Article 32 GDPR — enforcement
Cited in 827 decisions · €200.5B total fines · median €17,300 · top authority: 🇪🇺Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) (175)
| Date ↓ | Company / party | Authority | Articles | Fine |
|---|---|---|---|---|
| 2022-10-06 | Servizio Idrico Integrato S.c.p.a. Insufficient technical and organisational measures to ensure information security | 🇪🇺 Italian Data Protection Authority (Garante) | Art. 5Art. 32 | €15,000 |
| 2022-10-04 | Club Náutico el Estacio Insufficient technical and organisational measures to ensure information security | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 5Art. 32 | €6,000 |
| 2022-09-28 | BAYARD REVISTAS, S.A. Insufficient technical and organisational measures to ensure information security | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 5Art. 32Art. 33 | €31,200 |
| 2022-09-22 | Bitfactor SRL Insufficient technical and organisational measures to ensure information security | 🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) | Art. 25Art. 32 | €2,000 |
| 2022-09-21 | Curtea Veche Publishing SRL Insufficient technical and organisational measures to ensure information security | 🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) | Art. 32 | €5,000 |
| 2022-09-19 | Banca Comercială Română SA Insufficient technical and organisational measures to ensure information security | 🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) | Art. 25Art. 32 | €2,000 |
| 2022-09-13 | GIE INFOGREFFE Insufficient technical and organisational measures to ensure information security | 🇪🇺 French Data Protection Authority (CNIL) | Art. 5Art. 32 | €250,000 |
| 2022-09-12 | Hørsholm municipality Insufficient technical and organisational measures to ensure information security | 🇪🇺 Danish Data Protection Authority (Datatilsynet) | Art. 32 | €6,700 |
| 2022-09-08 | Realmedia Network SA Insufficient technical and organisational measures to ensure information security | 🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) | Art. 32 | €8,000 |
| 2022-08-29 | Alpha Bank Romania SA Insufficient technical and organisational measures to ensure information security | 🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) | Art. 29Art. 32 | €1,000 |
| 2022-08-28 | NATURGY ENERGY GROUP, S.A. Non-compliance with general data processing principles | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 5Art. 32 | €48,000 |
| 2022-08-23 | Company Insufficient technical and organisational measures to ensure information security | 🇪🇺 Belgian Data Protection Authority (APD) | Art. 5Art. 24Art. 32 | €2,500 |
| 2022-08-22 | Enel Energie Muntenia S.A. Insufficient technical and organisational measures to ensure information security | 🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) | Art. 32 | €10,000 |
| 2022-08-22 | UNONO NET 3.0, S.L. Non-compliance with general data processing principles | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 5Art. 32 | €900 |
| 2022-08-19 | ACCOR SA Insufficient fulfilment of data subjects rights | 🇪🇺 French Data Protection Authority (CNIL) | Art. 12Art. 13Art. 15Art. 21 | €600,000 |
| 2022-08-19 | Medical laboratory Insufficient technical and organisational measures to ensure information security | 🇪🇺 Belgian Data Protection Authority (APD) | Art. 5Art. 12Art. 13Art. 14 | €20,000 |
| 2022-08-11 | Lolland municipiality Insufficient technical and organisational measures to ensure information security | 🇪🇺 Danish Data Protection Authority (Datatilsynet) | Art. 32 | €6,700 |
| 2022-08-04 | JAÉN SENTIDO Y COMÚN Insufficient technical and organisational measures to ensure information security | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 5Art. 32 | €2,000 |
| 2022-07-29 | ESTUDIOS EUROPEOS DE POSTGRADO Y EMPRESA, S.L. Insufficient technical and organisational measures to ensure information security | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 5Art. 32 | €3,000 |
| 2022-07-21 | Telecommunications company Insufficient technical and organisational measures to ensure information security | 🇪🇺 Croatian Data Protection Authority (azop) | Art. 25Art. 32 | €285,000 |
| 2022-07-21 | Azienda Socio Sanitaria Territoriale Rhodense Insufficient technical and organisational measures to ensure information security | 🇪🇺 Italian Data Protection Authority (Garante) | Art. 5Art. 32 | €3,000 |
| 2022-07-19 | Bookstore employee Insufficient technical and organisational measures to ensure information security | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 5Art. 32 | €4,000 |
| 2022-07-14 | SIRIUS (law firm) Insufficient technical and organisational measures to ensure information security | 🇪🇺 Danish Data Protection Authority (Datatilsynet) | Art. 32 | €67,200 |
| 2022-07-13 | Manx Care Ltd Non-compliance with general data processing principles | 🇪🇺 Information Commissioner of Isle of Man | Art. 5Art. 24Art. 25Art. 32 | €202,000 |
| 2022-07-13 | DKV Seguros y Reaseguros, S.A.E. Insufficient technical and organisational measures to ensure information security | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 5Art. 32Art. 33 | €132,000 |