▲ Enforcement Tracker

3,806 GDPR enforcement decisions from 65 countries, updated daily. Compare fines by country or authority →

Total fines · last 12 months

€2.5B

+124% vs previous year

Decisions · last 12 months

631

53 per month avg

Largest · last 90 days

€825.0M

Uber Technologies Inc. · The Netherlands

Most active authority

Italian Data Protection Authority (Garante)

116 decisions · Italy

Monthly fine totals · last 12 months

NovDecJanFebMarAprMayJunJulAugSepOct

reset

Date ↓	Company / party	Authority	Articles	Fine
2025-08-05	Bank of Cyprus Public Company Limited Insufficient technical and organisational measures to ensure information security	🇨🇾 Cypriot Data Protection Commissioner	Art. 5 Art. 24 Art. 32	€25,000
2025-03-10	Housing Finance Corporation Insufficient legal basis for data processing	🇪🇺 Cypriot Data Protection Commissioner	Art. 5 Art. 24	€10,000
2023-12-07	Physician Non-compliance with general data processing principles	🇪🇺 Cypriot Data Protection Commissioner	Art. 5	€1,500
2023-11-22	Open University of Cyprus Insufficient technical and organisational measures to ensure information security	🇪🇺 Cypriot Data Protection Commissioner	Art. 5 Art. 32	€45,000
2023-05-02	NAGA Markets Europe Ltd Insufficient technical and organisational measures to ensure information security	🇪🇺 Cypriot Data Protection Commissioner	Art. 5 Art. 32	€9,000
2023-01-16	Πολίτης newspaper Non-compliance with general data processing principles	🇪🇺 Cypriot Data Protection Commissioner	Art. 5 Art. 6	€7,000
2023-01-01	Cypriot Ministry of the Interior Non-compliance with general data processing principles	🇪🇺 Cypriot Data Protection Commissioner	Art. 5	€8,000
2023-01-01	Bank of Cyprus Public Company Ltd. Non-compliance with general data processing principles	🇪🇺 Cypriot Data Protection Commissioner	Art. 5	€8,000
2023-01-01	Breikot Management Ltd Non-compliance with general data processing principles	🇪🇺 Cypriot Data Protection Commissioner	Art. 5 Art. 6	€3,000
2022-02-04	Εκδοτικού Οίκου Δίας Insufficient legal basis for data processing	🇪🇺 Cypriot Data Protection Commissioner	Art. 5 Art. 6	€10,000
2022-01-01	Bank of Cyprus Public Company Ltd. Insufficient technical and organisational measures to ensure information security	🇪🇺 Cypriot Data Protection Commissioner	Art. 5 Art. 24 Art. 32	€17,000
2022-01-01	Cyprus Electricity Authority Insufficient technical and organisational measures to ensure information security	🇪🇺 Cypriot Data Protection Commissioner	Art. 5 Art. 24 Art. 32	€5,000
2021-11-12	WS WiSpear Systems Ltd Non-compliance with general data processing principles	🇪🇺 Cypriot Data Protection Commissioner	Art. 5	€925,000
2021-03-03	Hellenic Bank Insufficient technical and organisational measures to ensure information security	🇪🇺 Cypriot Data Protection Commissioner	Art. 5 Art. 32 Art. 33	€25,000
2020-10-19	Bank of Cyprus Public Company Ltd Insufficient technical and organisational measures to ensure information security	🇪🇺 Cypriot Data Protection Commissioner	Art. 5 Art. 15 Art. 32 Art. 33	€15,000
2020-10-19	Grant Ideas Ltd Insufficient legal basis for data processing	🇪🇺 Cypriot Data Protection Commissioner	Art. 5 Art. 6	€1,000
2019-01-01	Doctor Insufficient legal basis for data processing	🇪🇺 Cypriot Data Protection Commissioner	Art. 5 Art. 6	€14,000