Article 5 GDPR — enforcement

Cited in 1,715 decisions · €1.8B total fines · median €10,000 · top authority: 🇪🇺Spanish Data Protection Authority (aepd) (541)

Read Article 5 GDPR →

Date ↓	Company / party	Authority	Articles	Fine
2026-06-01	Elkjøp AS Insufficient legal basis for data processing	🇳🇴 Norwegian Supervisory Authority (Datatilsynet)	Art. 5 Art. 6 Art. 12	€1,820,000
2026-05-20	Elektronikus Egészségügyi Szolgáltatási Tér Insufficient technical and organisational measures to ensure information security	🇭🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)	Art. 5 Art. 6 Art. 9	€1,400
2026-05-12	Technology Company Insufficient legal basis for data processing	🇧🇪 Belgian Data Protection Authority (APD)	Art. 5 Art. 6 Art. 12 Art. 13	€177,000
2026-05-12	Isabel SA Insufficient fulfilment of data subjects rights	🇧🇪 Belgian Data Protection Authority (APD)	Art. 5 Art. 12 Art. 13 Art. 15	€120,000
2026-05-12	Société Wallonne des Eaux Insufficient legal basis for data processing	🇧🇪 Belgian Data Protection Authority (APD)	Art. 5 Art. 12 Art. 13 Art. 28	€86,000
2026-05-08	Permanent TSB Insufficient technical and organisational measures to ensure information security	🇮🇪 Data Protection Authority of Ireland	Art. 5 Art. 32 Art. 33	€277,500
2026-05-08	Law Firm Insufficient fulfilment of data subjects rights	🇧🇪 Belgian Data Protection Authority (APD)	Art. 5 Art. 12 Art. 13 Art. 14	€4,920
2026-05-07	South Staffordshire Plc Insufficient technical and organisational measures to ensure information security	🇬🇧 Information Commissioner (ICO)	Art. 5 Art. 32	€1,112,100
2026-04-28	Crowd Entertainment Ltd Insufficient legal basis for data processing	🇷🇴 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 5	€35,000
2026-04-28	Posada del León de Oro Non-compliance with general data processing principles	🇪🇸 Spanish Data Protection Authority (aepd)	Art. 5 Art. 13	€240
2026-04-23	Accountancy Firm Insufficient legal basis for data processing	🇧🇪 Belgian Data Protection Authority (APD)	Art. 5 Art. 6 Art. 12 Art. 17	€8,500
2026-04-22	KONECTA BTO, S.L. Insufficient technical and organisational measures to ensure information security	🇪🇸 Spanish Data Protection Authority (aepd)	Art. 5	€300,000
2026-04-17	Poste Italiane S.p.a. Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 13 Art. 25	€6,624,000
2026-04-17	Postepay S.p.a. Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 13 Art. 25	€5,877,000
2026-04-17	Comune di Campo Calabro Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6	€6,000
2026-04-17	Framos Italia s.r.l. Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 12 Art. 13	€5,000
2026-04-17	Business Owner Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 13 Art. 32	€2,000
2026-04-17	Io e te s.r.l.s. Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 13 Art. 88	€2,000
2026-04-15	Utility Company Insufficient legal basis for data processing	🇸🇮 Slovenian Supervisory Authority (Informacijski pooblaščenec)	Art. 5	€6,600
2026-04-01	Ridetech International B.V. Insufficient legal basis for data processing	🇪🇺 Dutch Supervisory Authority for Data Protection (AP)	Art. 5 Art. 44 Art. 46	€100,000,000
2026-03-26	Intesa Sanpaolo S.p.A. Insufficient technical and organisational measures to ensure information security	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 24 Art. 32 Art. 34	€31,800,000
2026-03-26	Eni S.p.A. Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6	€96,000
2026-03-26	Municipality Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9	€5,000
2026-03-26	Piacenza Bar Association Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6	€3,000
2026-03-26	Municipality Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9	€3,000

1–25 of 1,715 next →