Skip to content

GDPR enforcement in 2026

403 decisions · €202.4B total fines · ← 2025

Date ↓ Company / party Authority Articles Fine
2026-05-14 Lidl Italia S.r.l.
Insufficient fulfilment of data subjects rights
🇮🇹 Italian Data Protection Authority (Garante) Art. 5Art. 12Art. 15Art. 18 €43,000
2026-05-14 Vortika s.r.l.
Insufficient fulfilment of information obligations
🇮🇹 Italian Data Protection Authority (Garante) Art. 5Art. 13Art. 14Art. 37 €30,000
2026-05-14 Monaldi-Cotugno-CTO
Non-compliance with general data processing principles
🇮🇹 Italian Data Protection Authority (Garante) Art. 5Art. 9Art. 13Art. 25 €15,000
2026-05-14 Municipality of Ventasso
Non-compliance with general data processing principles
🇮🇹 Italian Data Protection Authority (Garante) Art. 5Art. 6Art. 9 €8,000
2026-05-14 Municipality of Mirabella Imbaccari
Insufficient legal basis for data processing
🇮🇹 Italian Data Protection Authority (Garante) Art. 5Art. 6Art. 37 €1,800
2026-05-14 Francesco Gagliardi
Non-compliance with general data processing principles
🇮🇹 Italian Data Protection Authority (Garante) Art. 5Art. 14 €1,500
2026-05-14 FeGi M&A Services s.r.l.
Non-compliance with general data processing principles
🇮🇹 Italian Data Protection Authority (Garante) Art. 5Art. 14 €1,000
2026-05-14 Danta di Cadore Hunting Reserve
Insufficient fulfilment of information obligations
🇮🇹 Italian Data Protection Authority (Garante) Art. 5Art. 6Art. 13 €1,000
2026-05-13 HDPA (Greece) - 12/2026 🇬🇷 HDPA (Greece) Art. 231Art. 23Art. 231 —
2026-05-12 NAIH (Hungary) - NAIH-450-7-2026 🇭🇺 NAIH (Hungary) Art. 51Art. 5Art. 121Art. 12 €15,000,000
2026-05-12 Technology Company
Insufficient legal basis for data processing
🇧🇪 Belgian Data Protection Authority (APD) Art. 5Art. 6Art. 12Art. 13 €177,000
2026-05-12 Isabel SA
Insufficient fulfilment of data subjects rights
🇧🇪 Belgian Data Protection Authority (APD) Art. 5Art. 12Art. 13Art. 15 €120,000
2026-05-12 Société Wallonne des Eaux
Insufficient legal basis for data processing
🇧🇪 Belgian Data Protection Authority (APD) Art. 5Art. 12Art. 13Art. 28 €86,000
2026-05-12 Operator of an online marketplace
Insufficient fulfilment of information obligations
🇭🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH) Art. 5Art. 12Art. 13 €42,052
2026-05-08 Permanent TSB
Insufficient technical and organisational measures to ensure information security
🇮🇪 Data Protection Authority of Ireland Art. 5Art. 32Art. 33 €277,500
2026-05-08 Law Firm
Insufficient fulfilment of data subjects rights
🇧🇪 Belgian Data Protection Authority (APD) Art. 5Art. 12Art. 13Art. 14 €4,920
2026-05-07 South Staffordshire Plc
Insufficient technical and organisational measures to ensure information security
🇬🇧 Information Commissioner (ICO) Art. 5Art. 32 €1,112,100
2026-05-06 APD/GBA (Belgium) - 97/2026 🇧🇪 APD/GBA (Belgium) Art. 122Art. 12Art. 123Art. 124 —
2026-05-01 IP (Slovenia) - 0609-42/2026/7 🇸🇮 IP (Slovenia) Art. 32 €2,802
2026-04-30 NAIH (Hungary) - NAIH-4462-5-2026 🇭🇺 NAIH (Hungary) Art. 51Art. 5Art. 52Art. 121 €10,000,000
2026-04-30 Permanent TSB plc
Insufficient technical and organisational measures to ensure information security
🇮🇪 Data Protection Authority of Ireland Art. 5Art. 32Art. 33 €277,500
2026-04-30 Operator of an online shop for alcoholic beverages
Insufficient fulfilment of information obligations
🇭🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH) Art. 5Art. 12Art. 13 €27,319
2026-04-30 BLUE PROJECTS INDUSTRIES S.R.L.
Insufficient technical and organisational measures to ensure information security
🇷🇴 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) Art. 32 €2,500
2026-04-30 Mayor of the City and Municipality of Myślenice
Insufficient fulfilment of data breach notification obligations
🇵🇱 Polish National Personal Data Protection Office (UODO) Art. 33 €1,790
2026-04-29 Lepida S.c.p.A.
Non-compliance with general data processing principles
🇮🇹 Italian Data Protection Authority (Garante) Art. 5Art. 13Art. 25Art. 32 €100,000