▲ Enforcement Tracker

3,806 GDPR enforcement decisions from 65 countries, updated daily. Compare fines by country or authority →

Total fines · last 12 months

€2.5B

+124% vs previous year

Decisions · last 12 months

631

53 per month avg

Largest · last 90 days

€825.0M

Uber Technologies Inc. · The Netherlands

Most active authority

Italian Data Protection Authority (Garante)

116 decisions · Italy

Monthly fine totals · last 12 months

NovDecJanFebMarAprMayJunJulAugSepOct

reset

Date ↓	Company / party	Authority	Articles	Fine
2021-01-01	Electronics store Non-compliance with general data processing principles	🇪🇺 Data Protection Authority of Niedersachsen	Art. 5 Art. 17 Art. 35	€16,000
2021-01-01	Private individual Insufficient legal basis for data processing	🇪🇺 Data Protection Authority of Hamburg	Art. 5 Art. 6	€5,000
2021-01-01	Police officer Insufficient legal basis for data processing	🇪🇺 Data Protection Authority of Hessen	Art. 5 Art. 6	€1,800
2021-01-01	Police officer Insufficient legal basis for data processing	🇪🇺 Data Protection Authority of Hessen	Art. 5 Art. 6	€600
2021-01-01	Police officer Insufficient legal basis for data processing	🇪🇺 Data Protection Authority of Hessen	Art. 5 Art. 6	€500
2021-01-01	Police officer Insufficient legal basis for data processing	🇪🇺 Data Protection Authority of Hessen	Art. 5 Art. 6	€400
2021-01-01	Restaurant Non-compliance with general data processing principles	🇪🇺 Data Protection Authority of Hessen	Art. 5	€170
2021-01-01	Police officer Insufficient legal basis for data processing	🇪🇺 Data Protection Authority of Berlin	Art. 5 Art. 6	—
2021-01-01	Police officer Insufficient legal basis for data processing	🇪🇺 Data Protection Authority of Berlin	Art. 5 Art. 6	—
2021-01-01	Job center employee Insufficient legal basis for data processing	🇪🇺 Data Protection Authority of Berlin	Art. 5 Art. 6	—
2021-01-01	Medical clinic Insufficient legal basis for data processing	🇪🇺 Data Protection Authority of Berlin	Art. 5 Art. 6	—
2021-01-01	Attorney Insufficient legal basis for data processing	🇪🇺 Data Protection Authority of Berlin	Art. 5 Art. 6	—
2021-01-01	Private individual Non-compliance with general data processing principles	🇪🇺 Data Protection Authority of Saxony	Art. 5	—
2021-01-01	Job center employee Insufficient legal basis for data processing	🇪🇺 Data Protection Authority of Berlin	Art. 5 Art. 6	—
2021-01-01	Police officer Insufficient legal basis for data processing	🇪🇺 Data Protection Authority of Berlin	Art. 5 Art. 6	—
2021-01-01	Police officer Insufficient legal basis for data processing	🇪🇺 Data Protection Authority of Berlin	Art. 5 Art. 6	—
2021-01-01	Police officer Insufficient legal basis for data processing	🇪🇺 Data Protection Authority of Berlin	Art. 5 Art. 6	—
2020-10-24	Private Individual Non-compliance with general data processing principles	🇪🇺 Data Protection Authority of Sachsen-Anhalt	Art. 5 Art. 32	€200
2020-10-01	H&M Hennes & Mauritz Online Shop A.B. & Co. KG Insufficient legal basis for data processing	🇪🇺 Data Protection Authority of Hamburg	Art. 5 Art. 6	€35,258,708
2020-06-30	Allgemeine Ortskrankenkasse ('AOK') (health insurance company) Insufficient technical and organisational measures to ensure information security	🇪🇺 Data Protection Authority of Baden-Wuerttemberg	Art. 5 Art. 6 Art. 32	€1,240,000
2020-01-01	Restaurant Non-compliance with general data processing principles	🇪🇺 Data Protection Authority of Saarland	Art. 5	€10,000
2020-01-01	Restaurant Non-compliance with general data processing principles	🇪🇺 Data Protection Authority of Hamburg	Art. 5	€3,000
2020-01-01	Police officer Insufficient legal basis for data processing	🇪🇺 Data Protection Authority of Hamburg	Art. 5 Art. 6	€400
2020-01-01	Employee at a Covid 19 testing center Non-compliance with general data processing principles	🇪🇺 Data Protection Authority of Hessen	Art. 5	€300
2020-01-01	Police officer Insufficient legal basis for data processing	🇪🇺 Data Protection Authority of Hamburg	Art. 5 Art. 6	€300

← previous 26–50 of 66 next →