Article 25 GDPR — enforcement

Cited in 222 decisions · €924.0M total fines · median €50,000 · top authority: 🇪🇺Italian Data Protection Authority (Garante) (69)

Read Article 25 GDPR →

Date ↓	Company / party	Authority	Articles	Fine
2026-07-29	ANSPDCP (Romania) - Fine against Orange Romania SA of July 17, 2026	🇷🇴 ANSPDCP (Romania)	Art. 251 Art. 25 Art. 321 Art. 32	€523,900
2026-07-27	AEPD fines El Español for disclosing minor's identity in assault video	🇪🇸 AEPD (Spain)	Art. 51 Art. 5 Art. 52 Art. 25	€20,000
2026-07-22	Tietosuojavaltuutetun toimisto (Finland) - TSV/4630/2023	🇫🇮 Tietosuojavaltuutetun toimisto (Finland)	Art. 51 Art. 5 Art. 122 Art. 12	—
2026-07-16	Italian Garante sanctions Calabrian agency for location tracking of remote workers	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 51 Art. 51	€50,000
2026-07-14	Italian DPA sanctions Lusha Systems for processing contact data without consent in B2B	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 32 Art. 3 Art. 32 Art. 51	€2,000,000
2026-07-03	Italian DPA finds GDPR applies to US-based Character.AI service	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 32 Art. 3 Art. 52 Art. 5	€158,000
2026-06-13	UODO (Poland) - DKN.5131.34.2023	🇵🇱 UODO (Poland)	Art. 51 Art. 5 Art. 52 Art. 241	€2,760
2026-06-11	UODO (Poland) - DKN.5131.12.2022	🇵🇱 UODO (Poland)	Art. 51 Art. 5 Art. 52 Art. 241	—
2026-05-28	Italian DPA: AgID's automatic transfer of PEC addresses to INAD index unlawful	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 51 Art. 52	€55,000
2026-05-28	Italian DPA: vehicle tracking by Liguria Health Agency lawful, information duties met	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 51 Art. 51	€6,000
2026-05-26	IQVIA OPERATIONS FRANCE Non-compliance with general data processing principles	🇫🇷 French Data Protection Authority (CNIL)	Art. 14 Art. 25	€5,000,000
2026-05-25	UODO (Poland) - DKN.5131.5.2025	🇵🇱 UODO (Poland)	Art. 241 Art. 24 Art. 251 Art. 25	€21,000
2026-05-19	UODO (Poland) - DKN.5131.27.2023	🇵🇱 UODO (Poland)	Art. 51 Art. 5 Art. 52 Art. 241	€33,700
2026-05-12	Isabel SA Insufficient fulfilment of data subjects rights	🇧🇪 Belgian Data Protection Authority (APD)	Art. 5 Art. 12 Art. 13 Art. 15	€120,000
2026-04-17	Poste Italiane S.p.a. Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 13 Art. 25	€6,624,000
2026-04-17	Postepay S.p.a. Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 13 Art. 25	€5,877,000
2026-04-16	AKI (Estonia) - No. 2.1-1/24/397-890-38	🇪🇪 AKI (Estonia)	Art. 47 Art. 4 Art. 411 Art. 51	—
2026-04-15	CAIXABANK, S.A. Insufficient technical and organisational measures to ensure information security	🇪🇸 Spanish Data Protection Authority (aepd)	Art. 5 Art. 25	€400,000
2026-04-13	UODO (Poland) - DKN.5131.7.2022	🇵🇱 UODO (Poland)	Art. 51 Art. 5 Art. 52 Art. 241	€2,415
2026-03-12	INPS – Istituto nazionale previdenza sociale Insufficient technical and organisational measures to ensure information security	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9 Art. 10	€40,000
2026-02-26	Flamel S.r.l. Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 8 Art. 11 Art. 25 Art. 39	€15,000
2026-02-19	Your Consulting SRL Insufficient technical and organisational measures to ensure information security	🇷🇴 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 25 Art. 32	€3,000
2026-02-12	Sole Trader Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 13 Art. 25	€1,500
2026-01-29	Università Telematica e-Campus Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9 Art. 25	€50,000
2026-01-20	Slovenia DPA: Insufficient technical and organisational measures to ensure information security Insufficient technical and organisational measures to ensure information security	🇸🇮 Slovenian Supervisory Authority (Informacijski pooblaščenec)	Art. 25	€4,850

1–25 of 222 next →