Article 35 GDPR — enforcement

Cited in 102 decisions · €509.6M total fines · median €55,000 · top authority: 🇪🇺Italian Data Protection Authority (Garante) (31)

Read Article 35 GDPR →

Date ↓	Company / party	Authority	Articles	Fine
2026-09-17	Commissioner (Cyprus) - Online Platform “Agora”	🇨🇾 Commissioner (Cyprus)	Art. 31 Art. 35 Art. 36 Art. 582	€6,000
2026-09-02	Datatilsynet authorises AC Horsens facial recognition at matches under conditions	🇩🇰 Datatilsynet (Denmark)	Art. 91 Art. 9 Art. 92 Art. 35	—
2026-09-02	Datatilsynet (Denmark) - 09-07-2026 (Lyngby Boldklub)	🇩🇰 Datatilsynet (Denmark)	Art. 91 Art. 9 Art. 92 Art. 35	—
2026-09-01	Datatilsynet (Denmark) - 09-07-2026 (Lyngby Boldklub)	🇩🇰 Datatilsynet (Denmark)	Art. 91 Art. 9 Art. 92 Art. 35	—
2026-07-16	AEPD (Spain) - PS-00020-2025	🇪🇸 AEPD (Spain)	Art. 51 Art. 5 Art. 35 Art. 582	€200,000
2026-07-16	Garante per la protezione dei dati personali (Italy) - 10128005	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 51 Art. 51	€50,000
2026-07-03	Garante per la protezione dei dati personali (Italy) - 487/2026	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 32 Art. 3 Art. 52 Art. 5	€158,000
2026-07-03	Character Technologies Inc. Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 12 Art. 13 Art. 14	€158,000
2026-06-18	Garante per la protezione dei dati personali (Italy) - 457/2026	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 51 Art. 61	€5,000
2026-06-11	UODO reprimands hospital for inadequate processor oversight and email security failures	🇵🇱 UODO (Poland)	Art. 51 Art. 5 Art. 52 Art. 241	—
2026-06-08	Municipality of Vasto Insufficient fulfilment of information obligations	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 12 Art. 13 Art. 35	€5,000
2026-05-28	Garante per la protezione dei dati personali (Italy) - 382/2026	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 51 Art. 51	€6,000
2026-05-28	Liguria Health Protection Authority Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 25 Art. 35	€6,000
2026-04-17	Poste Italiane S.p.a. Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 13 Art. 25	€6,624,000
2026-04-17	Postepay S.p.a. Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 13 Art. 25	€5,877,000
2026-03-01	HOLY MARY CATHOLIC SCHOOL, S.L. Insufficient legal basis for data processing	🇪🇸 Spanish Data Protection Authority (aepd)	Art. 5 Art. 6 Art. 35	€12,000
2026-02-26	Depac Società Cooperativa Sociale a r.l. Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 9 Art. 13 Art. 30	€15,000
2026-02-23	Reddit, Inc. Non-compliance with general data processing principles	🇬🇧 Information Commissioner (ICO)	Art. 5 Art. 6 Art. 8 Art. 35	€16,610,000
2026-02-12	Comune di Coccaglio Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 12 Art. 13	€6,000
2026-02-12	Comune di Mazara del Vallo Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 12 Art. 13	€4,000
2026-01-29	Ministero della Cultura Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 12 Art. 13	€12,000
2026-01-29	Istituto San Giuseppe La Salle di Milano Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 12 Art. 13	€12,000
2025-12-30	Company Non-compliance with general data processing principles	🇪🇺 French Data Protection Authority (CNIL)	Art. 6 Art. 13 Art. 32 Art. 35	€3,500,000
2025-12-18	Comune di Nave Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 12 Art. 13	€6,000
2025-12-04	Comune di Tuscania Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 12 Art. 13	€12,000

1–25 of 102 next →