Article 24 GDPR — enforcement

Cited in 143 decisions · €897.7M total fines · median €26,000 · top authority: 🇪🇺Italian Data Protection Authority (Garante) (52)

Read Article 24 GDPR →

Date ↓	Company / party	Authority	Articles	Fine
2026-07-03	Italian DPA finds GDPR applies to US-based Character.AI service	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 32 Art. 3 Art. 52 Art. 5	€158,000
2026-06-19	VDAI (Lithuania) - 3R-1143	🇱🇹 VDAI (Lithuania)	Art. 51 Art. 5 Art. 241 Art. 24	€450,000
2026-06-13	UODO (Poland) - DKN.5131.34.2023	🇵🇱 UODO (Poland)	Art. 51 Art. 5 Art. 52 Art. 241	€2,760
2026-06-11	UODO (Poland) - DKN.5131.12.2022	🇵🇱 UODO (Poland)	Art. 51 Art. 5 Art. 52 Art. 241	—
2026-05-25	UODO (Poland) - DKN.5131.5.2025	🇵🇱 UODO (Poland)	Art. 241 Art. 24 Art. 251 Art. 25	€21,000
2026-05-19	UODO (Poland) - DKN.5131.27.2023	🇵🇱 UODO (Poland)	Art. 51 Art. 5 Art. 52 Art. 241	€33,700
2026-04-13	UODO (Poland) - DKN.5131.7.2022	🇵🇱 UODO (Poland)	Art. 51 Art. 5 Art. 52 Art. 241	€2,415
2026-03-26	Intesa Sanpaolo S.p.A. Insufficient technical and organisational measures to ensure information security	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 24 Art. 32 Art. 34	€31,800,000
2026-03-12	Enel Energia S.p.A. Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 24	€563,052
2026-02-26	S.M. Trattamento Acqua di XX Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 4 Art. 5 Art. 6 Art. 7	€30,000
2026-02-12	Depurazione Acqua S.r.l. Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 4 Art. 5 Art. 6 Art. 7	€15,000
2026-02-12	Unleadmited S.r.l. Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 24	€5,000
2026-02-05	DPD Polska sp. z o.o. Insufficient data processing agreement	🇵🇱 Polish National Personal Data Protection Office (UODO)	Art. 5 Art. 24 Art. 29 Art. 32	€2,682,000
2025-12-23	Geturhotels Srl Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 17 Art. 24	€6,000
2025-12-23	Geturhotels Srl Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 17 Art. 24	€6,000
2025-11-27	Aimag S.p.A. Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 13	€300,000
2025-11-27	Aimag S.p.A. Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 13	€300,000
2025-11-27	Infobel Insufficient legal basis for data processing	🇪🇺 Belgian Data Protection Authority (APD)	Art. 5 Art. 6 Art. 24	€40,000
2025-11-27	Infobel Insufficient legal basis for data processing	🇪🇺 Belgian Data Protection Authority (APD)	Art. 5 Art. 6 Art. 24	€40,000
2025-11-15	Powiatowego Inspektora Sanitarnego w Policach Insufficient technical and organisational measures to ensure information security	🇪🇺 Polish National Personal Data Protection Office (UODO)	Art. 5 Art. 24 Art. 25 Art. 32	€4,750
2025-11-15	Powiatowego Inspektora Sanitarnego w Policach Insufficient technical and organisational measures to ensure information security	🇪🇺 Polish National Personal Data Protection Office (UODO)	Art. 5 Art. 24 Art. 25 Art. 32	€4,750
2025-10-10	AEPD sanctions 23andMe for security failures in credential-stuffing breach	🇪🇸 AEPD (Spain)	Art. 51 Art. 5 Art. 9 Art. 241	—
2025-10-09	FT Solutions S.r.l. Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 12	€5,000
2025-10-09	FT Solutions S.r.l. Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 12	€5,000
2025-09-25	E-Power S.r.l. Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 12	€35,000

1–25 of 143 next →