Article 33 GDPR — enforcement

Cited in 125 decisions · €34.6M total fines · median €20,000 · top authority: 🇪🇺Polish National Personal Data Protection Office (UODO) (25)

Read Article 33 GDPR →

Date ↓	Company / party	Authority	Articles	Fine
2026-08-19	HDPA: Hellenic Open University found to have met breach notification duties after	🇬🇷 HDPA (Greece)	Art. 32 Art. 33 Art. 34 Art. 582	—
2026-06-18	Altex Romania S.R.L Insufficient technical and organisational measures to ensure information security	🇷🇴 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 32 Art. 33 Art. 34	€10,000
2026-06-18	Edizioni Grandangolo di Giuseppe Castaldo Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 12 Art. 13 Art. 24	€2,075
2026-05-29	Unicredit Bank SA Insufficient technical and organisational measures to ensure information security	🇷🇴 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 32 Art. 33	€12,000
2026-05-19	UODO (Poland) - DKN.5131.27.2023	🇵🇱 UODO (Poland)	Art. 51 Art. 5 Art. 52 Art. 241	€33,700
2026-05-08	Permanent TSB Insufficient technical and organisational measures to ensure information security	🇮🇪 Data Protection Authority of Ireland	Art. 5 Art. 32 Art. 33	€277,500
2026-04-30	Permanent TSB plc Insufficient technical and organisational measures to ensure information security	🇮🇪 Data Protection Authority of Ireland	Art. 5 Art. 32 Art. 33	€277,500
2026-04-30	Mayor of the City and Municipality of Myślenice Insufficient fulfilment of data breach notification obligations	🇵🇱 Polish National Personal Data Protection Office (UODO)	Art. 33	€1,790
2026-04-07	Housing Associaction Insufficient fulfilment of data breach notification obligations	🇵🇱 Polish National Personal Data Protection Office (UODO)	Art. 33	€2,350
2026-02-10	Fundację Lumus Non-compliance with general data processing principles	🇵🇱 Polish National Personal Data Protection Office (UODO)	Art. 33 Art. 34 Art. 37 Art. 38	€5,220
2025-12-12	Chief Constable of the Police Service of Scotland Insufficient technical and organisational measures to ensure information security	🇬🇧 Information Commissioner (ICO)	Art. 5 Art. 25 Art. 32 Art. 33	€75,700
2025-12-10	University of Limerick Insufficient technical and organisational measures to ensure information security	🇮🇪 Data Protection Authority of Ireland	Art. 5 Art. 30 Art. 32 Art. 33	€98,000
2025-10-23	Court Bailiff Insufficient fulfilment of data breach notification obligations	🇪🇺 Polish National Personal Data Protection Office (UODO)	Art. 33 Art. 34	€5,000
2025-10-23	Court Bailiff Insufficient fulfilment of data breach notification obligations	🇪🇺 Polish National Personal Data Protection Office (UODO)	Art. 33 Art. 34	€5,000
2025-10-10	AEPD (Spain) - PS-00140-2025	🇪🇸 AEPD (Spain)	Art. 51 Art. 5 Art. 9 Art. 241	—
2025-09-18	SAMARITAINE SAS Non-compliance with general data processing principles	🇪🇺 French Data Protection Authority (CNIL)	Art. 5 Art. 33 Art. 38	€100,000
2025-09-18	SAMARITAINE SAS Non-compliance with general data processing principles	🇪🇺 French Data Protection Authority (CNIL)	Art. 5 Art. 33 Art. 38	€100,000
2025-09-04	Company Insufficient fulfilment of data breach notification obligations	🇪🇺 Austrian Data Protection Authority (dsb)	Art. 33	€870
2025-09-04	Company Insufficient fulfilment of data breach notification obligations	🇪🇺 Austrian Data Protection Authority (dsb)	Art. 33	€870
2025-07-21	Hestia Publishers & Booksellers I. D. Kollaros & Co. S.A. Insufficient technical and organisational measures to ensure information security	🇪🇺 Hellenic Data Protection Authority (HDPA)	Art. 5 Art. 25 Art. 32 Art. 33	€9,000
2025-07-21	Hestia Publishers & Booksellers I. D. Kollaros & Co. S.A. Insufficient technical and organisational measures to ensure information security	🇪🇺 Hellenic Data Protection Authority (HDPA)	Art. 5 Art. 25 Art. 32 Art. 33	€9,000
2025-07-18	ADMINISTRACIONES BENIPON, S.L. Insufficient fulfilment of data breach notification obligations	🇪🇺 Spanish Data Protection Authority (aepd)	Art. 28 Art. 33	€1,100
2025-07-18	ADMINISTRACIONES BENIPON, S.L. Insufficient fulfilment of data breach notification obligations	🇪🇺 Spanish Data Protection Authority (aepd)	Art. 28 Art. 33	€1,100
2025-07-10	Poste Vita S.p.a. Insufficient technical and organisational measures to ensure information security	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 33	€80,000
2025-07-10	Poste Vita S.p.a. Insufficient technical and organisational measures to ensure information security	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 33	€80,000

1–25 of 125 next →