▲ Enforcement Tracker

3,806 GDPR enforcement decisions from 65 countries, updated daily. Compare fines by country or authority →

Total fines · last 12 months

€2.5B

+124% vs previous year

Decisions · last 12 months

633

53 per month avg

Largest · last 90 days

€825.0M

Uber Technologies Inc. · The Netherlands

Most active authority

Italian Data Protection Authority (Garante)

116 decisions · Italy

Monthly fine totals · last 12 months

NovDecJanFebMarAprMayJunJulAugSepOct

reset

Date ↓	Company / party	Authority	Articles	Fine
2026-09-21	Google Ireland Limited Insufficient legal basis for data processing	🇮🇪 Data Protection Commission (DPC)	Art. 5 Art. 6 Art. 12 Art. 13	€403,000,000
2026-08-25	Health Service Executive (HSE) Insufficient technical and organisational measures to ensure information security	🇮🇪 Data Protection Commission (DPC)	Art. 5 Art. 32 Art. 33 Art. 34	€645,000
2026-06-11	Midlands Regional Hospital Tullamore, County Offaly Insufficient technical and organisational measures to ensure information security	🇮🇪 Data Protection Authority of Ireland	Art. 5 Art. 28 Art. 30 Art. 32	€300,000
2026-05-08	Permanent TSB Insufficient technical and organisational measures to ensure information security	🇮🇪 Data Protection Authority of Ireland	Art. 5 Art. 32 Art. 33	€277,500
2026-04-30	Permanent TSB plc Insufficient technical and organisational measures to ensure information security	🇮🇪 Data Protection Authority of Ireland	Art. 5 Art. 32 Art. 33	€277,500
2025-12-10	University of Limerick Insufficient technical and organisational measures to ensure information security	🇮🇪 Data Protection Authority of Ireland	Art. 5 Art. 30 Art. 32 Art. 33	€98,000
2025-06-23	City of Dublin Education and Training Board Insufficient technical and organisational measures to ensure information security	🇪🇺 Data Protection Authority of Ireland	Art. 5 Art. 32 Art. 33 Art. 34	€125,000
2025-06-23	City of Dublin Education and Training Board Insufficient technical and organisational measures to ensure information security	🇪🇺 Data Protection Authority of Ireland	Art. 5 Art. 32 Art. 33 Art. 34	€125,000
2025-06-12	Departement of Social Security Insufficient legal basis for data processing	🇪🇺 Data Protection Authority of Ireland	Art. 5 Art. 6 Art. 9 Art. 13	€550,000
2025-06-12	Departement of Social Security Insufficient legal basis for data processing	🇪🇺 Data Protection Authority of Ireland	Art. 5 Art. 6 Art. 9 Art. 13	€550,000
2024-11-22	Maynooth University Insufficient technical and organisational measures to ensure information security	🇪🇺 Data Protection Authority of Ireland	Art. 5 Art. 32 Art. 33	€40,000
2024-11-13	Sligo County Council Non-compliance with general data processing principles	🇪🇺 Data Protection Authority of Ireland	Art. 5 Art. 13 Art. 24 Art. 25	€29,500
2023-09-01	TikTok Limited Non-compliance with general data processing principles	🇪🇺 Data Protection Authority of Ireland	Art. 5 Art. 12 Art. 13 Art. 24	€345,000,000
2023-08-22	DPC (Ireland) - 06/SIU/2018	🇮🇪 DPC (Ireland)	Art. 51 Art. 5 Art. 24 Art. 351	—
2023-06-16	Irish Departement of Health Non-compliance with general data processing principles	🇪🇺 Data Protection Authority of Ireland	Art. 5 Art. 6 Art. 9	€22,500
2023-02-27	Bank of Ireland 365 Insufficient technical and organisational measures to ensure information security	🇪🇺 Data Protection Authority of Ireland	Art. 5 Art. 32	€750,000
2023-01-23	Centric Health Ltd. Non-compliance with general data processing principles	🇪🇺 Data Protection Authority of Ireland	Art. 5 Art. 32	€460,000
2023-01-16	DPC (Ireland) reprimands Kildare County Council over surveillance tech and CCTV compliance	🇮🇪 DPC (Ireland)	Art. 2 Art. 5 Art. 6 Art. 13	€50,000
2022-12-22	VIEC Limited Non-compliance with general data processing principles	🇪🇺 Data Protection Authority of Ireland	Art. 5 Art. 32	€100,000
2022-09-05	Meta Platforms, Inc. Non-compliance with general data processing principles	🇪🇺 Data Protection Authority of Ireland	Art. 5 Art. 6 Art. 12 Art. 24	€405,000,000
2022-01-26	Slane Credit Union Ltd. Insufficient technical and organisational measures to ensure information security	🇪🇺 Data Protection Authority of Ireland	Art. 5 Art. 24 Art. 28 Art. 30	€5,000
2021-12-02	Irish Teacher Council Insufficient technical and organisational measures to ensure information security	🇪🇺 Data Protection Authority of Ireland	Art. 5 Art. 32 Art. 33	€60,000
2021-10-06	Facebook Ireland Limited Insufficient fulfilment of information obligations	🇪🇺 Data Protection Authority of Ireland	Art. 5 Art. 12 Art. 13	—
2021-09-02	WhatsApp Ireland Ltd. Insufficient fulfilment of information obligations	🇪🇺 Data Protection Authority of Ireland	Art. 5 Art. 12 Art. 13 Art. 14	€225,000,000
2021-08-20	MOVE Ireland Insufficient technical and organisational measures to ensure information security	🇪🇺 Data Protection Authority of Ireland	Art. 5 Art. 32	€1,500

1–25 of 29 next →