Skip to content

Article 5 GDPR — enforcement

Cited in 1,893 decisions · €202.4B total fines · median €10,000 · top authority: 🇪🇺Spanish Data Protection Authority (aepd) (541)

Date ↓ Company / party Authority Articles Fine
2026-11-17 AEPD (Spain) - ps-00287-2025 🇪🇸 AEPD (Spain) Art. 51Art. 5 —
2026-10-02 AEPD (Spain) - PS/00339/2024 🇪🇸 AEPD (Spain) Art. 51Art. 5 €100,000
2026-10-01 ANSPDCP (Romania) - TIP TOP FOOD INDUSTRY SRL 🇷🇴 ANSPDCP (Romania) Art. 51Art. 5Art. 9 €26,236
2026-10-01 Garante per la protezione dei dati personali (Italy) - 10297167 🇮🇹 Garante per la protezione dei dati personali (Italy) Art. 51Art. 5Art. 121Art. 12 €10,000
2026-09-30 Italian DPA: Municipality of Aprilia unlawfully disclosed whistleblower data to employer 🇮🇹 Garante per la protezione dei dati personali (Italy) Art. 51Art. 5Art. 51Art. 51 €5,000
2026-09-30 Icelandic DPA opens formal proceedings against Isavia over ANPR parking cameras at 🇮🇸 Persónuvernd (Island) Art. 51Art. 5Art. 12Art. 13 —
2026-09-29 Garante: Bologna University Hospital rightly refused erasure of recruitment ranking data 🇮🇹 Garante per la protezione dei dati personali (Italy) Art. 5Art. 6Art. 9 €30,000
2026-09-23 AEPD sanctions Vodafone España for inadequate Super WiFi processor agreement and oversight 🇪🇸 AEPD (Spain) Art. 51Art. 5Art. 28Art. 32 €750,000
2026-09-23 Persónuvernd: Icelandic Farmers’ Association breached GDPR by disclosing owner data to 🇮🇸 Persónuvernd (Iceland) Art. 51Art. 5Art. 14 —
2026-09-21 Google Ireland Limited
Insufficient legal basis for data processing
🇮🇪 Data Protection Commission (DPC) Art. 5Art. 6Art. 12Art. 13 €403,000,000
2026-09-17 Icelandic DPA: City of Reykjavik cannot request bank statements from NPA disabled service 🇮🇸 Persónuvernd (Iceland) Art. 51Art. 5Art. 61Art. 6 —
2026-09-16 Garante fines BBVA Italy for ignoring in-app objection, violating Arts. 5, 12, 21 GDPR 🇮🇹 Garante per la protezione dei dati personali (Italy) Art. 51Art. 5Art. 12Art. 21 €5,508,000
2026-09-16 Italian DPA probes University Health Agency Friuli over EHR access and missing logs 🇮🇹 Garante per la protezione dei dati personali (Italy) Art. 51Art. 5Art. 51Art. 51 €24,000
2026-09-16 AEPD fines El Español for publishing video of minor assailant without anonymization 🇪🇸 AEPD (Spain) Art. 51Art. 5Art. 52Art. 25 €20,000
2026-09-16 AEPD fines MÁS SOL ENERGÍA for marketing call to Robinson List subscriber 🇪🇸 AEPD (Spain) Art. 411Art. 4Art. 52Art. 5 €10,000
2026-09-16 Italian DPA: pool locker surveillance lawful but retention must be 12/24 hours 🇮🇹 Garante per la protezione dei dati personali (Italy) Art. 51Art. 5Art. 51Art. 61 €8,000
2026-09-16 Italian DPA: Municipality of Rieti breached GDPR by publishing 31,000 taxpayers' waste 🇮🇹 Garante per la protezione dei dati personali (Italy) Art. 51Art. 5Art. 51Art. 51 €6,000
2026-09-16 AEPD fines DIGI Telecom for issuing duplicate SIM to impersonator without consent 🇪🇸 AEPD (Spain) Art. 52Art. 5Art. 61Art. 6 €140
2026-09-16 Italian DPA sanctions Experian Italia for incomplete Art. 15 GDPR access responses on 🇮🇹 Garante per la protezione dei dati personali (Italy) Art. 51Art. 5Art. 51Art. 12 €120
2026-09-16 DSB (Austria) - 2026-0.690.562 🇦🇹 DSB (Austria) Art. 51Art. 5Art. 85Art. 10 —
2026-09-15 APDCAT: Public body violated GDPR by disclosing audio recording to four extra recipients 🇪🇸 APDCAT (Catalonia) Art. 51Art. 5Art. 6Art. 12 €3,150
2026-09-15 HDPA investigates Greek Infrastructure Ministry for SMS sent without consent or 🇬🇷 HDPA (Greece) Art. 51Art. 5Art. 14 —
2026-09-15 AEPD: Data subject entitled to identity of professionals who accessed medical records 🇪🇸 AEPD (Spain) Art. 51Art. 5Art. 52Art. 12 —
2026-09-10 Italian DPA sanctions Top Secret Investigazioni for unjustified email forwarding after 🇮🇹 Garante per la protezione dei dati personali (Italy) Art. 51Art. 5Art. 51Art. 51 €6,500
2026-09-09 Italian DPA finds Ministry of Education's disclosure of disciplinary dismissal excessive 🇮🇹 Garante per la protezione dei dati personali (Italy) Art. 51Art. 5Art. 61Art. 6 €10,000