Article 32 GDPR — enforcement

Cited in 825 decisions · €200.5B total fines · median €17,300 · top authority: 🇪🇺Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) (175)

Read Article 32 GDPR →

Date ↓	Company / party	Authority	Articles	Fine
2026-07-08	IP (Slovenia) - 0609-36/2026/7	🇸🇮 IP (Slovenia)	Art. 32	€1,198
2026-07-03	ANSPDCP (Romania) - 02/07/2026	🇷🇴 ANSPDCP (Romania)	Art. 321 Art. 32 Art. 322 Art. 324	€26,172
2026-07-03	University of Pisa Insufficient technical and organisational measures to ensure information security	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 25 Art. 32	€15,000
2026-07-03	Giuliano Isontina University Health Authority Insufficient technical and organisational measures to ensure information security	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 9 Art. 25 Art. 32	€10,000
2026-07-02	Banca Transilvania S.A. Insufficient technical and organisational measures to ensure information security	🇷🇴 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 32	€5,000
2026-07-01	Persónuvernd (Island) - 2025010358	🇮🇸 Persónuvernd (Island)	Art. 51 Art. 5 Art. 52 Art. 321	—
2026-06-19	InMedica UAB Insufficient technical and organisational measures to ensure information security	🇱🇹 Lithuanian Data Protection Authority (VDAI)	Art. 24 Art. 32 Art. 5	€450,000
2026-06-18	Docplanner Italy S.r.l. Insufficient technical and organisational measures to ensure information security	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 32	€10,000
2026-06-18	Altex Romania S.R.L Insufficient technical and organisational measures to ensure information security	🇷🇴 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 32 Art. 33 Art. 34	€10,000
2026-06-18	Edizioni Grandangolo di Giuseppe Castaldo Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 12 Art. 13 Art. 24	€2,075
2026-06-15	SSG SELECT SOLUTIONS S.R.L Insufficient technical and organisational measures to ensure information security	🇷🇴 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 29 Art. 32	€2,000
2026-06-13	UODO fines accounting firm €2,760 for email breach security failures	🇵🇱 UODO (Poland)	Art. 51 Art. 5 Art. 52 Art. 241	€2,760
2026-06-13	Sole trader providing accounting and tax advisory services Insufficient technical and organisational measures to ensure information security	🇵🇱 Polish National Personal Data Protection Office (UODO)	Art. 5 Art. 25 Art. 32	€2,760
2026-06-12	Națională Poșta Română Insufficient technical and organisational measures to ensure information security	🇷🇴 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 32	€5,000
2026-06-11	Midlands Regional Hospital Tullamore, County Offaly Insufficient technical and organisational measures to ensure information security	🇮🇪 Data Protection Authority of Ireland	Art. 5 Art. 28 Art. 30 Art. 32	€300,000
2026-06-11	Lecce Local Health Authority Insufficient technical and organisational measures to ensure information security	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 29 Art. 32	€4,500
2026-06-11	UODO reprimands hospital for inadequate processor oversight and email security failures	🇵🇱 UODO (Poland)	Art. 51 Art. 5 Art. 52 Art. 241	—
2026-06-02	Public Power Corporation S.A. (DEI) Insufficient legal basis for data processing	🇬🇷 Hellenic Data Protection Authority (HDPA)	Art. 5 Art. 32	€320,000
2026-06-02	Ypiresia 800 Teleperformance Single Member S.A. Insufficient technical and organisational measures to ensure information security	🇬🇷 Hellenic Data Protection Authority (HDPA)	Art. 5 Art. 32	€90,000
2026-06-02	PRELUDE GROUP E.E. Insufficient technical and organisational measures to ensure information security	🇬🇷 Hellenic Data Protection Authority (HDPA)	Art. 28 Art. 29 Art. 32	€80,000
2026-06-02	MEDIATEL Telephone Information Services S.A. Insufficient technical and organisational measures to ensure information security	🇬🇷 Hellenic Data Protection Authority (HDPA)	Art. 32	€45,000
2026-06-02	Minister of Justice Insufficient technical and organisational measures to ensure information security	🇵🇱 Polish National Personal Data Protection Office (UODO)	Art. 32	€23,540
2026-06-02	CQS S.A. Customer-Centric Services Insufficient technical and organisational measures to ensure information security	🇬🇷 Hellenic Data Protection Authority (HDPA)	Art. 32	€20,000
2026-05-29	Unicredit Bank SA Insufficient technical and organisational measures to ensure information security	🇷🇴 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 32 Art. 33	€12,000
2026-05-25	UODO (Poland) - DKN.5131.5.2025	🇵🇱 UODO (Poland)	Art. 241 Art. 24 Art. 251 Art. 25	€21,000

← previous 26–50 of 825 next →