art. 58	€7,200
2026-09-01	Slovenian DPA fines controller €5,320 for leaving employee personal data documents	🇸🇮 IP (Slovenia)	Art. 51 Art. 5 Art. 32	€5,320
2026-09-01	Datatilsynet (Denmark) - 09-07-2026 (Lyngby Boldklub)	🇩🇰 Datatilsynet (Denmark)	Art. 91 Art. 9 Art. 92 Art. 35	—

← previous 26–50 of 402 next →