Article 28 GDPR — enforcement

Cited in 180 decisions · €200.1B total fines · median €56,500 · top authority: 🇪🇺Italian Data Protection Authority (Garante) (50)

Read Article 28 GDPR →

Date ↓	Company / party	Authority	Articles	Fine
2026-09-23	AEPD sanctions Vodafone España for inadequate Super WiFi processor agreement and oversight	🇪🇸 AEPD (Spain)	Art. 51 Art. 5 Art. 28 Art. 32	€750,000
2026-08-20	Garante per la protezione dei dati personali (Italy) - 10269624	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 61 Art. 6 Art. 7 Art. 123	€280,000
2026-08-19	Garante per la protezione dei dati personali (Italy) - 10266250	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 5 Art. 6 Art. 7 Art. 12	€15,300
2026-08-11	IP (Slovenia) - 0609-41/2026/7	🇸🇮 IP (Slovenia)	Art. 283 Art. 28	€1,282
2026-07-28	HDPA (Greece) - 15/2026	🇬🇷 HDPA (Greece)	Art. 51 Art. 5 Art. 283 Art. 28	€200,000,150,000
2026-07-23	Garante per la protezione dei dati personali (Italy) - 556/2026	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 52 Art. 5 Art. 24 Art. 28	€9,516,000
2026-07-23	TIM S.p.A. Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 15	€9,516,000
2026-07-20	Garante per la protezione dei dati personali (Italy) - 10254256	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 49 Art. 4 Art. 410 Art. 415	€12,000
2026-07-03	Garante per la protezione dei dati personali (Italy) - 483/2026	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 13 Art. 14	€5,800,000
2026-07-03	Hera Comm S.p.A. Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 12 Art. 13 Art. 14	€5,800,000
2026-07-03	Garante per la protezione dei dati personali (Italy) - 484/2026	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 51 Art. 51	€1,400,000
2026-07-03	EstEnergy S.p.A. Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 12 Art. 13 Art. 14	€1,400,000
2026-06-18	Acquirente Unico S.p.A. Insufficient fulfilment of data subjects rights	🇮🇹 Italian Data Protection Authority (Garante)	Art. 12 Art. 16 Art. 28	€90,000
2026-06-11	Midlands Regional Hospital Tullamore, County Offaly Insufficient technical and organisational measures to ensure information security	🇮🇪 Data Protection Authority of Ireland	Art. 5 Art. 28 Art. 30 Art. 32	€300,000
2026-06-11	Green Partner S.r.l.s. Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 12	€15,300
2026-06-11	UODO reprimands hospital for inadequate processor oversight and email security failures	🇵🇱 UODO (Poland)	Art. 51 Art. 5 Art. 52 Art. 241	—
2026-06-05	ZeniΘ (Thessaloniki-Thessalia Gas Supply Company S.A.) Insufficient fulfilment of data subjects rights	🇬🇷 Hellenic Data Protection Authority (HDPA)	Art. 5 Art. 12 Art. 15 Art. 28	€100,000
2026-06-02	PRELUDE GROUP E.E. Insufficient technical and organisational measures to ensure information security	🇬🇷 Hellenic Data Protection Authority (HDPA)	Art. 28 Art. 29 Art. 32	€80,000
2026-05-25	UODO (Poland) - DKN.5131.5.2025	🇵🇱 UODO (Poland)	Art. 241 Art. 24 Art. 251 Art. 25	€21,000
2026-05-25	District Governor of Lubartów Insufficient technical and organisational measures to ensure information security	🇵🇱 Polish National Personal Data Protection Office (UODO)	Art. 5 Art. 25 Art. 28 Art. 32	€4,958
2026-05-25	Land-surveying office Insufficient technical and organisational measures to ensure information security	🇵🇱 Polish National Personal Data Protection Office (UODO)	Art. 28 Art. 32	€2,951
2026-05-14	Energia Sostenibile S.r.l. Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 12	€100,000
2026-05-12	Société Wallonne des Eaux Insufficient legal basis for data processing	🇧🇪 Belgian Data Protection Authority (APD)	Art. 5 Art. 12 Art. 13 Art. 28	€86,000
2026-04-29	Pianeta S.r.l. Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 12 Art. 13	€34,000
2026-04-17	Poste Italiane S.p.a. Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 13 Art. 25	€6,624,000

1–25 of 180 next →