Article 6 GDPR — enforcement
Cited in 1,176 decisions · €922.4M total fines · median €10,000 · top authority: 🇪🇺Spanish Data Protection Authority (aepd) (358)
| Date ↓ | Company / party | Authority | Articles | Fine |
|---|---|---|---|---|
| 2026-02-03 | Municipality of Tilburg Insufficient legal basis for data processing | 🇪🇺 Dutch Supervisory Authority for Data Protection (AP) | Art. 6Art. 9 | €25,000 |
| 2026-02-03 | Municipality of Eindhoven Insufficient legal basis for data processing | 🇪🇺 Dutch Supervisory Authority for Data Protection (AP) | Art. 6Art. 9 | €25,000 |
| 2026-02-03 | Municipality of Ede Insufficient legal basis for data processing | 🇪🇺 Dutch Supervisory Authority for Data Protection (AP) | Art. 6Art. 9 | €25,000 |
| 2026-02-03 | Municipality of Huizen Insufficient legal basis for data processing | 🇪🇺 Dutch Supervisory Authority for Data Protection (AP) | Art. 6Art. 9 | €25,000 |
| 2026-02-03 | Municipality of Delft Insufficient legal basis for data processing | 🇪🇺 Dutch Supervisory Authority for Data Protection (AP) | Art. 6Art. 9 | €25,000 |
| 2026-02-03 | Municipality of Zoetermeer Insufficient legal basis for data processing | 🇪🇺 Dutch Supervisory Authority for Data Protection (AP) | Art. 6Art. 9 | €25,000 |
| 2026-02-03 | Municipality of Hilversum Insufficient legal basis for data processing | 🇪🇺 Dutch Supervisory Authority for Data Protection (AP) | Art. 6Art. 9 | €25,000 |
| 2026-01-30 | Natural Person Non-compliance with general data processing principles | 🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) | Art. 5Art. 6Art. 9Art. 10 | €10,000 |
| 2026-01-30 | Hungarian University of Agriculture and Life Sciences Insufficient legal basis for data processing | 🇭🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH) | Art. 5Art. 6Art. 13 | €4,200 |
| 2026-01-29 | Università Telematica e-Campus Insufficient legal basis for data processing | 🇮🇹 Italian Data Protection Authority (Garante) | Art. 5Art. 6Art. 9Art. 25 | €50,000 |
| 2026-01-29 | Ministero della Cultura Non-compliance with general data processing principles | 🇮🇹 Italian Data Protection Authority (Garante) | Art. 5Art. 6Art. 12Art. 13 | €12,000 |
| 2026-01-29 | Istituto San Giuseppe La Salle di Milano Non-compliance with general data processing principles | 🇮🇹 Italian Data Protection Authority (Garante) | Art. 5Art. 6Art. 12Art. 13 | €12,000 |
| 2026-01-29 | Istituto tecnico industriale statale “Stanislao Cannizzaro” di Catania Insufficient legal basis for data processing | 🇮🇹 Italian Data Protection Authority (Garante) | Art. 5Art. 6Art. 9 | €10,000 |
| 2026-01-29 | Federazione Nazionale Ordini Professioni Infermieristiche (FNOPI) Insufficient legal basis for data processing | 🇮🇹 Italian Data Protection Authority (Garante) | Art. 5Art. 6 | €2,000 |
| 2026-01-10 | VOX ESPAÑA Insufficient legal basis for data processing | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 6 | €500 |
| 2025-12-31 | ONE WAY PRIVATE COMPANY Non-compliance with general data processing principles | 🇪🇺 Hellenic Data Protection Authority (HDPA) | Art. 5Art. 6Art. 7Art. 29 | €80,000 |
| 2025-12-30 | Company Non-compliance with general data processing principles | 🇪🇺 French Data Protection Authority (CNIL) | Art. 6Art. 13Art. 32Art. 35 | €3,500,000 |
| 2025-12-30 | Telecommunications company Insufficient legal basis for data processing | 🇪🇺 Croatian Data Protection Authority (azop) | Art. 6Art. 5 | €20,000 |
| 2025-12-30 | Telecommunications company Insufficient legal basis for data processing | 🇪🇺 Croatian Data Protection Authority (azop) | Art. 6Art. 5 | €20,000 |
| 2025-12-30 | Ikea Ibérica Insufficient legal basis for data processing | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 6 | €10,000 |
| 2025-12-30 | Ikea Ibérica Insufficient legal basis for data processing | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 6 | €10,000 |
| 2025-12-30 | Restaurant (SANTI 3000, S.L.) Insufficient legal basis for data processing | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 5Art. 6 | €9,600 |
| 2025-12-30 | Restaurant (SANTI 3000, S.L.) Insufficient legal basis for data processing | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 5Art. 6 | €9,600 |
| 2025-12-30 | UniCredit Bank Czech Republic and Slovakia, a.s. Insufficient legal basis for data processing | 🇪🇺 Czech Data Protection Auhtority (UOOU) | Art. 6 | €3,140 |
| 2025-12-30 | UniCredit Bank Czech Republic and Slovakia, a.s. Insufficient legal basis for data processing | 🇪🇺 Czech Data Protection Auhtority (UOOU) | Art. 6 | €3,140 |