Article 24 GDPR — enforcement

Cited in 143 decisions · €897.7M total fines · median €26,000 · top authority: 🇪🇺Italian Data Protection Authority (Garante) (52)

Read Article 24 GDPR →

Date ↓	Company / party	Authority	Articles	Fine
2023-11-30	Limit Call S.r.l.s. Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 12	€60,000
2023-11-27	Norwegian Labor and Welfare Administration Insufficient technical and organisational measures to ensure information security	🇪🇺 Norwegian Supervisory Authority (Datatilsynet)	Art. 5 Art. 24 Art. 25 Art. 32	€1,700,000
2023-10-12	Scionti Selezioni Superiori S.r.l. Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 12	€70,000
2023-09-28	Axpo Italia Spa Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 24	€10,000,000
2023-09-01	TikTok Limited Non-compliance with general data processing principles	🇪🇺 Data Protection Authority of Ireland	Art. 5 Art. 12 Art. 13 Art. 24	€345,000,000
2023-08-22	DPC (Ireland) - 06/SIU/2018	🇮🇪 DPC (Ireland)	Art. 51 Art. 5 Art. 24 Art. 351	—
2023-07-18	Tiscali Italia SpA Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 12 Art. 13 Art. 24	€100,000
2023-07-18	Università Telematica E-Campus Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 12	€75,000
2023-07-18	Compara Facile S.r.l. Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 12	€40,000
2023-07-18	Company Insufficient technical and organisational measures to ensure information security	🇪🇺 Polish National Personal Data Protection Office (UODO)	Art. 5 Art. 24 Art. 25 Art. 32	€3,400
2023-05-17	Website operator Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 12 Art. 13	€60,000
2023-05-16	Municipality Insufficient technical and organisational measures to ensure information security	🇪🇺 Polish National Personal Data Protection Office (UODO)	Art. 5 Art. 24 Art. 25 Art. 32	€6,700
2023-02-08	Company Insufficient technical and organisational measures to ensure information security	🇪🇺 Polish National Personal Data Protection Office (UODO)	Art. 5 Art. 24 Art. 25 Art. 32	€7,200
2023-02-06	I&S Limited Kft Non-compliance with general data processing principles	🇪🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)	Art. 5 Art. 6 Art. 9 Art. 13	€80,500
2023-02-03	Epic Ltd. Insufficient legal basis for data processing	🇪🇺 Cypriot Data Protection Commissioner	Art. 6 Art. 24 Art. 32	€3,250
2023-01-19	Szczecin-Centrum District Court Insufficient technical and organisational measures to ensure information security	🇪🇺 Polish National Personal Data Protection Office (UODO)	Art. 5 Art. 24 Art. 25 Art. 32	€6,400
2023-01-01	MALTA DPA: Insufficient fulfilment of data subjects rights Insufficient fulfilment of data subjects rights	🇪🇺 Data Protection Commissioner of Malta	Art. 5 Art. 12 Art. 13 Art. 14	€2,500
2022-12-15	Edison Energia S.p.A. Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 12	€4,900,000
2022-11-24	Areti spa Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 12 Art. 15 Art. 24	€1,000,000
2022-10-28	Datatilsynet (Denmark) - 2022-63-0003	🇩🇰 Datatilsynet (Denmark)	Art. 51 Art. 5 Art. 9 Art. 24	€500,000
2022-10-20	Douglas Italia S.p.a. Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 12	€1,400,000
2022-09-15	Lazio Region Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9 Art. 12	€100,000
2022-09-05	Meta Platforms, Inc. Non-compliance with general data processing principles	🇪🇺 Data Protection Authority of Ireland	Art. 5 Art. 6 Art. 12 Art. 24	€405,000,000
2022-08-23	Company Insufficient technical and organisational measures to ensure information security	🇪🇺 Belgian Data Protection Authority (APD)	Art. 5 Art. 24 Art. 32	€2,500
2022-08-05	Colosseo S.r.l. Insufficient fulfilment of data subjects rights	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 12 Art. 15	€1,000

← previous 76–100 of 143 next →