Article 24 GDPR — enforcement

Cited in 144 decisions · €907.3M total fines · median €26,000 · top authority: 🇪🇺Italian Data Protection Authority (Garante) (52)

Read Article 24 GDPR →

Date ↓	Company / party	Authority	Articles	Fine
2021-03-25	Fastweb S.p.A. Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 12	€4,500,000
2021-03-23	Irish Credit Bureau DAC Insufficient technical and organisational measures to ensure information security	🇪🇺 Data Protection Authority of Ireland	Art. 5 Art. 24 Art. 25	€90,000
2021-03-15	Asker Municipality Insufficient technical and organisational measures to ensure information security	🇪🇺 Norwegian Supervisory Authority (Datatilsynet)	Art. 5 Art. 6 Art. 32 Art. 24	€100,000
2021-03-15	Ålesund Municipality Insufficient technical and organisational measures to ensure information security	🇪🇺 Norwegian Supervisory Authority (Datatilsynet)	Art. 32 Art. 24 Art. 35	€4,900
2021-03-11	Vodafone España, S.A.U. Insufficient fulfilment of data subjects rights	🇪🇺 Spanish Data Protection Authority (aepd)	Art. 28 Art. 24 Art. 44 Art. 21	€8,150,000
2021-02-26	Nacionaliniam visuomenės sveikatos centrui (NVSC) Non-compliance with general data processing principles	🇪🇺 Lithuanian Data Protection Authority (VDAI)	Art. 5 Art. 13 Art. 24 Art. 32	€12,000
2021-02-26	IT sprendimai sėkmei Non-compliance with general data processing principles	🇪🇺 Lithuanian Data Protection Authority (VDAI)	Art. 5 Art. 13 Art. 24 Art. 32	€3,000
2021-01-27	Family Service / N.D.P.K. nv. Insufficient legal basis for data processing	🇪🇺 Belgian Data Protection Authority (APD)	Art. 5 Art. 6 Art. 7 Art. 13	€50,000
2021-01-22	BELGIUM DPA: Insufficient technical and organisational measures to ensure information security Insufficient technical and organisational measures to ensure information security	🇪🇺 Belgian Data Protection Authority (APD)	Art. 5 Art. 24 Art. 32 Art. 33	€25,000
2021-01-01	Restaurant Insufficient technical and organisational measures to ensure information security	🇪🇺 Data Protection Authority of Saarland	Art. 24 Art. 32	—
2020-12-23	BELGIUM DPA: Insufficient fulfilment of data subjects rights Insufficient fulfilment of data subjects rights	🇪🇺 Belgian Data Protection Authority (APD)	Art. 14 Art. 12 Art. 15 Art. 5	€50,000
2020-12-23	BELGIUM DPA: Insufficient fulfilment of data subjects rights Insufficient fulfilment of data subjects rights	🇪🇺 Belgian Data Protection Authority (APD)	Art. 14 Art. 12 Art. 6 Art. 5	€15,000
2020-11-12	Vodafone Italia S.p.A. Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 15	€12,251,601
2020-07-13	Wind Tre S.p.A. Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 12 Art. 24	€16,700,000
2020-01-24	Accounting firm Insufficient technical and organisational measures to ensure information security	🇪🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)	Art. 24 Art. 32	€1,450
2020-01-01	LITHUANIA DPA: Non-compliance with general data processing principles Non-compliance with general data processing principles	🇪🇺 Lithuanian Data Protection Authority (VDAI)	Art. 5 Art. 13 Art. 24 Art. 35	€8,000
2020-01-01	Private healthcare provider Insufficient technical and organisational measures to ensure information security	🇪🇺 Czech Data Protection Auhtority (UOOU)	Art. 24 Art. 32	€387
2019-12-11	Unknown Company Non-compliance with general data processing principles	🇪🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)	Art. 5 Art. 6 Art. 13 Art. 24	€1,430
2019-10-15	Unknown Company Non-compliance with general data processing principles	🇪🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)	Art. 5 Art. 6 Art. 13 Art. 24	€2,860

← previous 126–144 of 144