Article 5 GDPR — enforcement

Cited in 1,893 decisions · €202.4B total fines · median €10,000 · top authority: 🇪🇺Spanish Data Protection Authority (aepd) (541)

Read Article 5 GDPR →

Date ↓	Company / party	Authority	Articles	Fine
2026-07-03	University of Pisa Insufficient technical and organisational measures to ensure information security	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 25 Art. 32	€15,000
2026-07-03	Giuliano Isontina University Health Authority Insufficient technical and organisational measures to ensure information security	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 9 Art. 25 Art. 32	€10,000
2026-07-03	Municipality of San Genesio and Uniti Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9	€2,000
2026-07-03	Municipality of Villaputzu Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6	€2,000
2026-07-01	Persónuvernd (Island) - 2025010358	🇮🇸 Persónuvernd (Island)	Art. 51 Art. 5 Art. 52 Art. 321	—
2026-06-24	Persónuvernd (Iceland) - 2025010364	🇮🇸 Persónuvernd (Iceland)	Art. 51 Art. 5 Art. 51 Art. 51	—
2026-06-19	InMedica UAB Insufficient technical and organisational measures to ensure information security	🇱🇹 Lithuanian Data Protection Authority (VDAI)	Art. 24 Art. 32 Art. 5	€450,000
2026-06-19	VDAI fines medical company €450,000 for inadequate security measures in data breaches	🇱🇹 VDAI (Lithuania)	Art. 51 Art. 5 Art. 241 Art. 24	€450,000
2026-06-19	Estonian DPA: website republishing public authority documents independently liable under	🇪🇪 AKI (Estonia)	Art. 52 Art. 5 Art. 61 Art. 6	—
2026-06-18	Garante per la protezione dei dati personali (Italy) - 476/2026	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 123 Art. 12 Art. 17 Art. 6	€460,000
2026-06-18	Enna Provincial Health Authority Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 10 Art. 12	€20,000
2026-06-18	Docplanner Italy S.r.l. Insufficient technical and organisational measures to ensure information security	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 32	€10,000
2026-06-18	Garante per la protezione dei dati personali (Italy) - 462/2026	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 21 Art. 2 Art. 41 Art. 4	€6,600
2026-06-18	Cosmint S.p.A. Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 13	€6,600
2026-06-18	Garante per la protezione dei dati personali (Italy) - 457/2026	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 51 Art. 61	€5,000
2026-06-18	Edizioni Grandangolo di Giuseppe Castaldo Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 12 Art. 13 Art. 24	€2,075
2026-06-13	Sole trader providing accounting and tax advisory services Insufficient technical and organisational measures to ensure information security	🇵🇱 Polish National Personal Data Protection Office (UODO)	Art. 5 Art. 25 Art. 32	€2,760
2026-06-13	UODO fines accounting firm €2,760 for email breach security failures	🇵🇱 UODO (Poland)	Art. 51 Art. 5 Art. 52 Art. 241	€2,760
2026-06-12	Market-In Non-compliance with general data processing principles	🇬🇷 Hellenic Data Protection Authority (HDPA)	Art. 5 Art. 12 Art. 13 Art. 15	€95,000
2026-06-12	MEDE S.A. Non-compliance with general data processing principles	🇬🇷 Hellenic Data Protection Authority (HDPA)	Art. 5 Art. 12 Art. 13 Art. 15	€65,000
2026-06-11	Midlands Regional Hospital Tullamore, County Offaly Insufficient technical and organisational measures to ensure information security	🇮🇪 Data Protection Authority of Ireland	Art. 5 Art. 28 Art. 30 Art. 32	€300,000
2026-06-11	Green Partner S.r.l.s. Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 12	€15,300
2026-06-11	Lecce Local Health Authority Insufficient technical and organisational measures to ensure information security	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 29 Art. 32	€4,500
2026-06-11	Pietro d'Abano State Vocational School Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6	€1,000
2026-06-11	UODO reprimands hospital for inadequate processor oversight and email security failures	🇵🇱 UODO (Poland)	Art. 51 Art. 5 Art. 52 Art. 241	—

← previous 76–100 of 1,893 next →