Article 9 GDPR — enforcement

Cited in 275 decisions · €80.3M total fines · median €12,000 · top authority: 🇪🇺Italian Data Protection Authority (Garante) (121)

Read Article 9 GDPR →

Date ↓	Company / party	Authority	Articles	Fine
2026-01-29	Università Telematica e-Campus Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9 Art. 25	€50,000
2026-01-29	Istituto tecnico industriale statale “Stanislao Cannizzaro” di Catania Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9	€10,000
2026-01-29	Dr. Paolo Montemurro Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 9	€5,000
2026-01-28	DSB Austria: disclosure of health data to court-appointed expert in legal dispute lawful	🇦🇹 DSB (Austria)	Art. 92 Art. 9 Art. 92	—
2026-01-12	Medical Student Insufficient legal basis for data processing	🇦🇹 Austrian Data Protection Authority (dsb)	Art. 6 Art. 9	€200
2026-01-12	DSB (Austria) - 2026-0.016.479	🇦🇹 DSB (Austria)	Art. 415 Art. 4 Art. 51 Art. 5	€200
2025-12-04	Roverbella Comprehensive School Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9	€1,000
2025-12-04	'Principe Umberto di Savoia' State Scientific and Linguistic High School Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9 Art. 13	€1,000
2025-12-03	DSB (Austria) - 2025-0.968.031	🇦🇹 DSB (Austria)	Art. 91 Art. 9 Art. 92	—
2025-11-21	IDCQ HOSPITALES Y SANIDAD, S.L.U. Non-compliance with general data processing principles	🇪🇺 Spanish Data Protection Authority (aepd)	Art. 6 Art. 9 Art. 25	€1,200,000
2025-10-23	Mayor of the Municipality of Calvi Risorta Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9	€1,000
2025-10-23	Mayor of the Municipality of Calvi Risorta Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9	€1,000
2025-10-10	AEPD (Spain) - PS-00140-2025	🇪🇸 AEPD (Spain)	Art. 51 Art. 5 Art. 9 Art. 241	—
2025-09-11	Casa di Cura Città di Roma Insufficient technical and organisational measures to ensure information security	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 9 Art. 25 Art. 32	€12,000
2025-09-11	Casa di Cura Città di Roma Insufficient technical and organisational measures to ensure information security	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 9 Art. 25 Art. 32	€12,000
2025-09-11	Ministry of the Interior - Department of Firefighters, Public Rescue, and Civil Defense - Provincial Command of Florence Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9	€12,000
2025-09-11	Ministry of the Interior - Department of Firefighters, Public Rescue, and Civil Defense - Provincial Command of Florence Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9	€12,000
2025-09-11	Municipality of Buccino Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9 Art. 13	€6,000
2025-09-11	Municipality of Buccino Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9 Art. 13	€6,000
2025-08-04	Ospedaliero-Universitaria Careggi Insufficient technical and organisational measures to ensure information security	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 9 Art. 25 Art. 32	€80,000
2025-08-04	Ospedaliero-Universitaria Careggi Insufficient technical and organisational measures to ensure information security	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 9 Art. 25 Art. 32	€80,000
2025-07-23	SATI S.p.A. Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 9	€10,000
2025-07-23	SATI S.p.A. Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 9	€10,000
2025-07-22	Legal Entity Insufficient legal basis for data processing	🇪🇺 Slovenian Supervisory Authority (Informacijski pooblaščenec)	Art. 6 Art. 9	€2,200
2025-07-10	Magna PT S.p.A. Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9 Art. 13	€50,000

← previous 51–75 of 275 next →