▲ Enforcement Tracker

3,806 GDPR enforcement decisions from 65 countries, updated daily. Compare fines by country or authority →

Total fines · last 12 months

€2.5B

+124% vs previous year

Decisions · last 12 months

633

53 per month avg

Largest · last 90 days

€825.0M

Uber Technologies Inc. · The Netherlands

Most active authority

Italian Data Protection Authority (Garante)

116 decisions · Italy

Monthly fine totals · last 12 months

NovDecJanFebMarAprMayJunJulAugSepOct

reset

Date ↓	Company / party	Authority	Articles	Fine
2020-01-01	Police officer Insufficient legal basis for data processing	🇪🇺 Data Protection Authority of Hamburg	Art. 5 Art. 6	—
2020-01-01	Police officer Insufficient legal basis for data processing	🇪🇺 Data Protection Authority of Hamburg	Art. 5 Art. 6	—
2020-01-01	Police officer Insufficient legal basis for data processing	🇪🇺 Data Protection Authority of Saarland	Art. 5 Art. 6	—
2020-01-01	Operator of a ballet school Insufficient legal basis for data processing	🇪🇺 Data Protection Authority of Brandenburg	Art. 5 Art. 6 Art. 7	—
2020-01-01	Police officer Insufficient legal basis for data processing	🇪🇺 Data Protection Authority of Hamburg	Art. 5 Art. 6	—
2020-01-01	Police officer Insufficient legal basis for data processing	🇪🇺 Data Protection Authority of Hamburg	Art. 5 Art. 6	—
2020-01-01	Police officer Insufficient legal basis for data processing	🇪🇺 Data Protection Authority of Hamburg	Art. 5 Art. 6	—
2020-01-01	Police officer Insufficient legal basis for data processing	🇪🇺 Data Protection Authority of Hamburg	Art. 5 Art. 6	—
2019-11-01	Restaurant Non-compliance with general data processing principles	🇪🇺 Data Protection Authority of Baden-Wuerttemberg	Art. 5	€5,000
2019-10-30	Deutsche Wohnen SE Non-compliance with general data processing principles	🇪🇺 Data Protection Authority of Berlin	Art. 5	—
2019-10-24	Food company Insufficient technical and organisational measures to ensure information security	🇪🇺 Data Protection Authority of Baden-Wuerttemberg	Art. 5 Art. 32	€100,000
2019-08-05	Private person (YouTube-Channel) Insufficient legal basis for data processing	🇪🇺 Data Protection Authority of Nordrhein-Westfalen	Art. 5 Art. 6	€200
2019-04-12	Company in the financial sector Insufficient technical and organisational measures to ensure information security	🇪🇺 Data Protection Authority of Baden-Wuerttemberg	Art. 5 Art. 32	€80,000
2019-02-05	Private person Insufficient legal basis for data processing	🇪🇺 Data Protection Authority of Sachsen-Anhalt	Art. 6 Art. 5	€2,500
2019-01-01	GERMANY DPA: Non-compliance with general data processing principles Non-compliance with general data processing principles	🇪🇺 Data Protection Authority of Niedersachsen	Art. 5	€294,000
2019-01-01	Restaurant Non-compliance with general data processing principles	🇪🇺 Data Protection Authority of Saarland	Art. 5	€2,000

← previous 51–66 of 66