Article 25 GDPR — enforcement

Cited in 222 decisions · €924.0M total fines · median €50,000 · top authority: 🇪🇺Italian Data Protection Authority (Garante) (69)

Read Article 25 GDPR →

Date ↓	Company / party	Authority	Articles	Fine
2025-08-04	Comune di Venezia Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 25 Art. 32	€10,000
2025-08-04	Non-Public Health Care Institution Insufficient technical and organisational measures to ensure information security	🇪🇺 Polish National Personal Data Protection Office (UODO)	Art. 5 Art. 25 Art. 32	€7,700
2025-08-04	Non-Public Health Care Institution Insufficient technical and organisational measures to ensure information security	🇪🇺 Polish National Personal Data Protection Office (UODO)	Art. 5 Art. 25 Art. 32	€7,700
2025-07-21	McDonald’s Polska Sp. z o.o. Non-compliance with general data processing principles	🇪🇺 Polish National Personal Data Protection Office (UODO)	Art. 5 Art. 25 Art. 28 Art. 38	€3,955,000
2025-07-21	McDonald’s Polska Sp. z o.o. Non-compliance with general data processing principles	🇪🇺 Polish National Personal Data Protection Office (UODO)	Art. 5 Art. 25 Art. 28 Art. 38	€3,955,000
2025-07-21	24/7 Communication Sp. z o.o. Insufficient technical and organisational measures to ensure information security	🇪🇺 Polish National Personal Data Protection Office (UODO)	Art. 5 Art. 25 Art. 38	€43,000
2025-07-21	24/7 Communication Sp. z o.o. Insufficient technical and organisational measures to ensure information security	🇪🇺 Polish National Personal Data Protection Office (UODO)	Art. 5 Art. 25 Art. 38	€43,000
2025-07-21	Hestia Publishers & Booksellers I. D. Kollaros & Co. S.A. Insufficient technical and organisational measures to ensure information security	🇪🇺 Hellenic Data Protection Authority (HDPA)	Art. 5 Art. 25 Art. 32 Art. 33	€9,000
2025-07-21	Hestia Publishers & Booksellers I. D. Kollaros & Co. S.A. Insufficient technical and organisational measures to ensure information security	🇪🇺 Hellenic Data Protection Authority (HDPA)	Art. 5 Art. 25 Art. 32 Art. 33	€9,000
2025-06-26	Alliance for the Union of Romanians Party Non-compliance with general data processing principles	🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 5 Art. 6 Art. 25 Art. 32	€25,000
2025-06-26	Alliance for the Union of Romanians Party Non-compliance with general data processing principles	🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 5 Art. 6 Art. 25 Art. 32	€25,000
2025-06-23	Vodafone Romania S.A. Insufficient technical and organisational measures to ensure information security	🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 25	€4,000
2025-06-23	Vodafone Romania S.A. Insufficient technical and organisational measures to ensure information security	🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 25	€4,000
2025-04-29	Regione Lombardia Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 25 Art. 28	€50,000
2025-04-29	Regione Lombardia Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 25 Art. 28	€50,000
2025-04-29	MA Immobiliare S.r.l.s. Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 12	€40,000
2025-04-29	MA Immobiliare S.r.l.s. Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 12	€40,000
2025-04-29	Versilmagra Immobiliare di Robertelli Davide & C. S.a.s. Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 12	€2,000
2025-04-29	Versilmagra Immobiliare di Robertelli Davide & C. S.a.s. Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 12	€2,000
2025-04-22	Company Non-compliance with general data processing principles	🇪🇺 Belgian Data Protection Authority (APD)	Art. 5 Art. 6 Art. 12 Art. 14	€20,000
2025-04-22	Company Non-compliance with general data processing principles	🇪🇺 Belgian Data Protection Authority (APD)	Art. 5 Art. 6 Art. 12 Art. 14	€20,000
2025-04-10	Luka Inc. Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 12 Art. 13	€5,000,000
2025-04-10	Luka Inc. Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 12 Art. 13	€5,000,000
2025-04-10	Acea Energia S.p.A. Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 13	€3,000,000
2025-04-10	Acea Energia S.p.A. Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 13	€3,000,000

← previous 51–75 of 222 next →