GDPR enforcement in 2026

403 decisions · €202.4B total fines · ← 2025

Date ↓	Company / party	Authority	Articles	Fine
2026-06-12	Market-In Non-compliance with general data processing principles	🇬🇷 Hellenic Data Protection Authority (HDPA)	Art. 5 Art. 12 Art. 13 Art. 15	€95,000
2026-06-12	MEDE S.A. Non-compliance with general data processing principles	🇬🇷 Hellenic Data Protection Authority (HDPA)	Art. 5 Art. 12 Art. 13 Art. 15	€65,000
2026-06-12	Națională Poșta Română Insufficient technical and organisational measures to ensure information security	🇷🇴 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 32	€5,000
2026-06-11	Midlands Regional Hospital Tullamore, County Offaly Insufficient technical and organisational measures to ensure information security	🇮🇪 Data Protection Authority of Ireland	Art. 5 Art. 28 Art. 30 Art. 32	€300,000
2026-06-11	Green Partner S.r.l.s. Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 12	€15,300
2026-06-11	Lecce Local Health Authority Insufficient technical and organisational measures to ensure information security	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 29 Art. 32	€4,500
2026-06-11	Pietro d'Abano State Vocational School Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6	€1,000
2026-06-11	UODO reprimands hospital for inadequate processor oversight and email security failures	🇵🇱 UODO (Poland)	Art. 51 Art. 5 Art. 52 Art. 241	—
2026-06-08	Municipality of Vasto Insufficient fulfilment of information obligations	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 12 Art. 13 Art. 35	€5,000
2026-06-08	Belgian DPA rejects delisting request for US government URL showing criminal conviction	🇧🇪 APD/GBA (Belgium)	Art. 173 Art. 17 Art. 10	—
2026-06-05	ZeniΘ (Thessaloniki-Thessalia Gas Supply Company S.A.) Insufficient fulfilment of data subjects rights	🇬🇷 Hellenic Data Protection Authority (HDPA)	Art. 5 Art. 12 Art. 15 Art. 28	€100,000
2026-06-05	Piraeus Bank S.A. Insufficient fulfilment of data subjects rights	🇬🇷 Hellenic Data Protection Authority (HDPA)	Art. 15	€10,000
2026-06-05	Reda Naujokaitienė Insufficient legal basis for data processing	🇱🇹 Lithuanian Data Protection Authority (VDAI)	Art. 5 Art. 6 Art. 9	€1,153
2026-06-02	Greek HDPA sanctions DEI for unsolicited promotional calls via processors	🇬🇷 HDPA (Greece)	Art. 51 Art. 5 Art. 51 Art. 51	€880,000
2026-06-02	Public Power Corporation S.A. (DEI) Insufficient legal basis for data processing	🇬🇷 Hellenic Data Protection Authority (HDPA)	Art. 5 Art. 32	€320,000
2026-06-02	Ypiresia 800 Teleperformance Single Member S.A. Insufficient technical and organisational measures to ensure information security	🇬🇷 Hellenic Data Protection Authority (HDPA)	Art. 5 Art. 32	€90,000
2026-06-02	PRELUDE GROUP E.E. Insufficient technical and organisational measures to ensure information security	🇬🇷 Hellenic Data Protection Authority (HDPA)	Art. 28 Art. 29 Art. 32	€80,000
2026-06-02	MEDIATEL Telephone Information Services S.A. Insufficient technical and organisational measures to ensure information security	🇬🇷 Hellenic Data Protection Authority (HDPA)	Art. 32	€45,000
2026-06-02	Minister of Justice Insufficient technical and organisational measures to ensure information security	🇵🇱 Polish National Personal Data Protection Office (UODO)	Art. 32	€23,540
2026-06-02	CQS S.A. Customer-Centric Services Insufficient technical and organisational measures to ensure information security	🇬🇷 Hellenic Data Protection Authority (HDPA)	Art. 32	€20,000
2026-06-01	Elkjøp AS Insufficient legal basis for data processing	🇳🇴 Norwegian Supervisory Authority (Datatilsynet)	Art. 5 Art. 6 Art. 12	€1,820,000
2026-06-01	UODO fines controller for refusing to cooperate and provide information in two data	🇵🇱 UODO (Poland)	Art. 31 Art. 581 Art. 58 Art. 581	—
2026-05-29	IndaNext Hungary Kft. (legal successor of Blikk Kft.) Insufficient legal basis for data processing	🇭🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)	Art. 6 Art. 9 Art. 12	€70,518
2026-05-29	Blikk Kft. Insufficient legal basis for data processing	🇭🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)	Art. 6 Art. 9 Art. 12	€70,300
2026-05-29	Unicredit Bank SA Insufficient technical and organisational measures to ensure information security	🇷🇴 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 32 Art. 33	€12,000

← previous 151–175 of 403 next →