▲ Enforcement Tracker

3,806 GDPR enforcement decisions from 65 countries, updated daily. Compare fines by country or authority →

Total fines · last 12 months

€2.5B

+124% vs previous year

Decisions · last 12 months

631

53 per month avg

Largest · last 90 days

€825.0M

Uber Technologies Inc. · The Netherlands

Most active authority

Italian Data Protection Authority (Garante)

116 decisions · Italy

Monthly fine totals · last 12 months

NovDecJanFebMarAprMayJunJulAugSepOct

reset

Date ↓	Company / party	Authority	Articles	Fine
2024-06-24	Avanza Bank AB Insufficient technical and organisational measures to ensure information security	🇪🇺 Data Protection Authority of Sweden	Art. 5 Art. 32	€1,300,000
2023-10-03	Schockholm School borard Non-compliance with general data processing principles	🇪🇺 Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)	Art. 5 Art. 6 Art. 13	€70,000
2023-08-28	Trygg-Hansa Non-compliance with general data processing principles	🇪🇺 Data Protection Authority of Sweden	Art. 5 Art. 32	€3,000,000
2022-03-28	Klarna Bank AB Insufficient fulfilment of information obligations	🇪🇺 Data Protection Authority of Sweden	Art. 5 Art. 12 Art. 13 Art. 14	€720,000
2022-01-26	Uppsala hospital board Insufficient technical and organisational measures to ensure information security	🇪🇺 Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)	Art. 5 Art. 32	€152,000
2021-06-21	Storstockholms Lokaltrafik Insufficient legal basis for data processing	🇪🇺 Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)	Art. 5 Art. 6 Art. 13	€1,600,000
2021-06-09	Directorate of the Östra Skaraborg Rescue Service Non-compliance with general data processing principles	🇪🇺 Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)	Art. 5 Art. 32	€34,800
2021-06-07	MedHelp AB Non-compliance with general data processing principles	🇪🇺 Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)	Art. 5 Art. 6 Art. 9 Art. 13	€1,200,000
2021-06-07	Region Stockholm Insufficient fulfilment of information obligations	🇪🇺 Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)	Art. 5 Art. 13 Art. 14	€50,000
2021-06-07	Region Sörmland Insufficient fulfilment of information obligations	🇪🇺 Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)	Art. 5 Art. 13	€25,000
2021-06-07	Region Värmland Insufficient fulfilment of information obligations	🇪🇺 Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)	Art. 5 Art. 13	€25,000
2020-12-15	Uppsalahem AB Insufficient legal basis for data processing	🇪🇺 Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)	Art. 5 Art. 6	€29,500
2020-12-11	Umeå University Insufficient technical and organisational measures to ensure information security	🇪🇺 Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)	Art. 5 Art. 32	€54,000
2020-12-03	Capio St. Göran AB Insufficient technical and organisational measures to ensure information security	🇪🇺 Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)	Art. 5 Art. 32	€2,900,000
2020-12-03	Aleris Sjukvård AB Insufficient technical and organisational measures to ensure information security	🇪🇺 Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)	Art. 5 Art. 32	€1,463,000
2020-12-03	Aleris Sjukvård AB Insufficient technical and organisational measures to ensure information security	🇪🇺 Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)	Art. 5 Art. 32	€1,168,000
2020-12-03	Karolinska University Hospital of Solna Insufficient technical and organisational measures to ensure information security	🇪🇺 Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)	Art. 5 Art. 32	€390,100
2020-12-03	Sahlgrenska University Hospital Insufficient technical and organisational measures to ensure information security	🇪🇺 Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)	Art. 5 Art. 32	€341,300
2020-12-03	Östergötland Region Insufficient technical and organisational measures to ensure information security	🇪🇺 Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)	Art. 5 Art. 32	€243,800
2020-12-03	Västerbotten Region Insufficient technical and organisational measures to ensure information security	🇪🇺 Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)	Art. 5 Art. 32	€243,800
2020-11-25	Gnosjö Municipality Insufficient legal basis for data processing	🇪🇺 Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)	Art. 5 Art. 6 Art. 13 Art. 35	€19,500
2020-11-24	City of Stockholm Insufficient technical and organisational measures to ensure information security	🇪🇺 Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)	Art. 5 Art. 32	€394,000
2020-06-16	Housing Association Non-compliance with general data processing principles	🇪🇺 Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)	Art. 5 Art. 6	€1,900
2020-05-12	Health and Medical Board of the Region of Örebro County Insufficient legal basis for data processing	🇪🇺 Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)	Art. 5 Art. 6	€11,200
2020-03-11	Google LLC Insufficient fulfilment of data subjects rights	🇪🇺 Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)	Art. 5 Art. 6 Art. 17	€5,000,000

1–25 of 26 next →