Article 9 GDPR — enforcement

Cited in 233 decisions · €44.1M total fines · median €15,000 · top authority: 🇪🇺Italian Data Protection Authority (Garante) (121)

Read Article 9 GDPR →

Date ↓	Company / party	Authority	Articles	Fine
2026-05-29	Blikk Kft. Insufficient legal basis for data processing	🇭🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)	Art. 6 Art. 9 Art. 12	€70,300
2026-05-26	Mediaworks Hungary Zrt. Insufficient legal basis for data processing	🇭🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)	Art. 6 Art. 9	€140,500
2026-05-20	Elektronikus Egészségügyi Szolgáltatási Tér Insufficient technical and organisational measures to ensure information security	🇭🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)	Art. 5 Art. 6 Art. 9	€1,400
2026-03-26	Municipality Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9	€5,000
2026-03-26	Municipality Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9	€3,000
2026-03-12	INPS – Istituto nazionale previdenza sociale Insufficient technical and organisational measures to ensure information security	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9 Art. 10	€40,000
2026-03-12	Liceo Scientifico Morgagni di Roma Insufficient technical and organisational measures to ensure information security	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9 Art. 32	€2,000
2026-02-26	Depac Società Cooperativa Sociale a r.l. Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 9 Art. 13 Art. 30	€15,000
2026-02-26	Ministero delle Imprese e del Made in Italy Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9 Art. 12	€15,000
2026-02-20	University of Szeged Insufficient legal basis for data processing	🇭🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)	Art. 5 Art. 6 Art. 9 Art. 13	€5,570
2026-02-05	Obuda University Insufficient legal basis for data processing	🇭🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)	Art. 5 Art. 6 Art. 9	€4,200
2026-02-03	Municipality of Ede Insufficient legal basis for data processing	🇪🇺 Dutch Supervisory Authority for Data Protection (AP)	Art. 6 Art. 9	€25,000
2026-02-03	Municipality of Haarlemmermeer Insufficient legal basis for data processing	🇪🇺 Dutch Supervisory Authority for Data Protection (AP)	Art. 6 Art. 9	€25,000
2026-02-03	Municipality of Eindhoven Insufficient legal basis for data processing	🇪🇺 Dutch Supervisory Authority for Data Protection (AP)	Art. 6 Art. 9	€25,000
2026-02-03	Municipality of Tilburg Insufficient legal basis for data processing	🇪🇺 Dutch Supervisory Authority for Data Protection (AP)	Art. 6 Art. 9	€25,000
2026-02-03	Municipality of Veenendaal Insufficient legal basis for data processing	🇪🇺 Dutch Supervisory Authority for Data Protection (AP)	Art. 6 Art. 9	€25,000
2026-02-03	Municipality of Hilversum Insufficient legal basis for data processing	🇪🇺 Dutch Supervisory Authority for Data Protection (AP)	Art. 6 Art. 9	€25,000
2026-02-03	Municipality of Gooise Meren Insufficient legal basis for data processing	🇪🇺 Dutch Supervisory Authority for Data Protection (AP)	Art. 6 Art. 9	€25,000
2026-02-03	Municipality of Zoetermeer Insufficient legal basis for data processing	🇪🇺 Dutch Supervisory Authority for Data Protection (AP)	Art. 6 Art. 9	€25,000
2026-02-03	Municipality of Delft Insufficient legal basis for data processing	🇪🇺 Dutch Supervisory Authority for Data Protection (AP)	Art. 6 Art. 9	€25,000
2026-02-03	Municipality of Huizen Insufficient legal basis for data processing	🇪🇺 Dutch Supervisory Authority for Data Protection (AP)	Art. 6 Art. 9	€25,000
2026-01-30	Natural Person Non-compliance with general data processing principles	🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 5 Art. 6 Art. 9 Art. 10	€10,000
2026-01-29	Università Telematica e-Campus Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9 Art. 25	€50,000
2026-01-29	Istituto tecnico industriale statale “Stanislao Cannizzaro” di Catania Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9	€10,000
2026-01-29	Dr. Paolo Montemurro Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 9	€5,000

1–25 of 233 next →