Article 25 GDPR — enforcement

Cited in 223 decisions · €933.6M total fines · median €50,000 · top authority: 🇪🇺Italian Data Protection Authority (Garante) (69)

Read Article 25 GDPR →

Date ↓	Company / party	Authority	Articles	Fine
2021-02-23	Deutsche Wohnen SE Non-compliance with general data processing principles	🇪🇺 Data Protection Authority of Berlin	Art. 5 Art. 25	€0
2021-02-11	Krajowa Szkoła Sądownictwa i Prokuratury Insufficient technical and organisational measures to ensure information security	🇪🇺 Polish National Personal Data Protection Office (UODO)	Art. 5 Art. 25 Art. 28 Art. 32	€22,200
2021-01-27	Family Service / N.D.P.K. nv. Insufficient legal basis for data processing	🇪🇺 Belgian Data Protection Authority (APD)	Art. 5 Art. 6 Art. 7 Art. 13	€50,000
2021-01-01	Company Insufficient technical and organisational measures to ensure information security	🇪🇺 Data Protection Authority of Niedersachsen	Art. 25 Art. 32	—
2020-12-17	ID Finance Poland Sp. z o.o. Insufficient technical and organisational measures to ensure information security	🇪🇺 Polish National Personal Data Protection Office (UODO)	Art. 5 Art. 25 Art. 32	€235,300
2020-12-16	Robinson Tours Ltd. (Robinson Tours Idegenforgalmi és Szolgáltató Kft.) Insufficient technical and organisational measures to ensure information security	🇪🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)	Art. 25 Art. 32 Art. 34	€55,400
2020-12-14	Virgin Mobile Polska Insufficient technical and organisational measures to ensure information security	🇪🇺 Polish National Personal Data Protection Office (UODO)	Art. 5 Art. 25 Art. 32	€443,000
2020-11-25	Private Individual Insufficient legal basis for data processing	🇪🇺 Belgian Data Protection Authority (APD)	Art. 6 Art. 25	€1,500
2020-11-12	Vodafone Italia S.p.A. Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 15	€12,251,601
2020-10-23	Deichmann Cipőkereskedelmi Korlátolt Felelősségű Társaságnak Insufficient fulfilment of data subjects rights	🇪🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)	Art. 12 Art. 15 Art. 18 Art. 25	€54,800
2020-09-01	Apartment building owners association Insufficient legal basis for data processing	🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 5 Art. 6 Art. 12 Art. 13	€500
2020-07-13	Wind Tre S.p.A. Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 12 Art. 24	€16,700,000
2020-07-13	Iliad Italia S.p.A. Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 25	€800,000
2020-02-20	L.E. EOOD Insufficient technical and organisational measures to ensure information security	🇪🇺 Data Protection Commision of Bulgaria (KZLD)	Art. 25 Art. 32 Art. 6	€2,560
2020-02-20	T.K. EOOD Insufficient technical and organisational measures to ensure information security	🇪🇺 Data Protection Commision of Bulgaria (KZLD)	Art. 25 Art. 32	€2,560
2019-12-11	Unknown Company Non-compliance with general data processing principles	🇪🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)	Art. 5 Art. 6 Art. 13 Art. 24	€1,430
2019-12-10	Hora Credit IFN SA Insufficient technical and organisational measures to ensure information security	🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 5 Art. 25 Art. 32 Art. 33	€14,000
2019-10-15	Unknown Company Non-compliance with general data processing principles	🇪🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)	Art. 5 Art. 6 Art. 13 Art. 24	€2,860
2019-10-07	Telecommunication Service Provider Non-compliance with general data processing principles	🇪🇺 Hellenic Data Protection Authority (HDPA)	Art. 5 Art. 25	€200,000
2019-10-07	Telecommunication Service Provider Non-compliance with general data processing principles	🇪🇺 Hellenic Data Protection Authority (HDPA)	Art. 21 Art. 25	€200,000
2019-09-03	Telecommunication service provide Insufficient legal basis for data processing	🇪🇺 Commission for Personal Data Protection (KZLD)	Art. 6 Art. 25	€5,113
2019-09-03	Telecommunication service provide Insufficient legal basis for data processing	🇪🇺 Commission for Personal Data Protection (KZLD)	Art. 6 Art. 25	€1,022
2019-06-27	UNICREDIT BANK SA Insufficient technical and organisational measures to ensure information security	🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 25 Art. 5	€130,000

← previous 201–223 of 223