GDPR enforcement in 2026

403 decisions · €202.4B total fines · ← 2025

Date ↓	Company / party	Authority	Articles	Fine
2026-08-26	DSB: Retailer must grant full access and delete data after third-party fraud order	🇦🇹 DSB (Austria)	Art. 61 Art. 6 Art. 145 Art. 14	—
2026-08-25	HDPA orders TEIRESIAS S.A. to ensure data accuracy under Art. 5(1)(d) GDPR	🇬🇷 HDPA (Greece)	Art. 51 Art. 5	—
2026-08-25	Austrian DSB: e-marketplace transfer of customer data to China and US requires valid Art.	🇦🇹 DSB (Austria)	Art. 45 Art. 491 Art. 49 Art. 462	—
2026-08-25	Datatilsynet reprimands Danish Tax Administration for access request delays (2019-2024)	🇩🇰 Datatilsynet (Denmark)	Art. 123 Art. 12 Art. 15	—
2026-08-21	AP (The Netherlands) - Uber B.V and Uber Technologies Inc.	🇳🇱 AP (The Netherlands)	Art. 22	€824,990,000
2026-08-21	Uber Technologies Inc. Non-compliance with general data processing principles	🇪🇺 Dutch Supervisory Authority for Data Protection (AP)	Art. 22 Art. 13 Art. 14	€824,990,000
2026-08-21	ANSPDCP (Romania) - Fine against Poliserv JG (PJG) SRL	🇷🇴 ANSPDCP (Romania)	Art. 321 Art. 32 Art. 322	€15,728
2026-08-20	Garante per la protezione dei dati personali (Italy) - 10269624	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 61 Art. 6 Art. 7 Art. 123	€280,000
2026-08-19	Garante per la protezione dei dati personali (Italy) - 10266250	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 5 Art. 6 Art. 7 Art. 12	€15,300
2026-08-19	Poliserv JG (PJG) SRL Insufficient technical and organisational measures to ensure information security	🇷🇴 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 32	€3,000
2026-08-19	HDPA: Hellenic Open University found to have met breach notification duties after	🇬🇷 HDPA (Greece)	Art. 32 Art. 33 Art. 34 Art. 582	—
2026-08-18	ANSPDCP (Romania) - AMATO BESTSELLER S.R.L.	🇷🇴 ANSPDCP (Romania)	Art. 51 Art. 5 Art. 9 Art. 324	€285,395
2026-08-18	Austrian DSB: Employee who shared customer's phone number acted as GDPR controller	🇦🇹 DSB (Austria)	Art. 51 Art. 5 Art. 51 Art. 47	€1,000
2026-08-18	Garante per la protezione dei dati personali (Italy) - 10273026	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 51 Art. 851	—
2026-08-18	Datatilsynet (Denmark) - 2023-31-0321	🇩🇰 Datatilsynet (Denmark)	Art. 122 Art. 12 Art. 123 Art. 124	—
2026-08-13	AEPD (Spain) - ps-00148-2025	🇪🇸 AEPD (Spain)	Art. 61 Art. 6	€200,000
2026-08-12	Datatilsynet ordered Lab Pharma AS to erase influencer's personal data used after	🇳🇴 Datatilsynet (Norway)	Art. 61 Art. 6 Art. 61 Art. 17	€205,000
2026-08-11	IP (Slovenia) - 0609-41/2026/7	🇸🇮 IP (Slovenia)	Art. 283 Art. 28	€1,282
2026-08-07	ICO (UK) - ACRO Criminal Records Office	🇬🇧 ICO (UK)	Art. 32	—
2026-08-07	Finnish DPA finds 12-year retention of rental applicant data violates minimisation	🇫🇮 Tietosuojavaltuutetun toimisto (Finland)	Art. 51 Art. 5 Art. 51 Art. 251	—
2026-08-06	AMATO BESTSELLER S.R.L Non-compliance with general data processing principles	🇷🇴 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 32 Art. 14 Art. 5 Art. 9	€45,000
2026-08-06	Leontinoi Società Cooperativa Sociale Insufficient fulfilment of data subjects rights	🇮🇹 Italian Data Protection Authority (Garante)	Art. 12 Art. 15 Art. 31	€1,000
2026-08-04	Finnish DPA examines anti-doping organization's GDPR compliance over public suspension	🇫🇮 Tietosuojavaltuutetun toimisto (Finland)	Art. 22 Art. 2 Art. 51 Art. 5	—
2026-08-04	Finnish DPA: pension insurer did not violate GDPR by disclosing pension accrual to	🇫🇮 Tietosuojavaltuutetun toimisto (Finland)	Art. 51 Art. 5	—
2026-08-03	AZOP (Croatia) - Decision 08-03-2022 (energy company)	🇭🇷 AZOP (Croatia)	Art. 153 Art. 15	€940,000

← previous 51–75 of 403 next →