Article 24 GDPR — enforcement

Cited in 156 decisions · €924.0M total fines · median €27,750 · top authority: 🇪🇺Italian Data Protection Authority (Garante) (52)

Read Article 24 GDPR →

Date ↓	Company / party	Authority	Articles	Fine
2023-02-08	Company Insufficient technical and organisational measures to ensure information security	🇪🇺 Polish National Personal Data Protection Office (UODO)	Art. 5 Art. 24 Art. 25 Art. 32	€7,200
2023-02-06	I&S Limited Kft Non-compliance with general data processing principles	🇪🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)	Art. 5 Art. 6 Art. 9 Art. 13	€80,500
2023-02-03	Epic Ltd. Insufficient legal basis for data processing	🇪🇺 Cypriot Data Protection Commissioner	Art. 6 Art. 24 Art. 32	€3,250
2023-01-19	Szczecin-Centrum District Court Insufficient technical and organisational measures to ensure information security	🇪🇺 Polish National Personal Data Protection Office (UODO)	Art. 5 Art. 24 Art. 25 Art. 32	€6,400
2023-01-01	MALTA DPA: Insufficient fulfilment of data subjects rights Insufficient fulfilment of data subjects rights	🇪🇺 Data Protection Commissioner of Malta	Art. 5 Art. 12 Art. 13 Art. 14	€2,500
2022-12-15	Edison Energia S.p.A. Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 12	€4,900,000
2022-11-24	Areti spa Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 12 Art. 15 Art. 24	€1,000,000
2022-10-28	Danish DPA fines Sirius Lawyers DKK 500,000 for inadequate security after hacker attack	🇩🇰 Datatilsynet (Denmark)	Art. 51 Art. 5 Art. 9 Art. 24	€500,000
2022-10-20	Douglas Italia S.p.a. Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 12	€1,400,000
2022-09-15	Lazio Region Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9 Art. 12	€100,000
2022-09-05	Meta Platforms, Inc. Non-compliance with general data processing principles	🇪🇺 Data Protection Authority of Ireland	Art. 5 Art. 6 Art. 12 Art. 24	€405,000,000
2022-08-23	Company Insufficient technical and organisational measures to ensure information security	🇪🇺 Belgian Data Protection Authority (APD)	Art. 5 Art. 24 Art. 32	€2,500
2022-08-05	Colosseo S.r.l. Insufficient fulfilment of data subjects rights	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 12 Art. 15	€1,000
2022-08-05	Mister Brick S.a.s. Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 12 Art. 15	€1,000
2022-08-01	Policoro municipality Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 12 Art. 13 Art. 24	€26,000
2022-07-13	Manx Care Ltd Non-compliance with general data processing principles	🇪🇺 Information Commissioner of Isle of Man	Art. 5 Art. 24 Art. 25 Art. 32	€202,000
2022-06-30	Continental Automotive Romania SRL Insufficient technical and organisational measures to ensure information security	🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 24 Art. 32	€2,000
2022-06-09	Italian DPA sanctions Municipality of Policoro for CCTV signage, retention and DPO	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 51 Art. 52	€26,000
2022-05-25	Roularta Media Group Insufficient legal basis for data processing	🇪🇺 Belgian Data Protection Authority (APD)	Art. 5 Art. 6 Art. 7 Art. 12	€50,000
2022-05-25	Belgian DPA: Roularta Media Group violated cookie consent rules	🇧🇪 APD/GBA (Belgium)	Art. 411 Art. 4 Art. 51 Art. 5	€50
2022-02-08	Budapest Bank Zrt. Insufficient legal basis for data processing	🇪🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)	Art. 5 Art. 6 Art. 12 Art. 13	€634,000
2022-02-02	IAB Europe Insufficient legal basis for data processing	🇪🇺 Belgian Data Protection Authority (APD)	Art. 5 Art. 6 Art. 9 Art. 12	€0
2022-01-26	Slane Credit Union Ltd. Insufficient technical and organisational measures to ensure information security	🇪🇺 Data Protection Authority of Ireland	Art. 5 Art. 24 Art. 28 Art. 30	€5,000
2022-01-19	Fortum Marketing and Sales Polska S.A. Insufficient technical and organisational measures to ensure information security	🇪🇺 Polish National Personal Data Protection Office (UODO)	Art. 5 Art. 24 Art. 25 Art. 28	€1,000,000
2022-01-01	Bank of Cyprus Public Company Ltd. Insufficient technical and organisational measures to ensure information security	🇪🇺 Cypriot Data Protection Commissioner	Art. 5 Art. 24 Art. 32	€17,000

← previous 101–125 of 156 next →