Article 24 GDPR — enforcement

Cited in 155 decisions · €924.0M total fines · median €27,750 · top authority: 🇪🇺Italian Data Protection Authority (Garante) (52)

Read Article 24 GDPR →

Date ↓	Company / party	Authority	Articles	Fine
2026-09-16	AEPD sanctions Iberdrola Clientes for improper identity verification and unauthorized	🇪🇸 AEPD (Spain)	Art. 24 Art. 32 Art. 321 Art. 582	€1,000,000
2026-09-16	Italian DPA: Municipality of Rieti breached GDPR by publishing 31,000 taxpayers' waste	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 51 Art. 51	€6,000
2026-09-15	AEPD: Data subject entitled to identity of professionals who accessed medical records	🇪🇸 AEPD (Spain)	Art. 51 Art. 5 Art. 52 Art. 12	—
2026-09-03	Banco Bilbao Vizcaya Argentaria S.A. Insufficient fulfilment of data subjects rights	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 12 Art. 21 Art. 24	€5,508,000
2026-07-23	Garante per la protezione dei dati personali (Italy) - 556/2026	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 52 Art. 5 Art. 24 Art. 28	€9,516,000
2026-07-23	TIM S.p.A. Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 15	€9,516,000
2026-07-23	Municipality of Terralba Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 24 Art. 25	€8,000
2026-07-14	Municipality of Rieti Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 12 Art. 24 Art. 25	€6,000
2026-07-03	Character Technologies Inc. Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 12 Art. 13 Art. 14	€158,000
2026-07-03	Garante per la protezione dei dati personali (Italy) - 487/2026	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 32 Art. 3 Art. 52 Art. 5	€158,000
2026-06-19	VDAI fines medical company €450,000 for inadequate security measures in data breaches	🇱🇹 VDAI (Lithuania)	Art. 51 Art. 5 Art. 241 Art. 24	€450,000
2026-06-19	InMedica UAB Insufficient technical and organisational measures to ensure information security	🇱🇹 Lithuanian Data Protection Authority (VDAI)	Art. 24 Art. 32 Art. 5	€450,000
2026-06-18	Edizioni Grandangolo di Giuseppe Castaldo Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 12 Art. 13 Art. 24	€2,075
2026-06-13	UODO fines accounting firm €2,760 for email breach security failures	🇵🇱 UODO (Poland)	Art. 51 Art. 5 Art. 52 Art. 241	€2,760
2026-06-11	UODO reprimands hospital for inadequate processor oversight and email security failures	🇵🇱 UODO (Poland)	Art. 51 Art. 5 Art. 52 Art. 241	—
2026-05-25	UODO (Poland) - DKN.5131.5.2025	🇵🇱 UODO (Poland)	Art. 241 Art. 24 Art. 251 Art. 25	€21,000
2026-05-19	UODO (Poland) - DKN.5131.27.2023	🇵🇱 UODO (Poland)	Art. 51 Art. 5 Art. 52 Art. 241	€33,700
2026-05-14	Energia Sostenibile S.r.l. Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 12	€100,000
2026-04-13	UODO reprimands electricity seller for Art. 5, 24, 25, 28, 32 GDPR violations over	🇵🇱 UODO (Poland)	Art. 51 Art. 5 Art. 52 Art. 241	€2,415
2026-03-26	Intesa Sanpaolo S.p.A. Insufficient technical and organisational measures to ensure information security	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 24 Art. 32 Art. 34	€31,800,000
2026-03-12	Enel Energia S.p.A. Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 24	€563,052
2026-02-26	S.M. Trattamento Acqua di XX Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 4 Art. 5 Art. 6 Art. 7	€30,000
2026-02-12	Depurazione Acqua S.r.l. Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 4 Art. 5 Art. 6 Art. 7	€15,000
2026-02-12	Unleadmited S.r.l. Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 24	€5,000
2026-02-05	DPD Polska sp. z o.o. Insufficient data processing agreement	🇵🇱 Polish National Personal Data Protection Office (UODO)	Art. 5 Art. 24 Art. 29 Art. 32	€2,682,000

1–25 of 155 next →