GDPR enforcement in 2026
403 decisions · €202.4B total fines · ← 2025
| Date ↓ | Company / party | Authority | Articles | Fine |
|---|---|---|---|---|
| 2026-05-14 | Lidl Italia S.r.l. Insufficient fulfilment of data subjects rights | 🇮🇹 Italian Data Protection Authority (Garante) | Art. 5Art. 12Art. 15Art. 18 | €43,000 |
| 2026-05-14 | Vortika s.r.l. Insufficient fulfilment of information obligations | 🇮🇹 Italian Data Protection Authority (Garante) | Art. 5Art. 13Art. 14Art. 37 | €30,000 |
| 2026-05-14 | Monaldi-Cotugno-CTO Non-compliance with general data processing principles | 🇮🇹 Italian Data Protection Authority (Garante) | Art. 5Art. 9Art. 13Art. 25 | €15,000 |
| 2026-05-14 | Municipality of Ventasso Non-compliance with general data processing principles | 🇮🇹 Italian Data Protection Authority (Garante) | Art. 5Art. 6Art. 9 | €8,000 |
| 2026-05-14 | Municipality of Mirabella Imbaccari Insufficient legal basis for data processing | 🇮🇹 Italian Data Protection Authority (Garante) | Art. 5Art. 6Art. 37 | €1,800 |
| 2026-05-14 | Francesco Gagliardi Non-compliance with general data processing principles | 🇮🇹 Italian Data Protection Authority (Garante) | Art. 5Art. 14 | €1,500 |
| 2026-05-14 | FeGi M&A Services s.r.l. Non-compliance with general data processing principles | 🇮🇹 Italian Data Protection Authority (Garante) | Art. 5Art. 14 | €1,000 |
| 2026-05-14 | Danta di Cadore Hunting Reserve Insufficient fulfilment of information obligations | 🇮🇹 Italian Data Protection Authority (Garante) | Art. 5Art. 6Art. 13 | €1,000 |
| 2026-05-13 | HDPA (Greece) - 12/2026 | 🇬🇷 HDPA (Greece) | Art. 231Art. 23Art. 231 | — |
| 2026-05-12 | NAIH (Hungary) - NAIH-450-7-2026 | 🇭🇺 NAIH (Hungary) | Art. 51Art. 5Art. 121Art. 12 | €15,000,000 |
| 2026-05-12 | Technology Company Insufficient legal basis for data processing | 🇧🇪 Belgian Data Protection Authority (APD) | Art. 5Art. 6Art. 12Art. 13 | €177,000 |
| 2026-05-12 | Isabel SA Insufficient fulfilment of data subjects rights | 🇧🇪 Belgian Data Protection Authority (APD) | Art. 5Art. 12Art. 13Art. 15 | €120,000 |
| 2026-05-12 | Société Wallonne des Eaux Insufficient legal basis for data processing | 🇧🇪 Belgian Data Protection Authority (APD) | Art. 5Art. 12Art. 13Art. 28 | €86,000 |
| 2026-05-12 | Operator of an online marketplace Insufficient fulfilment of information obligations | 🇭🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH) | Art. 5Art. 12Art. 13 | €42,052 |
| 2026-05-08 | Permanent TSB Insufficient technical and organisational measures to ensure information security | 🇮🇪 Data Protection Authority of Ireland | Art. 5Art. 32Art. 33 | €277,500 |
| 2026-05-08 | Law Firm Insufficient fulfilment of data subjects rights | 🇧🇪 Belgian Data Protection Authority (APD) | Art. 5Art. 12Art. 13Art. 14 | €4,920 |
| 2026-05-07 | South Staffordshire Plc Insufficient technical and organisational measures to ensure information security | 🇬🇧 Information Commissioner (ICO) | Art. 5Art. 32 | €1,112,100 |
| 2026-05-06 | APD/GBA (Belgium) - 97/2026 | 🇧🇪 APD/GBA (Belgium) | Art. 122Art. 12Art. 123Art. 124 | — |
| 2026-05-01 | IP (Slovenia) - 0609-42/2026/7 | 🇸🇮 IP (Slovenia) | Art. 32 | €2,802 |
| 2026-04-30 | NAIH (Hungary) - NAIH-4462-5-2026 | 🇭🇺 NAIH (Hungary) | Art. 51Art. 5Art. 52Art. 121 | €10,000,000 |
| 2026-04-30 | Permanent TSB plc Insufficient technical and organisational measures to ensure information security | 🇮🇪 Data Protection Authority of Ireland | Art. 5Art. 32Art. 33 | €277,500 |
| 2026-04-30 | Operator of an online shop for alcoholic beverages Insufficient fulfilment of information obligations | 🇭🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH) | Art. 5Art. 12Art. 13 | €27,319 |
| 2026-04-30 | BLUE PROJECTS INDUSTRIES S.R.L. Insufficient technical and organisational measures to ensure information security | 🇷🇴 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) | Art. 32 | €2,500 |
| 2026-04-30 | Mayor of the City and Municipality of Myślenice Insufficient fulfilment of data breach notification obligations | 🇵🇱 Polish National Personal Data Protection Office (UODO) | Art. 33 | €1,790 |
| 2026-04-29 | Lepida S.c.p.A. Non-compliance with general data processing principles | 🇮🇹 Italian Data Protection Authority (Garante) | Art. 5Art. 13Art. 25Art. 32 | €100,000 |