Article 35 GDPR — enforcement

Cited in 88 decisions · €509.0M total fines · median €55,000 · top authority: 🇪🇺Italian Data Protection Authority (Garante) (31)

Read Article 35 GDPR →

Date ↓	Company / party	Authority	Articles	Fine
2026-04-17	Poste Italiane S.p.a. Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 13 Art. 25	€6,624,000
2026-04-17	Postepay S.p.a. Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 13 Art. 25	€5,877,000
2026-03-01	HOLY MARY CATHOLIC SCHOOL, S.L. Insufficient legal basis for data processing	🇪🇸 Spanish Data Protection Authority (aepd)	Art. 5 Art. 6 Art. 35	€12,000
2026-02-26	Depac Società Cooperativa Sociale a r.l. Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 9 Art. 13 Art. 30	€15,000
2026-02-23	Reddit, Inc. Non-compliance with general data processing principles	🇬🇧 Information Commissioner (ICO)	Art. 5 Art. 6 Art. 8 Art. 35	€16,610,000
2026-02-12	Comune di Coccaglio Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 12 Art. 13	€6,000
2026-02-12	Comune di Mazara del Vallo Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 12 Art. 13	€4,000
2026-01-29	Ministero della Cultura Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 12 Art. 13	€12,000
2026-01-29	Istituto San Giuseppe La Salle di Milano Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 12 Art. 13	€12,000
2025-12-30	Company Non-compliance with general data processing principles	🇪🇺 French Data Protection Authority (CNIL)	Art. 6 Art. 13 Art. 32 Art. 35	€3,500,000
2025-12-18	Comune di Nave Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 12 Art. 13	€6,000
2025-12-04	Comune di Tuscania Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 12 Art. 13	€12,000
2025-11-13	Comune di Orte Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 12 Art. 13	€6,000
2025-11-13	Comune di Orte Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 12 Art. 13	€6,000
2025-11-06	Aena, S.M.E., S.A. Non-compliance with general data processing principles	🇪🇺 Spanish Data Protection Authority (aepd)	Art. 35	€10,043,002
2025-11-06	Aena, S.M.E., S.A. Non-compliance with general data processing principles	🇪🇺 Spanish Data Protection Authority (aepd)	Art. 35	€10,043,002
2025-10-23	Comune di Curtarolo Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 12 Art. 13	€15,000
2025-10-23	Comune di Curtarolo Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 12 Art. 13	€15,000
2025-09-25	Provincia Autonoma di Bolzano Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 12 Art. 13	€32,000
2025-09-25	Provincia Autonoma di Bolzano Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 12 Art. 13	€32,000
2025-07-10	Nursery School “La Combricola Dei Birichini Di Betty” Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 12	€10,000
2025-07-10	Nursery School “La Combricola Dei Birichini Di Betty” Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 12	€10,000
2025-06-26	SIDECU, S.A. Non-compliance with general data processing principles	🇪🇺 Spanish Data Protection Authority (aepd)	Art. 9 Art. 13 Art. 35	€96,000
2025-06-26	SIDECU, S.A. Non-compliance with general data processing principles	🇪🇺 Spanish Data Protection Authority (aepd)	Art. 9 Art. 13 Art. 35	€96,000
2025-06-12	Departement of Social Security Insufficient legal basis for data processing	🇪🇺 Data Protection Authority of Ireland	Art. 5 Art. 6 Art. 9 Art. 13	€550,000

1–25 of 88 next →