▲ Enforcement Tracker

3,806 GDPR enforcement decisions from 65 countries, updated daily. Compare fines by country or authority →

Total fines · last 12 months

€2.5B

+124% vs previous year

Decisions · last 12 months

631

53 per month avg

Largest · last 90 days

€825.0M

Uber Technologies Inc. · The Netherlands

Most active authority

Italian Data Protection Authority (Garante)

116 decisions · Italy

Monthly fine totals · last 12 months

NovDecJanFebMarAprMayJunJulAugSepOct

reset

Date ↓	Company / party	Authority	Articles	Fine
2026-08-07	Finnish DPA finds 12-year retention of rental applicant data violates minimisation	🇫🇮 Tietosuojavaltuutetun toimisto (Finland)	Art. 51 Art. 5 Art. 51 Art. 251	—
2026-08-04	Finnish DPA: disclosing pension accrual to physician in disability assessment complies	🇫🇮 Tietosuojavaltuutetun toimisto (Finland)	Art. 51 Art. 5	—
2026-08-04	Finnish DPA examines anti-doping organization's GDPR compliance over public suspension	🇫🇮 Tietosuojavaltuutetun toimisto (Finland)	Art. 22 Art. 2 Art. 51 Art. 5	—
2026-07-22	Finnish DPA: requesting address, ID number and strong authentication for access request	🇫🇮 Tietosuojavaltuutetun toimisto (Finland)	Art. 51 Art. 5 Art. 122 Art. 12	—
2025-10-23	Aktia Pankki Oyj Insufficient technical and organisational measures to ensure information security	🇪🇺 Deputy Data Protection Ombudsman	Art. 5 Art. 25 Art. 32	€865,000
2025-10-23	Aktia Pankki Oyj Insufficient technical and organisational measures to ensure information security	🇪🇺 Deputy Data Protection Ombudsman	Art. 5 Art. 25 Art. 32	€865,000
2025-09-08	S-Pankki Oyj Insufficient technical and organisational measures to ensure information security	🇪🇺 Deputy Data Protection Ombudsman	Art. 5 Art. 25 Art. 32	€1,800,000
2025-09-08	S-Pankki Oyj Insufficient technical and organisational measures to ensure information security	🇪🇺 Deputy Data Protection Ombudsman	Art. 5 Art. 25 Art. 32	€1,800,000
2025-05-27	Yliopiston Apteekin Non-compliance with general data processing principles	🇪🇺 Deputy Data Protection Ombudsman	Art. 5 Art. 32	€1,100,000
2025-05-27	Yliopiston Apteekin Non-compliance with general data processing principles	🇪🇺 Deputy Data Protection Ombudsman	Art. 5 Art. 32	€1,100,000
2024-12-17	Sambla Group Oy Insufficient technical and organisational measures to ensure information security	🇪🇺 Deputy Data Protection Ombudsman	Art. 5 Art. 25 Art. 32	€950,000
2024-03-06	Verkkokauppa.com Non-compliance with general data processing principles	🇪🇺 Deputy Data Protection Ombudsman	Art. 5 Art. 25	€856,000
2022-12-09	Viking Line Oy Abp Non-compliance with general data processing principles	🇪🇺 Deputy Data Protection Ombudsman	Art. 5 Art. 12 Art. 13 Art. 15	€230,000
2022-05-09	Otavamedia Oy Insufficient fulfilment of data subjects rights	🇪🇺 Deputy Data Protection Ombudsman	Art. 5 Art. 12 Art. 15 Art. 17	€85,000
2021-12-26	Medical clinic Insufficient fulfilment of information obligations	🇪🇺 Deputy Data Protection Ombudsman	Art. 5 Art. 12 Art. 13 Art. 15	€5,000
2021-12-16	Motor insurance center Non-compliance with general data processing principles	🇪🇺 Deputy Data Protection Ombudsman	Art. 5 Art. 25	€52,000
2021-12-16	Travel agency Insufficient technical and organisational measures to ensure information security	🇪🇺 Deputy Data Protection Ombudsman	Art. 5 Art. 17 Art. 25 Art. 32	€6,500
2021-12-07	Psykoterapiakeskus Vastaamo Non-compliance with general data processing principles	🇪🇺 Deputy Data Protection Ombudsman	Art. 5 Art. 33 Art. 34	€608,000
2021-07-05	Higher Education Institution Non-compliance with general data processing principles	🇪🇺 Deputy Data Protection Ombudsman	Art. 5 Art. 6	€25,000
2021-06-24	Magazine publisher Insufficient legal basis for data processing	🇪🇺 Deputy Data Protection Ombudsman	Art. 5 Art. 7 Art. 12 Art. 21	€8,500
2021-04-21	ParkkiPate Oy Insufficient fulfilment of data subjects rights	🇪🇺 Deputy Data Protection Ombudsman	Art. 5 Art. 12 Art. 14 Art. 15	€75,000
2020-08-05	Acc Consulting Varsinais-Suomi Insufficient legal basis for data processing	🇪🇺 Deputy Data Protection Ombudsman	Art. 5 Art. 6	€7,000
2020-05-29	Taksi Helsinki Non-compliance with general data processing principles	🇪🇺 Deputy Data Protection Ombudsman	Art. 5 Art. 6 Art. 35	€72,000
2020-05-22	Unknown Company Insufficient legal basis for data processing	🇪🇺 Deputy Data Protection Ombudsman	Art. 5 Art. 6	€12,500