Article 32 GDPR — enforcement

Cited in 780 decisions · €506.8M total fines · median €16,825 · top authority: 🇪🇺Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) (175)

Read Article 32 GDPR →

Date ↓	Company / party	Authority	Articles	Fine
2026-08-11	ANSPDCP (Romania) - Fine against Homelux SRL	🇷🇴 ANSPDCP (Romania)	Art. 321 Art. 32 Art. 322	€108,570
2026-07-29	ANSPDCP (Romania) - Fine against Orange Romania SA of July 17, 2026	🇷🇴 ANSPDCP (Romania)	Art. 251 Art. 25 Art. 321 Art. 32	€523,900
2026-07-08	Slovenian DPA fines controller €1,198 for Art. 32 GDPR breach via pirated software	🇸🇮 IP (Slovenia)	Art. 32	€1,198
2026-07-03	ANSPDCP fines Banca Transilvania RON 26,172 for inadequate security over unauthorized	🇷🇴 ANSPDCP (Romania)	Art. 321 Art. 32 Art. 322 Art. 324	€26,172
2026-07-01	Persónuvernd examines BL ehf over alleged unlawful employee monitoring via shared OneDrive	🇮🇸 Persónuvernd (Island)	Art. 51 Art. 5 Art. 52 Art. 321	—
2026-06-15	SSG SELECT SOLUTIONS S.R.L Insufficient technical and organisational measures to ensure information security	🇷🇴 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 29 Art. 32	€2,000
2026-06-13	UODO (Poland) - DKN.5131.34.2023	🇵🇱 UODO (Poland)	Art. 51 Art. 5 Art. 52 Art. 241	€2,760
2026-06-12	Națională Poșta Română Insufficient technical and organisational measures to ensure information security	🇷🇴 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 32	€5,000
2026-06-11	Midlands Regional Hospital Tullamore, County Offaly Insufficient technical and organisational measures to ensure information security	🇮🇪 Data Protection Authority of Ireland	Art. 5 Art. 28 Art. 30 Art. 32	€300,000
2026-06-11	UODO (Poland) - DKN.5131.12.2022	🇵🇱 UODO (Poland)	Art. 51 Art. 5 Art. 52 Art. 241	—
2026-06-02	HDPA fines DEI for unlawful telemarketing calls to opt-out registered subscribers	🇬🇷 HDPA (Greece)	Art. 51 Art. 5 Art. 51 Art. 51	€880,000
2026-06-02	Minister of Justice Insufficient technical and organisational measures to ensure information security	🇵🇱 Polish National Personal Data Protection Office (UODO)	Art. 32	€23,540
2026-05-29	Unicredit Bank SA Insufficient technical and organisational measures to ensure information security	🇷🇴 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 32 Art. 33	€12,000
2026-05-25	UODO (Poland) - DKN.5131.5.2025	🇵🇱 UODO (Poland)	Art. 241 Art. 24 Art. 251 Art. 25	€21,000
2026-05-19	UODO (Poland) - DKN.5131.27.2023	🇵🇱 UODO (Poland)	Art. 51 Art. 5 Art. 52 Art. 241	€33,700
2026-05-08	Permanent TSB Insufficient technical and organisational measures to ensure information security	🇮🇪 Data Protection Authority of Ireland	Art. 5 Art. 32 Art. 33	€277,500
2026-05-07	South Staffordshire Plc Insufficient technical and organisational measures to ensure information security	🇬🇧 Information Commissioner (ICO)	Art. 5 Art. 32	€1,112,100
2026-05-01	Slovenian DPA fines processor €2,802 for failing to patch known vulnerability (Art. 32)	🇸🇮 IP (Slovenia)	Art. 32	€2,802
2026-04-30	BLUE PROJECTS INDUSTRIES S.R.L. Insufficient technical and organisational measures to ensure information security	🇷🇴 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 32	€2,500
2026-04-17	Poste Italiane S.p.a. Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 13 Art. 25	€6,624,000
2026-04-17	Postepay S.p.a. Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 13 Art. 25	€5,877,000
2026-04-17	Business Owner Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 13 Art. 32	€2,000
2026-04-13	UODO (Poland) - DKN.5131.7.2022	🇵🇱 UODO (Poland)	Art. 51 Art. 5 Art. 52 Art. 241	€2,415
2026-04-13	Sub Agent Insufficient technical and organisational measures to ensure information security	🇵🇱 Polish National Personal Data Protection Office (UODO)	Art. 28 Art. 32	€2,415
2026-04-03	BLUE PROJECTS S.R.L. Insufficient technical and organisational measures to ensure information security	🇷🇴 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 32	€2,500

1–25 of 780 next →