Article 6 GDPR — enforcement
Cited in 1,273 decisions · €3.4B total fines · median €10,000 · top authority: 🇪🇺Spanish Data Protection Authority (aepd) (358)
| Date ↓ | Company / party | Authority | Articles | Fine |
|---|---|---|---|---|
| 2026-01-30 | Hungarian University of Agriculture and Life Sciences Insufficient legal basis for data processing | 🇭🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH) | Art. 5Art. 6Art. 13 | €4,200 |
| 2026-01-29 | Università Telematica e-Campus Insufficient legal basis for data processing | 🇮🇹 Italian Data Protection Authority (Garante) | Art. 5Art. 6Art. 9Art. 25 | €50,000 |
| 2026-01-29 | Istituto San Giuseppe La Salle di Milano Non-compliance with general data processing principles | 🇮🇹 Italian Data Protection Authority (Garante) | Art. 5Art. 6Art. 12Art. 13 | €12,000 |
| 2026-01-29 | Ministero della Cultura Non-compliance with general data processing principles | 🇮🇹 Italian Data Protection Authority (Garante) | Art. 5Art. 6Art. 12Art. 13 | €12,000 |
| 2026-01-29 | Istituto tecnico industriale statale “Stanislao Cannizzaro” di Catania Insufficient legal basis for data processing | 🇮🇹 Italian Data Protection Authority (Garante) | Art. 5Art. 6Art. 9 | €10,000 |
| 2026-01-29 | Federazione Nazionale Ordini Professioni Infermieristiche (FNOPI) Insufficient legal basis for data processing | 🇮🇹 Italian Data Protection Authority (Garante) | Art. 5Art. 6 | €2,000 |
| 2026-01-19 | DSB (Austria) - 2025-1.049.138 | 🇦🇹 DSB (Austria) | Art. 51Art. 5Art. 131Art. 13 | €25,500 |
| 2026-01-16 | Garante per la protezione dei dati personali (Italy) - 10214411 | 🇮🇹 Garante per la protezione dei dati personali (Italy) | Art. 51Art. 5Art. 61Art. 6 | €1,500 |
| 2026-01-12 | DSB (Austria) - 2026-0.016.479 | 🇦🇹 DSB (Austria) | Art. 415Art. 4Art. 51Art. 5 | €200 |
| 2026-01-12 | Medical Student Insufficient legal basis for data processing | 🇦🇹 Austrian Data Protection Authority (dsb) | Art. 6Art. 9 | €200 |
| 2026-01-10 | VOX ESPAÑA Insufficient legal basis for data processing | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 6 | €500 |
| 2026-01-07 | AEPD fines two telecom providers €400,000 and €300,000 for SIM card fraud | 🇪🇸 Agencia Española de Protección de Datos | Art. 6 | €400,000 |
| 2025-12-31 | ONE WAY PRIVATE COMPANY Non-compliance with general data processing principles | 🇪🇺 Hellenic Data Protection Authority (HDPA) | Art. 5Art. 6Art. 7Art. 29 | €80,000 |
| 2025-12-30 | Company Non-compliance with general data processing principles | 🇪🇺 French Data Protection Authority (CNIL) | Art. 6Art. 13Art. 32Art. 35 | €3,500,000 |
| 2025-12-30 | Telecommunications company Insufficient legal basis for data processing | 🇪🇺 Croatian Data Protection Authority (azop) | Art. 6Art. 5 | €20,000 |
| 2025-12-30 | Telecommunications company Insufficient legal basis for data processing | 🇪🇺 Croatian Data Protection Authority (azop) | Art. 6Art. 5 | €20,000 |
| 2025-12-30 | Ikea Ibérica Insufficient legal basis for data processing | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 6 | €10,000 |
| 2025-12-30 | Ikea Ibérica Insufficient legal basis for data processing | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 6 | €10,000 |
| 2025-12-30 | Restaurant (SANTI 3000, S.L.) Insufficient legal basis for data processing | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 5Art. 6 | €9,600 |
| 2025-12-30 | Restaurant (SANTI 3000, S.L.) Insufficient legal basis for data processing | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 5Art. 6 | €9,600 |
| 2025-12-30 | UniCredit Bank Czech Republic and Slovakia, a.s. Insufficient legal basis for data processing | 🇪🇺 Czech Data Protection Auhtority (UOOU) | Art. 6 | €3,140 |
| 2025-12-30 | UniCredit Bank Czech Republic and Slovakia, a.s. Insufficient legal basis for data processing | 🇪🇺 Czech Data Protection Auhtority (UOOU) | Art. 6 | €3,140 |
| 2025-12-30 | GERMANY DPA: Insufficient legal basis for data processing Insufficient legal basis for data processing | 🇪🇺 Data Protection Authority of Rhineland-Palatinate | Art. 6 | €600 |
| 2025-12-30 | Alza.cz a.s. Insufficient legal basis for data processing | 🇪🇺 Czech Data Protection Auhtority (UOOU) | Art. 6Art. 7 | €588 |
| 2025-12-30 | Alza.cz a.s. Insufficient legal basis for data processing | 🇪🇺 Czech Data Protection Auhtority (UOOU) | Art. 6Art. 7 | €588 |