Article 35 GDPR — enforcement

Cited in 101 decisions · €509.6M total fines · median €55,000 · top authority: 🇪🇺Italian Data Protection Authority (Garante) (31)

Read Article 35 GDPR →

Date ↓	Company / party	Authority	Articles	Fine
2025-11-13	Comune di Orte Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 12 Art. 13	€6,000
2025-11-06	Aena, S.M.E., S.A. Non-compliance with general data processing principles	🇪🇺 Spanish Data Protection Authority (aepd)	Art. 35	€10,043,002
2025-11-06	Aena, S.M.E., S.A. Non-compliance with general data processing principles	🇪🇺 Spanish Data Protection Authority (aepd)	Art. 35	€10,043,002
2025-10-23	Comune di Curtarolo Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 12 Art. 13	€15,000
2025-10-23	Comune di Curtarolo Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 12 Art. 13	€15,000
2025-09-25	Provincia Autonoma di Bolzano Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 12 Art. 13	€32,000
2025-09-25	Provincia Autonoma di Bolzano Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 12 Art. 13	€32,000
2025-07-10	Nursery School “La Combricola Dei Birichini Di Betty” Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 12	€10,000
2025-07-10	Nursery School “La Combricola Dei Birichini Di Betty” Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 12	€10,000
2025-06-26	SIDECU, S.A. Non-compliance with general data processing principles	🇪🇺 Spanish Data Protection Authority (aepd)	Art. 9 Art. 13 Art. 35	€96,000
2025-06-26	SIDECU, S.A. Non-compliance with general data processing principles	🇪🇺 Spanish Data Protection Authority (aepd)	Art. 9 Art. 13 Art. 35	€96,000
2025-06-12	Departement of Social Security Insufficient legal basis for data processing	🇪🇺 Data Protection Authority of Ireland	Art. 5 Art. 6 Art. 9 Art. 13	€550,000
2025-06-12	Departement of Social Security Insufficient legal basis for data processing	🇪🇺 Data Protection Authority of Ireland	Art. 5 Art. 6 Art. 9 Art. 13	€550,000
2025-04-29	Regione Lombardia Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 25 Art. 28	€50,000
2025-04-29	Regione Lombardia Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 25 Art. 28	€50,000
2025-03-13	Azienda regionale per lo sviluppo e per i servizi in agricoltura (ARSAC) Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 13 Art. 25	€50,000
2025-02-04	Real estate company Non-compliance with general data processing principles	🇪🇺 French Data Protection Authority (CNIL)	Art. 5 Art. 6 Art. 12 Art. 13	€40,000
2025-01-16	Realmaps S.r.l. Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 12	€100,000
2024-12-20	LIGA NACIONAL DE FÚTBOL PROFESIONAL Insufficient technical and organisational measures to ensure information security	🇪🇺 Spanish Data Protection Authority (aepd)	Art. 35	€1,000,000
2024-12-18	Company Insufficient technical and organisational measures to ensure information security	🇪🇺 Polish National Personal Data Protection Office (UODO)	Art. 38 Art. 30 Art. 35	€135,600
2024-12-17	Hospital Insufficient technical and organisational measures to ensure information security	🇪🇺 Belgian Data Protection Authority (APD)	Art. 5 Art. 24 Art. 32 Art. 35	€200,000
2024-12-10	GENERALI ESPAÑA, SOCIEDAD ANONIMA DE SEGUROS Y REASEGUROS Insufficient technical and organisational measures to ensure information security	🇪🇺 Spanish Data Protection Authority (aepd)	Art. 5 Art. 25 Art. 32 Art. 35	€4,000,000
2024-11-22	CARTONAJES BAÑERES, S.A. Insufficient technical and organisational measures to ensure information security	🇪🇺 Spanish Data Protection Authority (aepd)	Art. 15 Art. 35	€220,000
2024-11-22	CARTONAJES BAÑERES, S.A Insufficient technical and organisational measures to ensure information security	🇪🇺 Spanish Data Protection Authority (aepd)	Art. 15 Art. 35	€220,000
2024-11-13	Foodinho Srl Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9 Art. 12	€5,000,000

← previous 26–50 of 101 next →