Article 28 GDPR — enforcement

Cited in 161 decisions · €108.7M total fines · median €50,500 · top authority: 🇪🇺Italian Data Protection Authority (Garante) (50)

Read Article 28 GDPR →

Date ↓	Company / party	Authority	Articles	Fine
2020-12-17	Miropass S.r.l. Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9 Art. 28	€40,000
2020-12-07	Perfomeclic Insufficient legal basis for data processing	🇪🇺 French Data Protection Authority (CNIL)	Art. 5 Art. 14 Art. 21 Art. 28	€7,300
2020-10-03	Avata Hispania, S.L. Insufficient legal basis for data processing	🇪🇺 Spanish Data Protection Authority (aepd)	Art. 5 Art. 6 Art. 28	€3,000
2020-09-30	Azienda Ospedaliera di Rilievo Nazionale 'Antonio Cardarelli' (Private Hospital) Insufficient technical and organisational measures to ensure information security	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 13 Art. 28	€80,000
2020-09-25	Legal Person Insufficient legal basis for data processing	🇪🇺 Czech Data Protection Auhtority (UOOU)	Art. 5 Art. 13 Art. 28 Art. 30	€400
2020-07-13	Merlini s.r.l. Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 28	€200,000
2020-01-01	Healthcare provider Insufficient fulfilment of information obligations	🇪🇺 Czech Data Protection Auhtority (UOOU)	Art. 5 Art. 12 Art. 28	—
2019-10-18	Major of Aleksandrów Kujawski Insufficient data processing agreement	🇪🇺 Polish National Personal Data Protection Office (UODO)	Art. 28	€9,380
2019-09-03	CNPD (Portugal) - Deliberação 2019/494	🇵🇹 CNPD (Portugal)	Art. 288 Art. 2 Art. 3 Art. 56	—
2019-01-01	Unknown Company Insufficient fulfilment of data subjects rights	🇪🇺 Data Protection Authority of Brandenburg	Art. 15 Art. 28	€50,000
2018-12-17	Kolibri Image Regina und Dirk Maass GbR Insufficient data processing agreement	🇪🇺 Data Protection Authority of Hamburg	Art. 28	€5,000

← previous 151–161 of 161