Article 5 GDPR — enforcement

Cited in 1,784 decisions · €2.0B total fines · median €10,000 · top authority: 🇪🇺Spanish Data Protection Authority (aepd) (541)

Read Article 5 GDPR →

Date ↓	Company / party	Authority	Articles	Fine
2026-08-12	AEPD (Spain) - PS/00249/2025	🇪🇸 AEPD (Spain)	Art. 411 Art. 4 Art. 52 Art. 5	€10,000
2026-07-27	AEPD fines El Español for disclosing minor's identity in assault video	🇪🇸 AEPD (Spain)	Art. 51 Art. 5 Art. 52 Art. 25	€20,000
2026-07-24	HDPA (Greece) 33/2020 — Employee's access and erasure claims against the American College	🇬🇷 HDPA (Greece)	Art. 47 Art. 4 Art. 5 Art. 12	€2,000
2026-07-22	Tietosuojavaltuutetun toimisto (Finland) - TSV/4630/2023	🇫🇮 Tietosuojavaltuutetun toimisto (Finland)	Art. 51 Art. 5 Art. 122 Art. 12	—
2026-07-20	Italian DPA: Justice Ministry unlawful disclosure of employee health data in service order	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 49 Art. 4 Art. 410 Art. 415	€12,000
2026-07-18	Italian DPA: Enna Health Authority violated GDPR by publishing judicial data	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 5 Art. 51 Art. 51 Art. 6	€20,000
2026-07-17	APDCAT sanctions Madremanya City Council for exposing applicants' sensitive data in tender	🇪🇸 APDCAT (Catalonia)	Art. 51 Art. 5 Art. 51 Art. 31	—
2026-07-17	AEPD: No fine for surveillance cameras facing public road; no evidence of rights	🇪🇸 AEPD (Spain)	Art. 51 Art. 5 Art. 12 Art. 15	—
2026-07-16	AEPD fines Alkora, S.A. for ransomware breach exposing 40,000 individuals' data	🇪🇸 AEPD (Spain)	Art. 51 Art. 5 Art. 35 Art. 582	€200,000
2026-07-16	Italian Garante sanctions Calabrian agency for location tracking of remote workers	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 51 Art. 51	€50,000
2026-07-16	Italian Garante: OPI of Pisa must remove residential addresses from public register	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 1 Art. 51 Art. 5 Art. 51	€16,000
2026-07-16	AEPD investigates University of Navarra over student COVID-19 vaccination status requests	🇪🇸 AEPD (Spain)	Art. 415 Art. 4 Art. 51 Art. 5	—
2026-07-14	Italian DPA sanctions Lusha Systems for processing contact data without consent in B2B	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 32 Art. 3 Art. 32 Art. 51	€2,000,000
2026-07-13	AEPD: Digi Telecom violated Art 6(1) GDPR by issuing duplicate SIM to impersonator	🇪🇸 AEPD (Spain)	Art. 52 Art. 5 Art. 61 Art. 6	€140
2026-07-03	Italian Garante sanctions Hera Comm for automated credit-check refusals of contracts	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 13 Art. 14	€5,800,000
2026-07-03	Italian Garante sanctions EstEnergy for automated creditworthiness scoring in energy	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 51 Art. 51	€1,400,000
2026-07-03	Italian DPA finds GDPR applies to US-based Character.AI service	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 32 Art. 3 Art. 52 Art. 5	€158,000
2026-07-01	Persónuvernd examines BL ehf over alleged unlawful employee monitoring via shared OneDrive	🇮🇸 Persónuvernd (Island)	Art. 51 Art. 5 Art. 52 Art. 321	—
2026-06-19	VDAI (Lithuania) - 3R-1143	🇱🇹 VDAI (Lithuania)	Art. 51 Art. 5 Art. 241 Art. 24	€450,000
2026-06-18	Garante: Piaggio violated GDPR by accessing former employees' emails in disciplinary probe	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 123 Art. 12 Art. 17 Art. 6	€460,000
2026-06-18	Italian Garante: Employer's recording of locker opening and destruction of contents	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 21 Art. 2 Art. 41 Art. 4	€6,600
2026-06-18	Italian DPA: Vasto municipality breached transparency duties over traffic cameras	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 51 Art. 61	€5,000
2026-06-13	UODO (Poland) - DKN.5131.34.2023	🇵🇱 UODO (Poland)	Art. 51 Art. 5 Art. 52 Art. 241	€2,760
2026-06-12	Market-In Non-compliance with general data processing principles	🇬🇷 Hellenic Data Protection Authority (HDPA)	Art. 5 Art. 12 Art. 13 Art. 15	€95,000
2026-06-12	MEDE S.A. Non-compliance with general data processing principles	🇬🇷 Hellenic Data Protection Authority (HDPA)	Art. 5 Art. 12 Art. 13 Art. 15	€65,000

1–25 of 1,784 next →