▲ Enforcement Tracker

3,806 GDPR enforcement decisions from 65 countries, updated daily. Compare fines by country or authority →

Total fines · last 12 months

€2.5B

+124% vs previous year

Decisions · last 12 months

631

53 per month avg

Largest · last 90 days

€825.0M

Uber Technologies Inc. · The Netherlands

Most active authority

Italian Data Protection Authority (Garante)

116 decisions · Italy

Monthly fine totals · last 12 months

NovDecJanFebMarAprMayJunJulAugSepOct

reset

Date ↓	Company / party	Authority	Articles	Fine
2026-09-30	Icelandic DPA opens formal proceedings against Isavia over ANPR parking cameras at	🇮🇸 Persónuvernd (Island)	Art. 51 Art. 5 Art. 12 Art. 13	—
2026-09-23	Persónuvernd: Icelandic Farmers’ Association breached GDPR by disclosing owner data to	🇮🇸 Persónuvernd (Iceland)	Art. 51 Art. 5 Art. 14	—
2026-09-17	Iceland DPA: Reykjavik Social Services may not request bank statements and receipts from	🇮🇸 Persónuvernd (Iceland)	Art. 51 Art. 5 Art. 61 Art. 6	—
2026-07-01	Persónuvernd (Island) - 2025010358	🇮🇸 Persónuvernd (Island)	Art. 51 Art. 5 Art. 52 Art. 321	—
2026-06-24	Persónuvernd (Iceland) - 2025010364	🇮🇸 Persónuvernd (Iceland)	Art. 51 Art. 5 Art. 51 Art. 51	—
2025-02-17	Primary Health Care in the Capital Area Insufficient legal basis for data processing	🇪🇺 Icelandic data protection authority ('Persónuvernd')	Art. 5 Art. 6 Art. 9	€34,300
2024-03-24	Stjörnuna ehf Non-compliance with general data processing principles	🇪🇺 Icelandic data protection authority ('Persónuvernd')	Art. 5 Art. 6 Art. 12 Art. 13	€10,000
2023-12-06	City of Kópavogur Non-compliance with general data processing principles	🇪🇺 Icelandic data protection authority ('Persónuvernd')	Art. 5 Art. 24 Art. 28	€20,000
2023-12-06	City of Hafnarfjörður Non-compliance with general data processing principles	🇪🇺 Icelandic data protection authority ('Persónuvernd')	Art. 5 Art. 24 Art. 28	€18,600
2023-12-06	Garðabær municipality Non-compliance with general data processing principles	🇪🇺 Icelandic data protection authority ('Persónuvernd')	Art. 5 Art. 24 Art. 28	€16,600
2023-12-06	Reykjanesbær municipality Non-compliance with general data processing principles	🇪🇺 Icelandic data protection authority ('Persónuvernd')	Art. 5 Art. 24 Art. 28	€16,600
2023-12-06	City of Reykjavik Non-compliance with general data processing principles	🇪🇺 Icelandic data protection authority ('Persónuvernd')	Art. 5 Art. 24 Art. 28	€13,300
2023-09-06	University of Iceland Insufficient fulfilment of information obligations	🇪🇺 Icelandic data protection authority ('Persónuvernd')	Art. 5 Art. 12 Art. 13	€10,300
2023-07-03	Heilsuveru Insufficient technical and organisational measures to ensure information security	🇪🇺 Icelandic data protection authority ('Persónuvernd')	Art. 5 Art. 25 Art. 32	€81,000
2023-06-28	Sjúkratyringur Íslands Insufficient technical and organisational measures to ensure information security	🇪🇺 Icelandic data protection authority ('Persónuvernd')	Art. 5 Art. 25 Art. 32	€13,400
2023-06-27	Creditinfo Lánstraust hf. Insufficient legal basis for data processing	🇪🇺 Icelandic data protection authority ('Persónuvernd')	Art. 5 Art. 6 Art. 8 Art. 9	€257,000
2023-06-27	eCommerce 2020 ApS Insufficient legal basis for data processing	🇪🇺 Icelandic data protection authority ('Persónuvernd')	Art. 5 Art. 6 Art. 8 Art. 9	€51,000
2023-06-27	Almennri innheimtu ehf Insufficient legal basis for data processing	🇪🇺 Icelandic data protection authority ('Persónuvernd')	Art. 5 Art. 6 Art. 8 Art. 9	€24,000
2022-05-03	City of Reykjavík Insufficient legal basis for data processing	🇪🇺 Icelandic data protection authority ('Persónuvernd')	Art. 5 Art. 6 Art. 32	€36,000
2022-03-08	Hörpu tónlistar- og ráðstefnuhúss ohf. Non-compliance with general data processing principles	🇪🇺 Icelandic data protection authority ('Persónuvernd')	Art. 5 Art. 6	€7,000
2021-11-23	Icelandic Ministry of Industry and Innovation Non-compliance with general data processing principles	🇪🇺 Icelandic data protection authority ('Persónuvernd')	Art. 5 Art. 6 Art. 7 Art. 13	€51,000
2021-11-23	YAY ehf. Non-compliance with general data processing principles	🇪🇺 Icelandic data protection authority ('Persónuvernd')	Art. 5 Art. 6 Art. 28 Art. 32	€27,200
2021-06-15	Huppuís ehf Non-compliance with general data processing principles	🇪🇺 Icelandic data protection authority ('Persónuvernd')	Art. 5 Art. 6 Art. 12 Art. 13	€34,000
2020-03-10	National Center of Addiction Medicine ('SAA') Insufficient technical and organisational measures to ensure information security	🇪🇺 Icelandic data protection authority ('Persónuvernd')	Art. 5 Art. 32	€20,600
2020-03-10	Breiðholt Upper Secondary School Insufficient technical and organisational measures to ensure information security	🇪🇺 Icelandic data protection authority ('Persónuvernd')	Art. 5 Art. 32	€9,000