Article 28 GDPR — enforcement

Cited in 181 decisions · €200.1B total fines · median €60,000 · top authority: 🇪🇺Italian Data Protection Authority (Garante) (50)

Date ↓	Company / party	Authority	Articles	Fine
2020-07-13	Merlini s.r.l. Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 28	€200,000
2020-01-01	Healthcare provider Insufficient fulfilment of information obligations	🇪🇺 Czech Data Protection Auhtority (UOOU)	Art. 5 Art. 12 Art. 28	—
2019-10-18	Major of Aleksandrów Kujawski Insufficient data processing agreement	🇪🇺 Polish National Personal Data Protection Office (UODO)	Art. 28	€9,380
2019-09-03	CNPD (Portugal) - Deliberação 2019/494	🇵🇹 CNPD (Portugal)	Art. 288 Art. 2 Art. 3 Art. 56	—
2019-01-01	Unknown Company Insufficient fulfilment of data subjects rights	🇪🇺 Data Protection Authority of Brandenburg	Art. 15 Art. 28	€50,000
2018-12-17	Kolibri Image Regina und Dirk Maass GbR Insufficient data processing agreement	🇪🇺 Data Protection Authority of Hamburg	Art. 28	€5,000

← previous 176–181 of 181