Article 6 GDPR — enforcement
Cited in 1,220 decisions · €3.0B total fines · median €10,000 · top authority: 🇪🇺Spanish Data Protection Authority (aepd) (358)
| Date ↓ | Company / party | Authority | Articles | Fine |
|---|---|---|---|---|
| 2026-01-30 | Hungarian University of Agriculture and Life Sciences Insufficient legal basis for data processing | 🇭🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH) | Art. 5Art. 6Art. 13 | €4,200 |
| 2026-01-29 | Università Telematica e-Campus Insufficient legal basis for data processing | 🇮🇹 Italian Data Protection Authority (Garante) | Art. 5Art. 6Art. 9Art. 25 | €50,000 |
| 2026-01-29 | Istituto San Giuseppe La Salle di Milano Non-compliance with general data processing principles | 🇮🇹 Italian Data Protection Authority (Garante) | Art. 5Art. 6Art. 12Art. 13 | €12,000 |
| 2026-01-29 | Ministero della Cultura Non-compliance with general data processing principles | 🇮🇹 Italian Data Protection Authority (Garante) | Art. 5Art. 6Art. 12Art. 13 | €12,000 |
| 2026-01-29 | Istituto tecnico industriale statale “Stanislao Cannizzaro” di Catania Insufficient legal basis for data processing | 🇮🇹 Italian Data Protection Authority (Garante) | Art. 5Art. 6Art. 9 | €10,000 |
| 2026-01-29 | Federazione Nazionale Ordini Professioni Infermieristiche (FNOPI) Insufficient legal basis for data processing | 🇮🇹 Italian Data Protection Authority (Garante) | Art. 5Art. 6 | €2,000 |
| 2026-01-19 | Austrian DSB: Marketing agency violated GDPR by recording phone interviews without valid | 🇦🇹 DSB (Austria) | Art. 51Art. 5Art. 131Art. 13 | €25,500 |
| 2026-01-16 | Italian DPA fines butcher €1,500 for unlawful video surveillance lacking information signs | 🇮🇹 Garante per la protezione dei dati personali (Italy) | Art. 51Art. 5Art. 61Art. 6 | €1,500 |
| 2026-01-12 | DSB: Medical student fined for recording dementia patient video without Art 9 GDPR basis | 🇦🇹 DSB (Austria) | Art. 415Art. 4Art. 51Art. 5 | €200 |
| 2026-01-10 | VOX ESPAÑA Insufficient legal basis for data processing | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 6 | €500 |
| 2025-12-31 | ONE WAY PRIVATE COMPANY Non-compliance with general data processing principles | 🇪🇺 Hellenic Data Protection Authority (HDPA) | Art. 5Art. 6Art. 7Art. 29 | €80,000 |
| 2025-12-30 | Company Non-compliance with general data processing principles | 🇪🇺 French Data Protection Authority (CNIL) | Art. 6Art. 13Art. 32Art. 35 | €3,500,000 |
| 2025-12-30 | Telecommunications company Insufficient legal basis for data processing | 🇪🇺 Croatian Data Protection Authority (azop) | Art. 6Art. 5 | €20,000 |
| 2025-12-30 | Telecommunications company Insufficient legal basis for data processing | 🇪🇺 Croatian Data Protection Authority (azop) | Art. 6Art. 5 | €20,000 |
| 2025-12-30 | Ikea Ibérica Insufficient legal basis for data processing | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 6 | €10,000 |
| 2025-12-30 | Ikea Ibérica Insufficient legal basis for data processing | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 6 | €10,000 |
| 2025-12-30 | Restaurant (SANTI 3000, S.L.) Insufficient legal basis for data processing | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 5Art. 6 | €9,600 |
| 2025-12-30 | Restaurant (SANTI 3000, S.L.) Insufficient legal basis for data processing | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 5Art. 6 | €9,600 |
| 2025-12-30 | UniCredit Bank Czech Republic and Slovakia, a.s. Insufficient legal basis for data processing | 🇪🇺 Czech Data Protection Auhtority (UOOU) | Art. 6 | €3,140 |
| 2025-12-30 | UniCredit Bank Czech Republic and Slovakia, a.s. Insufficient legal basis for data processing | 🇪🇺 Czech Data Protection Auhtority (UOOU) | Art. 6 | €3,140 |
| 2025-12-30 | GERMANY DPA: Insufficient legal basis for data processing Insufficient legal basis for data processing | 🇪🇺 Data Protection Authority of Rhineland-Palatinate | Art. 6 | €600 |
| 2025-12-30 | Alza.cz a.s. Insufficient legal basis for data processing | 🇪🇺 Czech Data Protection Auhtority (UOOU) | Art. 6Art. 7 | €588 |
| 2025-12-30 | Alza.cz a.s. Insufficient legal basis for data processing | 🇪🇺 Czech Data Protection Auhtority (UOOU) | Art. 6Art. 7 | €588 |
| 2025-12-30 | GERMANY DPA: Insufficient legal basis for data processing Insufficient legal basis for data processing | 🇪🇺 Data Protection Authority of Rhineland-Palatinate | Art. 6 | €300 |
| 2025-12-30 | DUITSLAND, DPA: Onvoldoende juridische basis voor gegevensverwerking. Insufficient legal basis for data processing | 🇪🇺 Data Protection Authority of Saarland | Art. 6 | €118 |