Article 5 GDPR — enforcement

Cited in 1,886 decisions · €202.4B total fines · median €10,000 · top authority: 🇪🇺Spanish Data Protection Authority (aepd) (541)

Read Article 5 GDPR →

Date ↓	Company / party	Authority	Articles	Fine
2026-10-01	DSB (Austria) - 2026-0.690.562	🇦🇹 Datenschutzbehörde	Art. 5	—
2026-09-30	Italian DPA: Municipality of Aprilia unlawfully disclosed whistleblower data to employer	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 51 Art. 51	€5,000
2026-09-30	Icelandic DPA opens formal proceedings against Isavia over ANPR parking cameras at	🇮🇸 Persónuvernd (Island)	Art. 51 Art. 5 Art. 12 Art. 13	—
2026-09-29	Garante: Bologna University Hospital rightly refused erasure of recruitment ranking data	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 5 Art. 6 Art. 9	€30,000
2026-09-23	AEPD sanctions Vodafone España for inadequate Super WiFi processor agreement and oversight	🇪🇸 AEPD (Spain)	Art. 51 Art. 5 Art. 28 Art. 32	€750,000
2026-09-23	Persónuvernd: Icelandic Farmers’ Association breached GDPR by disclosing owner data to	🇮🇸 Persónuvernd (Iceland)	Art. 51 Art. 5 Art. 14	—
2026-09-21	Google Ireland Limited Insufficient legal basis for data processing	🇮🇪 Data Protection Commission (DPC)	Art. 5 Art. 6 Art. 12 Art. 13	€403,000,000
2026-09-17	Icelandic DPA: City of Reykjavik cannot request bank statements from NPA disabled service	🇮🇸 Persónuvernd (Iceland)	Art. 51 Art. 5 Art. 61 Art. 6	—
2026-09-16	Garante fines BBVA Italy for ignoring in-app objection, violating Arts. 5, 12, 21 GDPR	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 12 Art. 21	€5,508,000
2026-09-16	Italian DPA probes University Health Agency Friuli over EHR access and missing logs	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 51 Art. 51	€24,000
2026-09-16	AEPD fines El Español for publishing video of minor assailant without anonymization	🇪🇸 AEPD (Spain)	Art. 51 Art. 5 Art. 52 Art. 25	€20,000
2026-09-16	AEPD fines MÁS SOL ENERGÍA for marketing call to Robinson List subscriber	🇪🇸 AEPD (Spain)	Art. 411 Art. 4 Art. 52 Art. 5	€10,000
2026-09-16	Italian DPA: pool locker surveillance lawful but retention must be 12/24 hours	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 51 Art. 61	€8,000
2026-09-16	Italian DPA: Municipality of Rieti breached GDPR by publishing 31,000 taxpayers' waste	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 51 Art. 51	€6,000
2026-09-16	AEPD fines DIGI Telecom for issuing duplicate SIM to impersonator without consent	🇪🇸 AEPD (Spain)	Art. 52 Art. 5 Art. 61 Art. 6	€140
2026-09-16	Italian DPA sanctions Experian Italia for incomplete Art. 15 GDPR access responses on	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 51 Art. 12	€120
2026-09-15	APDCAT: Public body violated GDPR by disclosing audio recording to four extra recipients	🇪🇸 APDCAT (Catalonia)	Art. 51 Art. 5 Art. 6 Art. 12	€3,150
2026-09-15	HDPA investigates Greek Infrastructure Ministry for SMS sent without consent or	🇬🇷 HDPA (Greece)	Art. 51 Art. 5 Art. 14	—
2026-09-15	AEPD: Data subject entitled to identity of professionals who accessed medical records	🇪🇸 AEPD (Spain)	Art. 51 Art. 5 Art. 52 Art. 12	—
2026-09-10	Italian DPA sanctions Top Secret Investigazioni for unjustified email forwarding after	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 51 Art. 51	€6,500
2026-09-09	Italian DPA finds Ministry of Education's disclosure of disciplinary dismissal excessive	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 61 Art. 6	€10,000
2026-09-08	Garante per la protezione dei dati personali (Italy) - 551/2026	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 5 Art. 6 Art. 9	€10,000
2026-09-08	AEPD (Spain) - ps-0035-2025	🇪🇸 AEPD (Spain)	Art. 51 Art. 5	€160
2026-09-03	Banco Bilbao Vizcaya Argentaria S.A. Insufficient fulfilment of data subjects rights	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 12 Art. 21 Art. 24	€5,508,000
2026-09-03	Friuli Centrale University Health Authority Insufficient technical and organisational measures to ensure information security	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 9 Art. 25 Art. 32	€24,000

1–25 of 1,886 next →