Article 28 GDPR — enforcement

Cited in 161 decisions · €108.7M total fines · median €50,500 · top authority: 🇪🇺Italian Data Protection Authority (Garante) (50)

Read Article 28 GDPR →

Date ↓	Company / party	Authority	Articles	Fine
2026-08-11	Slovenian DPA fines controller €1,282 for missing Art. 28(3) processor contract	🇸🇮 IP (Slovenia)	Art. 283 Art. 28	€1,282
2026-07-20	Italian DPA: Justice Ministry unlawful disclosure of employee health data in service order	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 49 Art. 4 Art. 410 Art. 415	€12,000
2026-07-03	Italian Garante sanctions Hera Comm for automated credit-check refusals of contracts	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 13 Art. 14	€5,800,000
2026-07-03	Italian Garante sanctions EstEnergy for automated creditworthiness scoring in energy	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 51 Art. 51	€1,400,000
2026-06-11	Midlands Regional Hospital Tullamore, County Offaly Insufficient technical and organisational measures to ensure information security	🇮🇪 Data Protection Authority of Ireland	Art. 5 Art. 28 Art. 30 Art. 32	€300,000
2026-06-11	UODO (Poland) - DKN.5131.12.2022	🇵🇱 UODO (Poland)	Art. 51 Art. 5 Art. 52 Art. 241	—
2026-06-02	HDPA fines DEI for unlawful telemarketing calls to opt-out registered subscribers	🇬🇷 HDPA (Greece)	Art. 51 Art. 5 Art. 51 Art. 51	€880,000
2026-05-25	UODO (Poland) - DKN.5131.5.2025	🇵🇱 UODO (Poland)	Art. 241 Art. 24 Art. 251 Art. 25	€21,000
2026-05-12	Société Wallonne des Eaux Insufficient legal basis for data processing	🇧🇪 Belgian Data Protection Authority (APD)	Art. 5 Art. 12 Art. 13 Art. 28	€86,000
2026-04-17	Poste Italiane S.p.a. Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 13 Art. 25	€6,624,000
2026-04-17	Postepay S.p.a. Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 13 Art. 25	€5,877,000
2026-04-16	AKI (Estonia) - No. 2.1-1/24/397-890-38	🇪🇪 AKI (Estonia)	Art. 47 Art. 4 Art. 411 Art. 51	—
2026-04-13	UODO (Poland) - DKN.5131.7.2022	🇵🇱 UODO (Poland)	Art. 51 Art. 5 Art. 52 Art. 241	€2,415
2026-04-13	Sub Agent Insufficient technical and organisational measures to ensure information security	🇵🇱 Polish National Personal Data Protection Office (UODO)	Art. 28 Art. 32	€2,415
2026-03-25	RENAULT COMMERCIAL ROUMANIE S.R.L. Insufficient technical and organisational measures to ensure information security	🇷🇴 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 28 Art. 32	€125,000
2026-03-12	Enel Energia S.p.A. Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 24	€563,052
2026-02-26	S.M. Trattamento Acqua di XX Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 4 Art. 5 Art. 6 Art. 7	€30,000
2026-02-26	Ministero delle Imprese e del Made in Italy Insufficient data processing agreement	🇮🇹 Italian Data Protection Authority (Garante)	Art. 28	€15,000
2026-02-26	Ministero dell’Economia e delle Finanze Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 28	€12,000
2026-02-12	Depurazione Acqua S.r.l. Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 4 Art. 5 Art. 6 Art. 7	€15,000
2026-02-12	Comune di Velletri Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 12 Art. 13	€2,000
2026-01-13	PREMIER RESTAURANTS ROMANIA SRL Insufficient technical and organisational measures to ensure information security	🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 28 Art. 32	€8,000
2026-01-13	PREMIER RESTAURANTS ROMANIA SRL Insufficient technical and organisational measures to ensure information security	🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 28 Art. 32	€8,000
2025-12-31	Thessaloniki–Thessaly Gas Supply Company S.A. Insufficient data processing agreement	🇪🇺 Hellenic Data Protection Authority (HDPA)	Art. 28 Art. 32	€10,000
2025-12-18	Pioneer Hi-Bred Italia Sementi s.r.l. Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 28	€120,000

1–25 of 161 next →