Article 33 GDPR — enforcement

Cited in 121 decisions · €34.3M total fines · median €20,363 · top authority: 🇪🇺Polish National Personal Data Protection Office (UODO) (25)

Read Article 33 GDPR →

Date ↓	Company / party	Authority	Articles	Fine
2026-05-29	Unicredit Bank SA Insufficient technical and organisational measures to ensure information security	🇷🇴 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 32 Art. 33	€12,000
2026-05-19	UODO (Poland) - DKN.5131.27.2023	🇵🇱 UODO (Poland)	Art. 51 Art. 5 Art. 52 Art. 241	€33,700
2026-05-08	Permanent TSB Insufficient technical and organisational measures to ensure information security	🇮🇪 Data Protection Authority of Ireland	Art. 5 Art. 32 Art. 33	€277,500
2026-04-30	Mayor of the City and Municipality of Myślenice Insufficient fulfilment of data breach notification obligations	🇵🇱 Polish National Personal Data Protection Office (UODO)	Art. 33	€1,790
2026-04-07	Housing Associaction Insufficient fulfilment of data breach notification obligations	🇵🇱 Polish National Personal Data Protection Office (UODO)	Art. 33	€2,350
2026-02-10	Fundację Lumus Non-compliance with general data processing principles	🇵🇱 Polish National Personal Data Protection Office (UODO)	Art. 33 Art. 34 Art. 37 Art. 38	€5,220
2025-12-12	Chief Constable of the Police Service of Scotland Insufficient technical and organisational measures to ensure information security	🇬🇧 Information Commissioner (ICO)	Art. 5 Art. 25 Art. 32 Art. 33	€75,700
2025-12-10	University of Limerick Insufficient technical and organisational measures to ensure information security	🇮🇪 Data Protection Authority of Ireland	Art. 5 Art. 30 Art. 32 Art. 33	€98,000
2025-10-23	Court Bailiff Insufficient fulfilment of data breach notification obligations	🇪🇺 Polish National Personal Data Protection Office (UODO)	Art. 33 Art. 34	€5,000
2025-10-23	Court Bailiff Insufficient fulfilment of data breach notification obligations	🇪🇺 Polish National Personal Data Protection Office (UODO)	Art. 33 Art. 34	€5,000
2025-10-10	AEPD sanctions 23andMe for security failures in credential-stuffing breach	🇪🇸 AEPD (Spain)	Art. 51 Art. 5 Art. 9 Art. 241	—
2025-09-18	SAMARITAINE SAS Non-compliance with general data processing principles	🇪🇺 French Data Protection Authority (CNIL)	Art. 5 Art. 33 Art. 38	€100,000
2025-09-18	SAMARITAINE SAS Non-compliance with general data processing principles	🇪🇺 French Data Protection Authority (CNIL)	Art. 5 Art. 33 Art. 38	€100,000
2025-09-04	Company Insufficient fulfilment of data breach notification obligations	🇪🇺 Austrian Data Protection Authority (dsb)	Art. 33	€870
2025-09-04	Company Insufficient fulfilment of data breach notification obligations	🇪🇺 Austrian Data Protection Authority (dsb)	Art. 33	€870
2025-07-21	Hestia Publishers & Booksellers I. D. Kollaros & Co. S.A. Insufficient technical and organisational measures to ensure information security	🇪🇺 Hellenic Data Protection Authority (HDPA)	Art. 5 Art. 25 Art. 32 Art. 33	€9,000
2025-07-21	Hestia Publishers & Booksellers I. D. Kollaros & Co. S.A. Insufficient technical and organisational measures to ensure information security	🇪🇺 Hellenic Data Protection Authority (HDPA)	Art. 5 Art. 25 Art. 32 Art. 33	€9,000
2025-07-18	ADMINISTRACIONES BENIPON, S.L. Insufficient fulfilment of data breach notification obligations	🇪🇺 Spanish Data Protection Authority (aepd)	Art. 28 Art. 33	€1,100
2025-07-18	ADMINISTRACIONES BENIPON, S.L. Insufficient fulfilment of data breach notification obligations	🇪🇺 Spanish Data Protection Authority (aepd)	Art. 28 Art. 33	€1,100
2025-07-10	Poste Vita S.p.a. Insufficient technical and organisational measures to ensure information security	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 33	€80,000
2025-07-10	Poste Vita S.p.a. Insufficient technical and organisational measures to ensure information security	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 33	€80,000
2025-06-24	Birthlink Insufficient technical and organisational measures to ensure information security	🇪🇺 Information Commissioner (ICO)	Art. 5 Art. 32 Art. 33	€20,725
2025-06-24	Birthlink Insufficient technical and organisational measures to ensure information security	🇪🇺 Information Commissioner (ICO)	Art. 5 Art. 32 Art. 33	€20,725
2025-06-23	City of Dublin Education and Training Board Insufficient technical and organisational measures to ensure information security	🇪🇺 Data Protection Authority of Ireland	Art. 5 Art. 32 Art. 33 Art. 34	€125,000
2025-06-23	City of Dublin Education and Training Board Insufficient technical and organisational measures to ensure information security	🇪🇺 Data Protection Authority of Ireland	Art. 5 Art. 32 Art. 33 Art. 34	€125,000

1–25 of 121 next →