Article 35 GDPR — enforcement

Cited in 95 decisions · €509.4M total fines · median €55,000 · top authority: 🇪🇺Italian Data Protection Authority (Garante) (31)

Read Article 35 GDPR →

Date ↓	Company / party	Authority	Articles	Fine
2026-07-16	AEPD fines Alkora, S.A. for ransomware breach exposing 40,000 individuals' data	🇪🇸 AEPD (Spain)	Art. 51 Art. 5 Art. 35 Art. 582	€200,000
2026-07-16	Italian Garante sanctions Calabrian agency for location tracking of remote workers	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 51 Art. 51	€50,000
2026-07-03	Italian DPA finds GDPR applies to US-based Character.AI service	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 32 Art. 3 Art. 52 Art. 5	€158,000
2026-06-18	Italian DPA: Vasto municipality breached transparency duties over traffic cameras	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 51 Art. 61	€5,000
2026-06-11	UODO (Poland) - DKN.5131.12.2022	🇵🇱 UODO (Poland)	Art. 51 Art. 5 Art. 52 Art. 241	—
2026-05-28	Italian DPA: vehicle tracking by Liguria Health Agency lawful, information duties met	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 51 Art. 51	€6,000
2026-04-17	Poste Italiane S.p.a. Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 13 Art. 25	€6,624,000
2026-04-17	Postepay S.p.a. Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 13 Art. 25	€5,877,000
2026-03-01	HOLY MARY CATHOLIC SCHOOL, S.L. Insufficient legal basis for data processing	🇪🇸 Spanish Data Protection Authority (aepd)	Art. 5 Art. 6 Art. 35	€12,000
2026-02-26	Depac Società Cooperativa Sociale a r.l. Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 9 Art. 13 Art. 30	€15,000
2026-02-23	Reddit, Inc. Non-compliance with general data processing principles	🇬🇧 Information Commissioner (ICO)	Art. 5 Art. 6 Art. 8 Art. 35	€16,610,000
2026-02-12	Comune di Coccaglio Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 12 Art. 13	€6,000
2026-02-12	Comune di Mazara del Vallo Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 12 Art. 13	€4,000
2026-01-29	Istituto San Giuseppe La Salle di Milano Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 12 Art. 13	€12,000
2026-01-29	Ministero della Cultura Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 12 Art. 13	€12,000
2025-12-30	Company Non-compliance with general data processing principles	🇪🇺 French Data Protection Authority (CNIL)	Art. 6 Art. 13 Art. 32 Art. 35	€3,500,000
2025-12-18	Comune di Nave Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 12 Art. 13	€6,000
2025-12-04	Comune di Tuscania Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 12 Art. 13	€12,000
2025-11-13	Comune di Orte Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 12 Art. 13	€6,000
2025-11-13	Comune di Orte Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 12 Art. 13	€6,000
2025-11-06	Aena, S.M.E., S.A. Non-compliance with general data processing principles	🇪🇺 Spanish Data Protection Authority (aepd)	Art. 35	€10,043,002
2025-11-06	Aena, S.M.E., S.A. Non-compliance with general data processing principles	🇪🇺 Spanish Data Protection Authority (aepd)	Art. 35	€10,043,002
2025-10-23	Comune di Curtarolo Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 12 Art. 13	€15,000
2025-10-23	Comune di Curtarolo Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 12 Art. 13	€15,000
2025-09-25	Provincia Autonoma di Bolzano Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 12 Art. 13	€32,000

1–25 of 95 next →