Article 25 GDPR — enforcement

Cited in 222 decisions · €924.0M total fines · median €50,000 · top authority: 🇪🇺Italian Data Protection Authority (Garante) (69)

Read Article 25 GDPR →

Date ↓	Company / party	Authority	Articles	Fine
2025-12-22	CURENERGÍA COMERCIALIZADOR DE ÚLTIMO RECURSO S.A.U. Insufficient technical and organisational measures to ensure information security	🇪🇺 Spanish Data Protection Authority (aepd)	Art. 25	€500,000
2025-12-22	CURENERGÍA COMERCIALIZADOR DE ÚLTIMO RECURSO S.A.U. Insufficient technical and organisational measures to ensure information security	🇪🇺 Spanish Data Protection Authority (aepd)	Art. 25	€500,000
2025-12-18	Bank Non-compliance with general data processing principles	🇭🇷 Croatian Data Protection Authority (azop)	Art. 5 Art. 6 Art. 13 Art. 25	€1,500,000
2025-12-12	Chief Constable of the Police Service of Scotland Insufficient technical and organisational measures to ensure information security	🇬🇧 Information Commissioner (ICO)	Art. 5 Art. 25 Art. 32 Art. 33	€75,700
2025-11-27	Aimag S.p.A. Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 13	€300,000
2025-11-27	Aimag S.p.A. Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 13	€300,000
2025-11-26	Cucina di Fabio S.R.L. Insufficient legal basis for data processing	🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 6 Art. 15 Art. 17 Art. 25	€3,000
2025-11-26	Cucina di Fabio S.R.L. Insufficient legal basis for data processing	🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 6 Art. 15 Art. 17 Art. 25	€3,000
2025-11-24	DSB Austria: Online shop violated GDPR by ignoring request to stop gender-specific	🇦🇹 DSB (Austria)	Art. 51 Art. 5 Art. 51 Art. 61	—
2025-11-21	IDCQ HOSPITALES Y SANIDAD, S.L.U. Non-compliance with general data processing principles	🇪🇺 Spanish Data Protection Authority (aepd)	Art. 6 Art. 9 Art. 25	€1,200,000
2025-11-15	Powiatowego Inspektora Sanitarnego w Policach Insufficient technical and organisational measures to ensure information security	🇪🇺 Polish National Personal Data Protection Office (UODO)	Art. 5 Art. 24 Art. 25 Art. 32	€4,750
2025-11-15	Powiatowego Inspektora Sanitarnego w Policach Insufficient technical and organisational measures to ensure information security	🇪🇺 Polish National Personal Data Protection Office (UODO)	Art. 5 Art. 24 Art. 25 Art. 32	€4,750
2025-10-23	Aktia Pankki Oyj Insufficient technical and organisational measures to ensure information security	🇪🇺 Deputy Data Protection Ombudsman	Art. 5 Art. 25 Art. 32	€865,000
2025-10-23	Aktia Pankki Oyj Insufficient technical and organisational measures to ensure information security	🇪🇺 Deputy Data Protection Ombudsman	Art. 5 Art. 25 Art. 32	€865,000
2025-10-09	Municipality of Moschato–Tavros Insufficient legal basis for data processing	🇪🇺 Hellenic Data Protection Authority (HDPA)	Art. 5 Art. 12 Art. 13 Art. 25	€10,000
2025-10-09	Municipality of Moschato–Tavros Insufficient legal basis for data processing	🇪🇺 Hellenic Data Protection Authority (HDPA)	Art. 5 Art. 12 Art. 13 Art. 25	€10,000
2025-10-09	FT Solutions S.r.l. Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 12	€5,000
2025-10-09	FT Solutions S.r.l. Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 12	€5,000
2025-09-11	Casa di Cura Città di Roma Insufficient technical and organisational measures to ensure information security	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 9 Art. 25 Art. 32	€12,000
2025-09-11	Casa di Cura Città di Roma Insufficient technical and organisational measures to ensure information security	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 9 Art. 25 Art. 32	€12,000
2025-09-08	S-Pankki Oyj Insufficient technical and organisational measures to ensure information security	🇪🇺 Deputy Data Protection Ombudsman	Art. 5 Art. 25 Art. 32	€1,800,000
2025-09-08	S-Pankki Oyj Insufficient technical and organisational measures to ensure information security	🇪🇺 Deputy Data Protection Ombudsman	Art. 5 Art. 25 Art. 32	€1,800,000
2025-08-04	Ospedaliero-Universitaria Careggi Insufficient technical and organisational measures to ensure information security	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 9 Art. 25 Art. 32	€80,000
2025-08-04	Ospedaliero-Universitaria Careggi Insufficient technical and organisational measures to ensure information security	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 9 Art. 25 Art. 32	€80,000
2025-08-04	Comune di Venezia Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 25 Art. 32	€10,000

← previous 26–50 of 222 next →