Article 6 GDPR — enforcement

Cited in 1,273 decisions · €3.4B total fines · median €10,000 · top authority: 🇪🇺Spanish Data Protection Authority (aepd) (358)

Read Article 6 GDPR →

Date ↓	Company / party	Authority	Articles	Fine
2026-09-30	Italian DPA: Municipality of Aprilia unlawfully disclosed whistleblower data to employer	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 51 Art. 51	€5,000
2026-09-29	Garante: Bologna University Hospital rightly refused erasure of recruitment ranking data	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 5 Art. 6 Art. 9	€30,000
2026-09-21	Google Ireland Limited Insufficient legal basis for data processing	🇮🇪 Data Protection Commission (DPC)	Art. 5 Art. 6 Art. 12 Art. 13	€403,000,000
2026-09-17	Icelandic DPA: City of Reykjavik cannot request bank statements from NPA disabled service	🇮🇸 Persónuvernd (Iceland)	Art. 51 Art. 5 Art. 61 Art. 6	—
2026-09-16	Italian DPA: pool locker surveillance lawful but retention must be 12/24 hours	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 51 Art. 61	€8,000
2026-09-16	AEPD fines DIGI Telecom for issuing duplicate SIM to impersonator without consent	🇪🇸 AEPD (Spain)	Art. 52 Art. 5 Art. 61 Art. 6	€140
2026-09-15	APDCAT: Public body violated GDPR by disclosing audio recording to four extra recipients	🇪🇸 APDCAT (Catalonia)	Art. 51 Art. 5 Art. 6 Art. 12	€3,150
2026-09-09	Italian DPA finds Ministry of Education's disclosure of disciplinary dismissal excessive	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 61 Art. 6	€10,000
2026-09-08	Garante per la protezione dei dati personali (Italy) - 551/2026	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 5 Art. 6 Art. 9	€10,000
2026-09-08	AEPD (Spain) - ps-00256-2025	🇪🇸 AEPD (Spain)	Art. 61 Art. 6	€2,000
2026-09-04	Finnish DPA orders Espoo to ensure pupil data protection in Google learning tools	🇫🇮 Tietosuojavaltuutetun toimisto (Finland)	Art. 61 Art. 6	—
2026-09-03	Azienda Speciale per la Gestione degli Impianti Sportivi del Comune di Trento Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 12 Art. 13	€8,000
2026-08-26	DSB: Retailer must grant full access and delete data after third-party fraud order	🇦🇹 DSB (Austria)	Art. 61 Art. 6 Art. 145 Art. 14	—
2026-08-20	Garante per la protezione dei dati personali (Italy) - 10269624	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 61 Art. 6 Art. 7 Art. 123	€280,000
2026-08-19	Garante per la protezione dei dati personali (Italy) - 10266250	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 5 Art. 6 Art. 7 Art. 12	€15,300
2026-08-18	Austrian DSB: Employee who shared customer's phone number acted as GDPR controller	🇦🇹 DSB (Austria)	Art. 51 Art. 5 Art. 51 Art. 47	€1,000
2026-08-13	AEPD (Spain) - ps-00148-2025	🇪🇸 AEPD (Spain)	Art. 61 Art. 6	€200,000
2026-08-12	Datatilsynet ordered Lab Pharma AS to erase influencer's personal data used after	🇳🇴 Datatilsynet (Norway)	Art. 61 Art. 6 Art. 61 Art. 17	€205,000
2026-08-04	Finnish DPA examines anti-doping organization's GDPR compliance over public suspension	🇫🇮 Tietosuojavaltuutetun toimisto (Finland)	Art. 22 Art. 2 Art. 51 Art. 5	—
2026-07-23	Garante per la protezione dei dati personali (Italy) - 556/2026	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 52 Art. 5 Art. 24 Art. 28	€9,516,000
2026-07-23	TIM S.p.A. Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 15	€9,516,000
2026-07-23	Emiglia-Romagna Regional Employment Agency Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9	€30,000
2026-07-23	Monza and Brianza Local Education Authority Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6	€10,000
2026-07-23	Bologna University Hospital IRCCS Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9	€10,000
2026-07-23	Municipality of Terralba Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 24 Art. 25	€8,000

1–25 of 1,273 next →