Article 6 GDPR — enforcement

Cited in 1,220 decisions · €3.0B total fines · median €10,000 · top authority: 🇪🇺Spanish Data Protection Authority (aepd) (358)

Read Article 6 GDPR →

Date ↓	Company / party	Authority	Articles	Fine
2026-04-16	AKI (Estonia) - No. 2.1-1/24/397-890-38	🇪🇪 AKI (Estonia)	Art. 47 Art. 4 Art. 411 Art. 51	—
2026-03-26	Eni S.p.A. Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6	€96,000
2026-03-26	Municipality Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9	€5,000
2026-03-26	Piacenza Bar Association Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6	€3,000
2026-03-26	Municipality Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9	€3,000
2026-03-26	Comune di Cassino Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6	€2,500
2026-03-24	Advertising Agency Insufficient legal basis for data processing	🇦🇹 Austrian Data Protection Authority (dsb)	Art. 5 Art. 6 Art. 13	€6,300
2026-03-20	Domeniul Public și Privat SA Insufficient legal basis for data processing	🇷🇴 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 5 Art. 6 Art. 12 Art. 13	€3,000
2026-03-20	Public and Private Domain SA Insufficient legal basis for data processing	🇷🇴 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 5 Art. 6 Art. 12 Art. 13	€3,000
2026-03-20	Austrian DSB rules 360-degree feedback unlawful without specific works agreement	🇦🇹 DSB (Austria)	Art. 88 Art. 61 Art. 6 Art. 61	—
2026-03-13	RAMÓN GRAU, S.L. Insufficient legal basis for data processing	🇪🇸 Spanish Data Protection Authority (aepd)	Art. 6 Art. 13	€18,000
2026-03-12	Enel Energia S.p.A. Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 24	€563,052
2026-03-12	INPS – Istituto nazionale previdenza sociale Insufficient technical and organisational measures to ensure information security	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9 Art. 10	€40,000
2026-03-12	Comune di Sutri Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6	€2,000
2026-03-12	Liceo Scientifico Morgagni di Roma Insufficient technical and organisational measures to ensure information security	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9 Art. 32	€2,000
2026-03-04	ARES CAPITAL, S.A. Insufficient legal basis for data processing	🇪🇸 Spanish Data Protection Authority (aepd)	Art. 5 Art. 6 Art. 13	€200,000
2026-03-02	HIGHCLIFFE ESTATES MARBELLA, S.L. Insufficient legal basis for data processing	🇪🇸 Spanish Data Protection Authority (aepd)	Art. 6	€8,500
2026-03-01	HOLY MARY CATHOLIC SCHOOL, S.L. Insufficient legal basis for data processing	🇪🇸 Spanish Data Protection Authority (aepd)	Art. 5 Art. 6 Art. 35	€12,000
2026-02-26	S.M. Trattamento Acqua di XX Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 4 Art. 5 Art. 6 Art. 7	€30,000
2026-02-26	Ministero delle Imprese e del Made in Italy Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9 Art. 12	€15,000
2026-02-26	Ministero dell’Economia e delle Finanze Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 28	€12,000
2026-02-26	Conservatory Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 10	€5,000
2026-02-26	Istituto Tecnico Statale “Luigi Einaudi” di Correggio Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6	€2,000
2026-02-23	Reddit, Inc. Non-compliance with general data processing principles	🇬🇧 Information Commissioner (ICO)	Art. 5 Art. 6 Art. 8 Art. 35	€16,610,000
2026-02-20	University of Szeged Insufficient legal basis for data processing	🇭🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)	Art. 5 Art. 6 Art. 9 Art. 13	€5,570

← previous 26–50 of 1,220 next →