GDPR enforcement in 2026

230 decisions · €310.0M total fines · ← 2025

Date ↓	Company / party	Authority	Articles	Fine
2026-06-01	Elkjøp AS Insufficient legal basis for data processing	🇳🇴 Norwegian Supervisory Authority (Datatilsynet)	Art. 5 Art. 6 Art. 12	€1,820,000
2026-05-29	Blikk Kft. Insufficient legal basis for data processing	🇭🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)	Art. 6 Art. 9 Art. 12	€70,300
2026-05-29	Unicredit Bank SA Insufficient technical and organisational measures to ensure information security	🇷🇴 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 32 Art. 33	€12,000
2026-05-28	Italian DPA: AgID's automatic transfer of PEC addresses to INAD index unlawful	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 51 Art. 52	€55,000
2026-05-28	Italian DPA: vehicle tracking by Liguria Health Agency lawful, information duties met	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 51 Art. 51	€6,000
2026-05-28	Italian Garante: Red Cross violated Art. 9 GDPR by disclosing HIV status on meal tray	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 51 Art. 9	€700
2026-05-28	EDPB - Binding Decision 1/2026	🇪🇺 EDPB	Art. 424 Art. 4 Art. 571 Art. 57	—
2026-05-26	IQVIA OPERATIONS FRANCE Non-compliance with general data processing principles	🇫🇷 French Data Protection Authority (CNIL)	Art. 14 Art. 25	€5,000,000
2026-05-26	Mediaworks Hungary Zrt. Insufficient legal basis for data processing	🇭🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)	Art. 6 Art. 9	€140,500
2026-05-25	UODO (Poland) - DKN.5131.5.2025	🇵🇱 UODO (Poland)	Art. 241 Art. 24 Art. 251 Art. 25	€21,000
2026-05-22	UODO (Poland) - DKE.561.4.2026	🇵🇱 UODO (Poland)	Art. 51 Art. 5 Art. 52	€26,711
2026-05-20	Elektronikus Egészségügyi Szolgáltatási Tér Insufficient technical and organisational measures to ensure information security	🇭🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)	Art. 5 Art. 6 Art. 9	€1,400
2026-05-20	ICO (UK) - KRA Consultancy Ltd	🇬🇧 ICO (UK)		€300
2026-05-19	UODO (Poland) - DKN.5131.27.2023	🇵🇱 UODO (Poland)	Art. 51 Art. 5 Art. 52 Art. 241	€33,700
2026-05-13	HDPA (Greece) examines deletion request from National Registry of Undesirable Aliens	🇬🇷 HDPA (Greece)	Art. 231 Art. 23 Art. 231	—
2026-05-12	NAIH fines online store HUF 15M for transparency and Article 12(1) GDPR violations	🇭🇺 NAIH (Hungary)	Art. 51 Art. 5 Art. 121 Art. 12	€15,000,000
2026-05-12	Technology Company Insufficient legal basis for data processing	🇧🇪 Belgian Data Protection Authority (APD)	Art. 5 Art. 6 Art. 12 Art. 13	€177,000
2026-05-12	Isabel SA Insufficient fulfilment of data subjects rights	🇧🇪 Belgian Data Protection Authority (APD)	Art. 5 Art. 12 Art. 13 Art. 15	€120,000
2026-05-12	Société Wallonne des Eaux Insufficient legal basis for data processing	🇧🇪 Belgian Data Protection Authority (APD)	Art. 5 Art. 12 Art. 13 Art. 28	€86,000
2026-05-08	Permanent TSB Insufficient technical and organisational measures to ensure information security	🇮🇪 Data Protection Authority of Ireland	Art. 5 Art. 32 Art. 33	€277,500
2026-05-08	Law Firm Insufficient fulfilment of data subjects rights	🇧🇪 Belgian Data Protection Authority (APD)	Art. 5 Art. 12 Art. 13 Art. 14	€4,920
2026-05-07	South Staffordshire Plc Insufficient technical and organisational measures to ensure information security	🇬🇧 Information Commissioner (ICO)	Art. 5 Art. 32	€1,112,100
2026-05-06	APD/GBA: Controller failed to provide copies of service sheets for GDPR access request	🇧🇪 APD/GBA (Belgium)	Art. 122 Art. 12 Art. 123 Art. 124	—
2026-05-01	Slovenian DPA fines processor €2,802 for failing to patch known vulnerability (Art. 32)	🇸🇮 IP (Slovenia)	Art. 32	€2,802
2026-04-30	NAIH fines online store HUF 10M for missing and inadequate privacy notice	🇭🇺 NAIH (Hungary)	Art. 51 Art. 5 Art. 52 Art. 121	€10,000,000

← previous 51–75 of 230 next →