Article 6 GDPR — enforcement

Cited in 1,176 decisions · €922.4M total fines · median €10,000 · top authority: 🇪🇺Spanish Data Protection Authority (aepd) (358)

Read Article 6 GDPR →

Date ↓	Company / party	Authority	Articles	Fine
2026-06-01	Elkjøp AS Insufficient legal basis for data processing	🇳🇴 Norwegian Supervisory Authority (Datatilsynet)	Art. 5 Art. 6 Art. 12	€1,820,000
2026-05-29	Blikk Kft. Insufficient legal basis for data processing	🇭🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)	Art. 6 Art. 9 Art. 12	€70,300
2026-05-26	Mediaworks Hungary Zrt. Insufficient legal basis for data processing	🇭🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)	Art. 6 Art. 9	€140,500
2026-05-20	Elektronikus Egészségügyi Szolgáltatási Tér Insufficient technical and organisational measures to ensure information security	🇭🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)	Art. 5 Art. 6 Art. 9	€1,400
2026-05-12	Technology Company Insufficient legal basis for data processing	🇧🇪 Belgian Data Protection Authority (APD)	Art. 5 Art. 6 Art. 12 Art. 13	€177,000
2026-04-28	SIPHONE 2020, S.L. Insufficient legal basis for data processing	🇪🇸 Spanish Data Protection Authority (aepd)	Art. 6 Art. 13	€4,000
2026-04-23	Accountancy Firm Insufficient legal basis for data processing	🇧🇪 Belgian Data Protection Authority (APD)	Art. 5 Art. 6 Art. 12 Art. 17	€8,500
2026-04-17	Poste Italiane S.p.a. Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 13 Art. 25	€6,624,000
2026-04-17	Postepay S.p.a. Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 13 Art. 25	€5,877,000
2026-04-17	Comune di Campo Calabro Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6	€6,000
2026-04-17	Framos Italia s.r.l. Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 12 Art. 13	€5,000
2026-03-26	Eni S.p.A. Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6	€96,000
2026-03-26	Municipality Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9	€5,000
2026-03-26	Municipality Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9	€3,000
2026-03-26	Piacenza Bar Association Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6	€3,000
2026-03-26	Comune di Cassino Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6	€2,500
2026-03-24	Advertising Agency Insufficient legal basis for data processing	🇦🇹 Austrian Data Protection Authority (dsb)	Art. 5 Art. 6 Art. 13	€6,300
2026-03-20	Domeniul Public și Privat SA Insufficient legal basis for data processing	🇷🇴 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 5 Art. 6 Art. 12 Art. 13	€3,000
2026-03-20	Public and Private Domain SA Insufficient legal basis for data processing	🇷🇴 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 5 Art. 6 Art. 12 Art. 13	€3,000
2026-03-13	RAMÓN GRAU, S.L. Insufficient legal basis for data processing	🇪🇸 Spanish Data Protection Authority (aepd)	Art. 6 Art. 13	€18,000
2026-03-12	Enel Energia S.p.A. Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 24	€563,052
2026-03-12	INPS – Istituto nazionale previdenza sociale Insufficient technical and organisational measures to ensure information security	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9 Art. 10	€40,000
2026-03-12	Liceo Scientifico Morgagni di Roma Insufficient technical and organisational measures to ensure information security	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9 Art. 32	€2,000
2026-03-12	Comune di Sutri Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6	€2,000
2026-03-04	ARES CAPITAL, S.A. Insufficient legal basis for data processing	🇪🇸 Spanish Data Protection Authority (aepd)	Art. 5 Art. 6 Art. 13	€200,000

1–25 of 1,176 next →