Article 25 GDPR — enforcement

Cited in 245 decisions · €944.1M total fines · median €50,000 · top authority: 🇪🇺Italian Data Protection Authority (Garante) (69)

Read Article 25 GDPR →

Date ↓	Company / party	Authority	Articles	Fine
2026-09-16	Italian DPA probes University Health Agency Friuli over EHR access and missing logs	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 51 Art. 51	€24,000
2026-09-16	AEPD fines El Español for publishing video of minor assailant without anonymization	🇪🇸 AEPD (Spain)	Art. 51 Art. 5 Art. 52 Art. 25	€20,000
2026-09-16	Italian DPA: Municipality of Rieti breached GDPR by publishing 31,000 taxpayers' waste	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 51 Art. 51	€6,000
2026-09-16	Italian DPA sanctions Experian Italia for incomplete Art. 15 GDPR access responses on	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 51 Art. 12	€120
2026-09-15	AEPD: Data subject entitled to identity of professionals who accessed medical records	🇪🇸 AEPD (Spain)	Art. 51 Art. 5 Art. 52 Art. 12	—
2026-09-10	AEPD: CaixaBank requested excessive inheritance documentation from heirs	🇪🇸 AEPD (Spain)	Art. 13 Art. 25 Art. 30	€408,000
2026-09-03	Friuli Centrale University Health Authority Insufficient technical and organisational measures to ensure information security	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 9 Art. 25 Art. 32	€24,000
2026-08-07	Finnish DPA finds 12-year retention of rental applicant data violates minimisation	🇫🇮 Tietosuojavaltuutetun toimisto (Finland)	Art. 51 Art. 5 Art. 51 Art. 251	—
2026-07-29	ANSPDCP (Romania) - Fine against Orange Romania SA of July 17, 2026	🇷🇴 ANSPDCP (Romania)	Art. 251 Art. 25 Art. 321 Art. 32	€523,900
2026-07-23	Garante per la protezione dei dati personali (Italy) - 556/2026	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 52 Art. 5 Art. 24 Art. 28	€9,516,000
2026-07-23	TIM S.p.A. Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 15	€9,516,000
2026-07-23	Municipality of Terralba Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 24 Art. 25	€8,000
2026-07-23	Garante per la protezione dei dati personali (Italy) - 577/2026	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 25	—
2026-07-22	Finnish DPA: requesting address, ID number and strong authentication for access request	🇫🇮 Tietosuojavaltuutetun toimisto (Finland)	Art. 51 Art. 5 Art. 122 Art. 12	—
2026-07-17	Orange Romania SA Insufficient technical and organisational measures to ensure information security	🇷🇴 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 25 Art. 32	€100,000
2026-07-16	Garante per la protezione dei dati personali (Italy) - 10128005	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 51 Art. 51	€50,000
2026-07-14	Garante fines Lusha Systems Inc. over unauthorized B2B contact database	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 32 Art. 3 Art. 32 Art. 51	€2,000,000
2026-07-14	Municipality of Rieti Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 12 Art. 24 Art. 25	€6,000
2026-07-03	Garante per la protezione dei dati personali (Italy) - 487/2026	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 32 Art. 3 Art. 52 Art. 5	€158,000
2026-07-03	Character Technologies Inc. Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 12 Art. 13 Art. 14	€158,000
2026-07-03	Experian Italia S.p.A. Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 12 Art. 15 Art. 25	€120,000
2026-07-03	University of Pisa Insufficient technical and organisational measures to ensure information security	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 25 Art. 32	€15,000
2026-07-03	Giuliano Isontina University Health Authority Insufficient technical and organisational measures to ensure information security	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 9 Art. 25 Art. 32	€10,000
2026-06-18	Edizioni Grandangolo di Giuseppe Castaldo Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 12 Art. 13 Art. 24	€2,075
2026-06-13	UODO fines accounting firm €2,760 for email breach security failures	🇵🇱 UODO (Poland)	Art. 51 Art. 5 Art. 52 Art. 241	€2,760

1–25 of 245 next →