GDPR enforcement in 2026
156 decisions · €267.1M total fines · ← 2025
| Date ↓ | Company / party | Authority | Articles | Fine |
|---|---|---|---|---|
| 2026-02-12 | Comune di Mazara del Vallo Insufficient legal basis for data processing | 🇮🇹 Italian Data Protection Authority (Garante) | Art. 5Art. 6Art. 12Art. 13 | €4,000 |
| 2026-02-12 | Comune di Monterotondo Insufficient legal basis for data processing | 🇮🇹 Italian Data Protection Authority (Garante) | Art. 5Art. 13Art. 88 | €2,000 |
| 2026-02-12 | Sole Trader Insufficient legal basis for data processing | 🇮🇹 Italian Data Protection Authority (Garante) | Art. 5Art. 6Art. 13Art. 88 | €2,000 |
| 2026-02-12 | Comune di Velletri Non-compliance with general data processing principles | 🇮🇹 Italian Data Protection Authority (Garante) | Art. 5Art. 6Art. 12Art. 13 | €2,000 |
| 2026-02-12 | Sole Trader Insufficient legal basis for data processing | 🇮🇹 Italian Data Protection Authority (Garante) | Art. 5Art. 13Art. 25 | €1,500 |
| 2026-02-12 | Sole Trader Insufficient fulfilment of information obligations | 🇮🇹 Italian Data Protection Authority (Garante) | Art. 5Art. 13 | €1,000 |
| 2026-02-11 | Vodafone – PANAFON A.E.E.T. Insufficient fulfilment of data subjects rights | 🇬🇷 Hellenic Data Protection Authority (HDPA) | Art. 12Art. 15Art. 18 | €30,000 |
| 2026-02-10 | Fundację Lumus Non-compliance with general data processing principles | 🇵🇱 Polish National Personal Data Protection Office (UODO) | Art. 33Art. 34Art. 37Art. 38 | €5,220 |
| 2026-02-06 | Landlord Insufficient legal basis for data processing | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 6 | €1,800 |
| 2026-02-05 | DPD Polska sp. z o.o. Insufficient data processing agreement | 🇵🇱 Polish National Personal Data Protection Office (UODO) | Art. 5Art. 24Art. 29Art. 32 | €2,682,000 |
| 2026-02-05 | MediaLab.AI, Inc. Insufficient legal basis for data processing | 🇪🇺 Information Commissioner (ICO) | €284,450 | |
| 2026-02-05 | Tensa Art Design S.A Insufficient cooperation with supervisory authority | 🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) | Art. 58Art. 83 | €20,000 |
| 2026-02-05 | Obuda University Insufficient legal basis for data processing | 🇭🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH) | Art. 5Art. 6Art. 9 | €4,200 |
| 2026-02-04 | GENPACT ROMANIA SRL Insufficient technical and organisational measures to ensure information security | 🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) | Art. 32 | €10,000 |
| 2026-02-03 | Municipality of Delft Insufficient legal basis for data processing | 🇪🇺 Dutch Supervisory Authority for Data Protection (AP) | Art. 6Art. 9 | €25,000 |
| 2026-02-03 | Municipality of Hilversum Insufficient legal basis for data processing | 🇪🇺 Dutch Supervisory Authority for Data Protection (AP) | Art. 6Art. 9 | €25,000 |
| 2026-02-03 | Municipality of Zoetermeer Insufficient legal basis for data processing | 🇪🇺 Dutch Supervisory Authority for Data Protection (AP) | Art. 6Art. 9 | €25,000 |
| 2026-02-03 | Municipality of Veenendaal Insufficient legal basis for data processing | 🇪🇺 Dutch Supervisory Authority for Data Protection (AP) | Art. 6Art. 9 | €25,000 |
| 2026-02-03 | Municipality of Tilburg Insufficient legal basis for data processing | 🇪🇺 Dutch Supervisory Authority for Data Protection (AP) | Art. 6Art. 9 | €25,000 |
| 2026-02-03 | Municipality of Huizen Insufficient legal basis for data processing | 🇪🇺 Dutch Supervisory Authority for Data Protection (AP) | Art. 6Art. 9 | €25,000 |
| 2026-02-03 | Municipality of Haarlemmermeer Insufficient legal basis for data processing | 🇪🇺 Dutch Supervisory Authority for Data Protection (AP) | Art. 6Art. 9 | €25,000 |
| 2026-02-03 | Municipality of Gooise Meren Insufficient legal basis for data processing | 🇪🇺 Dutch Supervisory Authority for Data Protection (AP) | Art. 6Art. 9 | €25,000 |
| 2026-02-03 | Municipality of Eindhoven Insufficient legal basis for data processing | 🇪🇺 Dutch Supervisory Authority for Data Protection (AP) | Art. 6Art. 9 | €25,000 |
| 2026-02-03 | Municipality of Ede Insufficient legal basis for data processing | 🇪🇺 Dutch Supervisory Authority for Data Protection (AP) | Art. 6Art. 9 | €25,000 |
| 2026-02-03 | FREE TECHNOLOGIES EXCOM, S.L. Insufficient technical and organisational measures to ensure information security | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 32 | €10,000 |