Article 9 GDPR — enforcement

Cited in 249 decisions · €79.6M total fines · median €13,000 · top authority: 🇪🇺Italian Data Protection Authority (Garante) (121)

Read Article 9 GDPR →

Date ↓	Company / party	Authority	Articles	Fine
2026-02-03	Municipality of Zoetermeer Insufficient legal basis for data processing	🇪🇺 Dutch Supervisory Authority for Data Protection (AP)	Art. 6 Art. 9	€25,000
2026-01-30	Natural Person Non-compliance with general data processing principles	🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 5 Art. 6 Art. 9 Art. 10	€10,000
2026-01-29	Università Telematica e-Campus Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9 Art. 25	€50,000
2026-01-29	Istituto tecnico industriale statale “Stanislao Cannizzaro” di Catania Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9	€10,000
2026-01-29	Dr. Paolo Montemurro Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 9	€5,000
2026-01-12	DSB: Medical student fined for recording dementia patient video without Art 9 GDPR basis	🇦🇹 DSB (Austria)	Art. 415 Art. 4 Art. 51 Art. 5	€200
2025-12-04	'Principe Umberto di Savoia' State Scientific and Linguistic High School Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9 Art. 13	€1,000
2025-12-04	Roverbella Comprehensive School Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9	€1,000
2025-12-03	Austrian DSB: sharing ADHD diagnosis from public forum post did not breach Art. 9 GDPR	🇦🇹 DSB (Austria)	Art. 91 Art. 9 Art. 92	—
2025-11-21	IDCQ HOSPITALES Y SANIDAD, S.L.U. Non-compliance with general data processing principles	🇪🇺 Spanish Data Protection Authority (aepd)	Art. 6 Art. 9 Art. 25	€1,200,000
2025-10-23	Mayor of the Municipality of Calvi Risorta Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9	€1,000
2025-10-23	Mayor of the Municipality of Calvi Risorta Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9	€1,000
2025-10-10	AEPD sanctions 23andMe for security failures in credential-stuffing breach	🇪🇸 AEPD (Spain)	Art. 51 Art. 5 Art. 9 Art. 241	—
2025-09-11	Ministry of the Interior - Department of Firefighters, Public Rescue, and Civil Defense - Provincial Command of Florence Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9	€12,000
2025-09-11	Casa di Cura Città di Roma Insufficient technical and organisational measures to ensure information security	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 9 Art. 25 Art. 32	€12,000
2025-09-11	Casa di Cura Città di Roma Insufficient technical and organisational measures to ensure information security	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 9 Art. 25 Art. 32	€12,000
2025-09-11	Ministry of the Interior - Department of Firefighters, Public Rescue, and Civil Defense - Provincial Command of Florence Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9	€12,000
2025-09-11	Municipality of Buccino Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9 Art. 13	€6,000
2025-09-11	Municipality of Buccino Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9 Art. 13	€6,000
2025-08-04	Ospedaliero-Universitaria Careggi Insufficient technical and organisational measures to ensure information security	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 9 Art. 25 Art. 32	€80,000
2025-08-04	Ospedaliero-Universitaria Careggi Insufficient technical and organisational measures to ensure information security	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 9 Art. 25 Art. 32	€80,000
2025-07-23	SATI S.p.A. Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 9	€10,000
2025-07-23	SATI S.p.A. Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 9	€10,000
2025-07-22	Legal Entity Insufficient legal basis for data processing	🇪🇺 Slovenian Supervisory Authority (Informacijski pooblaščenec)	Art. 6 Art. 9	€2,200
2025-07-10	Magna PT S.p.A. Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9 Art. 13	€50,000

← previous 26–50 of 249 next →