Article 38 GDPR — enforcement

Cited in 35 decisions · €10.0M total fines · median €22,350 · top authority: 🇪🇺Polish National Personal Data Protection Office (UODO) (8)

Read Article 38 GDPR →

Date ↓	Company / party	Authority	Articles	Fine
2022-06-29	Persónuvernd (Iceland) - 2020061979	🇮🇸 Persónuvernd (Iceland)	Art. 38 Art. 39	—
2022-06-09	Garante per la protezione dei dati personali (Italy) - 9794895	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 51 Art. 52	€26,000
2022-05-12	Villabate municipality Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 37 Art. 38	€6,000
2021-12-16	Bank Insufficient involvement of data protection officer	🇪🇺 Belgian Data Protection Authority (APD)	Art. 38	€75,000
2021-10-27	Company Insufficient involvement of data protection officer	🇪🇺 National Commission for Data Protection (CNPD)	Art. 37 Art. 38 Art. 39	€18,700
2021-10-27	LUXEMBOURG DPA: Insufficient involvement of data protection officer Insufficient involvement of data protection officer	🇪🇺 National Commission for Data Protection (CNPD)	Art. 38 Art. 39	€15,400
2021-10-13	LUXEMBOURG DPA: Insufficient involvement of data protection officer Insufficient involvement of data protection officer	🇪🇺 National Commission for Data Protection (CNPD)	Art. 37 Art. 38 Art. 39	€18,000
2021-10-13	LUXEMBOURG DPA: Insufficient involvement of data protection officer Insufficient involvement of data protection officer	🇪🇺 National Commission for Data Protection (CNPD)	Art. 38 Art. 39	€13,200
2021-06-11	LUXEMBOURG DPA: Insufficient involvement of data protection officer Insufficient involvement of data protection officer	🇪🇺 National Commission for Data Protection (CNPD)	Art. 38 Art. 39	€15,000
2021-05-31	LUXEMBOURG DPA: Insufficient involvement of data protection officer Insufficient involvement of data protection officer	🇪🇺 National Commission for Data Protection (CNPD)	Art. 38 Art. 39	€18,000

← previous 26–35 of 35