Article 26 GDPR — enforcement

Cited in 7 decisions · €11.5M total fines · median €32,000 · top authority: 🇪🇺Dutch Supervisory Authority for Data Protection (AP) (2)

Date ↓	Company / party	Authority	Articles	Fine
2025-10-16	Experian Nederland B.V. Insufficient legal basis for data processing	🇪🇺 Dutch Supervisory Authority for Data Protection (AP)	Art. 5 Art. 6 Art. 12 Art. 14	€2,700,000
2025-10-16	Experian Nederland B.V. Insufficient legal basis for data processing	🇪🇺 Dutch Supervisory Authority for Data Protection (AP)	Art. 5 Art. 6 Art. 12 Art. 14	€2,700,000
2025-09-25	Provincia Autonoma di Bolzano Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 12 Art. 13	€32,000
2025-09-25	Provincia Autonoma di Bolzano Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 12 Art. 13	€32,000
2023-01-01	Company Unknown	🇪🇺 Data Protection Authority of Niedersachsen	Art. 6 Art. 12 Art. 26	€16,600
2022-01-27	Cosmote Mobile Telecommunications S.A. Insufficient technical and organisational measures to ensure information security	🇪🇺 Hellenic Data Protection Authority (HDPA)	Art. 5 Art. 13 Art. 14 Art. 25	€6,000,000
2020-01-01	Company Insufficient data processing agreement	🇪🇺 Data Protection Authority of Hamburg	Art. 26	€13,000