▲ Enforcement Tracker

3,806 GDPR enforcement decisions from 65 countries, updated daily. Compare fines by country or authority →

Total fines · last 12 months

€2.5B

+124% vs previous year

Decisions · last 12 months

631

53 per month avg

Largest · last 90 days

€825.0M

Uber Technologies Inc. · The Netherlands

Most active authority

Italian Data Protection Authority (Garante)

116 decisions · Italy

Monthly fine totals · last 12 months

NovDecJanFebMarAprMayJunJulAugSepOct

reset

Date ↓	Company / party	Authority	Articles	Fine
2026-09-15	HDPA investigates Greek Infrastructure Ministry for SMS sent without consent or	🇬🇷 HDPA (Greece)	Art. 51 Art. 5 Art. 14	—
2026-08-25	HDPA orders TEIRESIAS S.A. to ensure data accuracy under Art. 5(1)(d) GDPR	🇬🇷 HDPA (Greece)	Art. 51 Art. 5	—
2026-07-28	Ministry of Social Cohesion and Family Insufficient technical and organisational measures to ensure information security	🇬🇷 Hellenic Data Protection Authority (HDPA)	Art. 5 Art. 28 Art. 32	€200,000
2026-07-28	HDPA (Greece) - 15/2026	🇬🇷 HDPA (Greece)	Art. 51 Art. 5 Art. 283 Art. 28	—
2026-07-24	HDPA (Greece) - 33/2020	🇬🇷 HDPA (Greece)	Art. 47 Art. 4 Art. 5 Art. 12	€2,000
2026-07-07	General Hospital of Thessaloniki Insufficient technical and organisational measures to ensure information security	🇬🇷 Hellenic Data Protection Authority (HDPA)	Art. 5 Art. 12 Art. 13 Art. 32	€25,000
2026-06-12	Market-In Non-compliance with general data processing principles	🇬🇷 Hellenic Data Protection Authority (HDPA)	Art. 5 Art. 12 Art. 13 Art. 15	€95,000
2026-06-12	MEDE S.A. Non-compliance with general data processing principles	🇬🇷 Hellenic Data Protection Authority (HDPA)	Art. 5 Art. 12 Art. 13 Art. 15	€65,000
2026-06-05	ZeniΘ (Thessaloniki-Thessalia Gas Supply Company S.A.) Insufficient fulfilment of data subjects rights	🇬🇷 Hellenic Data Protection Authority (HDPA)	Art. 5 Art. 12 Art. 15 Art. 28	€100,000
2026-06-02	Greek HDPA sanctions DEI for unsolicited promotional calls via processors	🇬🇷 HDPA (Greece)	Art. 51 Art. 5 Art. 51 Art. 51	€880,000
2026-06-02	Public Power Corporation S.A. (DEI) Insufficient legal basis for data processing	🇬🇷 Hellenic Data Protection Authority (HDPA)	Art. 5 Art. 32	€320,000
2026-06-02	Ypiresia 800 Teleperformance Single Member S.A. Insufficient technical and organisational measures to ensure information security	🇬🇷 Hellenic Data Protection Authority (HDPA)	Art. 5 Art. 32	€90,000
2026-01-08	Headquarter of a Fire Brigade Insufficient legal basis for data processing	🇪🇺 Hellenic Data Protection Authority (HDPA)	Art. 5	€10,000
2025-12-31	ONE WAY PRIVATE COMPANY Non-compliance with general data processing principles	🇪🇺 Hellenic Data Protection Authority (HDPA)	Art. 5 Art. 6 Art. 7 Art. 29	€80,000
2025-10-09	Municipality of Moschato–Tavros Insufficient legal basis for data processing	🇪🇺 Hellenic Data Protection Authority (HDPA)	Art. 5 Art. 12 Art. 13 Art. 25	€10,000
2025-10-09	Municipality of Moschato–Tavros Insufficient legal basis for data processing	🇪🇺 Hellenic Data Protection Authority (HDPA)	Art. 5 Art. 12 Art. 13 Art. 25	€10,000
2025-07-21	Hestia Publishers & Booksellers I. D. Kollaros & Co. S.A. Insufficient technical and organisational measures to ensure information security	🇪🇺 Hellenic Data Protection Authority (HDPA)	Art. 5 Art. 25 Art. 32 Art. 33	€9,000
2025-07-21	Hestia Publishers & Booksellers I. D. Kollaros & Co. S.A. Insufficient technical and organisational measures to ensure information security	🇪🇺 Hellenic Data Protection Authority (HDPA)	Art. 5 Art. 25 Art. 32 Art. 33	€9,000
2025-07-04	Zougla TZI-AP Anonymous Mass Media Company Insufficient legal basis for data processing	🇪🇺 Hellenic Data Protection Authority (HDPA)	Art. 5 Art. 31	€3,000
2025-07-04	Zougla TZI-AP Anonymous Mass Media Company Insufficient legal basis for data processing	🇪🇺 Hellenic Data Protection Authority (HDPA)	Art. 5 Art. 31	€3,000
2025-06-25	Vodafone – PANAFON A.E.E.T. Insufficient technical and organisational measures to ensure information security	🇪🇺 Hellenic Data Protection Authority (HDPA)	Art. 5 Art. 28	€550,000
2025-06-25	Vodafone – PANAFON A.E.E.T. Insufficient technical and organisational measures to ensure information security	🇪🇺 Hellenic Data Protection Authority (HDPA)	Art. 5 Art. 28	€550,000
2025-06-24	Shield of David - K.I.D.A.F. Non-compliance with general data processing principles	🇪🇺 Hellenic Data Protection Authority (HDPA)	Art. 5 Art. 12 Art. 13 Art. 15	€10,000
2025-06-24	Shield of David - K.I.D.A.F. Non-compliance with general data processing principles	🇪🇺 Hellenic Data Protection Authority (HDPA)	Art. 5 Art. 12 Art. 13 Art. 15	€10,000
2025-06-24	General Hospital of the University of Larissa Insufficient fulfilment of data subjects rights	🇪🇺 Hellenic Data Protection Authority (HDPA)	Art. 5 Art. 14 Art. 15	€7,000

1–25 of 61 next →