Article 44 GDPR — enforcement

Cited in 12 decisions · €129.8M total fines · median €2,650,000 · top authority: 🇪🇺Croatian Data Protection Authority (azop) (2)

Read Article 44 GDPR →

Date ↓	Company / party	Authority	Articles	Fine
2026-04-01	Ridetech International B.V. Insufficient legal basis for data processing	🇪🇺 Dutch Supervisory Authority for Data Protection (AP)	Art. 5 Art. 44 Art. 46	€100,000,000
2025-11-24	Telecommunications operator (operator of electronic communications networks and services) Non-compliance with general data processing principles	🇪🇺 Croatian Data Protection Authority (azop)	Art. 5 Art. 6 Art. 12 Art. 13	€4,500,000
2025-11-24	Telecommunications operator (operator of electronic communications networks and services) Non-compliance with general data processing principles	🇪🇺 Croatian Data Protection Authority (azop)	Art. 5 Art. 6 Art. 12 Art. 13	€4,500,000
2023-10-25	ENDESA ENERGÍA, S.A.U. Non-compliance with general data processing principles	🇪🇺 Spanish Data Protection Authority (aepd)	Art. 5 Art. 32 Art. 33 Art. 34	€6,100,000
2023-08-01	Legal Person Insufficient legal basis for data processing	🇪🇺 Czech Data Protection Auhtority (UOOU)	Art. 6 Art. 13 Art. 44	€3,570
2023-06-30	Tele2 Sverige Aktiebolag Insufficient technical and organisational measures to ensure information security	🇪🇺 Data Protection Authority of Sweden	Art. 44	€1,000,000
2023-06-30	CDON AB Insufficient technical and organisational measures to ensure information security	🇪🇺 Data Protection Authority of Sweden	Art. 44	€25,000
2022-11-02	Portuguese National Statistical Institute Non-compliance with general data processing principles	🇪🇺 Portuguese Data Protection Authority (CNPD)	Art. 5 Art. 9 Art. 12 Art. 13	€4,300,000
2021-09-27	Ferde AS Non-compliance with general data processing principles	🇪🇺 Norwegian Supervisory Authority (Datatilsynet)	Art. 5 Art. 28 Art. 32 Art. 44	€496,000
2021-09-16	Bocconi University Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9 Art. 13	€200,000
2021-03-11	Vodafone España, S.A.U. Insufficient fulfilment of data subjects rights	🇪🇺 Spanish Data Protection Authority (aepd)	Art. 28 Art. 24 Art. 44 Art. 21	€8,150,000
2019-11-21	Futura Internationale Insufficient fulfilment of data subjects rights	🇪🇺 French Data Protection Authority (CNIL)	Art. 5 Art. 6 Art. 13 Art. 14	€500,000