▲ Enforcement Tracker

3,806 GDPR enforcement decisions from 65 countries, updated daily. Compare fines by country or authority →

Total fines · last 12 months

€2.5B

+124% vs previous year

Decisions · last 12 months

631

53 per month avg

Largest · last 90 days

€825.0M

Uber Technologies Inc. · The Netherlands

Most active authority

Italian Data Protection Authority (Garante)

116 decisions · Italy

Monthly fine totals · last 12 months

NovDecJanFebMarAprMayJunJulAugSepOct

reset

Date ↓	Company / party	Authority	Articles	Fine
2026-05-07	South Staffordshire Plc Insufficient technical and organisational measures to ensure information security	🇬🇧 Information Commissioner (ICO)	Art. 5 Art. 32	€1,112,100
2026-02-23	Reddit, Inc. Non-compliance with general data processing principles	🇬🇧 Information Commissioner (ICO)	Art. 5 Art. 6 Art. 8 Art. 35	€16,610,000
2025-12-12	Chief Constable of the Police Service of Scotland Insufficient technical and organisational measures to ensure information security	🇬🇧 Information Commissioner (ICO)	Art. 5 Art. 25 Art. 32 Art. 33	€75,700
2025-11-20	LastPass UK Ltd Insufficient technical and organisational measures to ensure information security	🇪🇺 Information Commissioner (ICO)	Art. 5 Art. 32	€1,400,000
2025-11-20	LastPass UK Ltd Insufficient technical and organisational measures to ensure information security	🇪🇺 Information Commissioner (ICO)	Art. 5 Art. 32	€1,400,000
2025-10-15	CAPITA PLC Insufficient technical and organisational measures to ensure information security	🇪🇺 Information Commissioner (ICO)	Art. 5 Art. 32	€9,180,000
2025-10-15	CAPITA PLC Insufficient technical and organisational measures to ensure information security	🇪🇺 Information Commissioner (ICO)	Art. 5 Art. 32	€9,180,000
2025-06-24	Birthlink Insufficient technical and organisational measures to ensure information security	🇪🇺 Information Commissioner (ICO)	Art. 5 Art. 32 Art. 33	€20,725
2025-06-24	Birthlink Insufficient technical and organisational measures to ensure information security	🇪🇺 Information Commissioner (ICO)	Art. 5 Art. 32 Art. 33	€20,725
2025-06-05	23andMe, Inc. Insufficient technical and organisational measures to ensure information security	🇪🇺 Information Commissioner (ICO)	Art. 5 Art. 32	€2,700,000
2025-06-05	23andMe, Inc. Insufficient technical and organisational measures to ensure information security	🇪🇺 Information Commissioner (ICO)	Art. 5 Art. 32	€2,700,000
2025-04-14	DPP Law Ltd. Insufficient technical and organisational measures to ensure information security	🇪🇺 Information Commissioner (ICO)	Art. 5 Art. 32 Art. 33	€70,300
2025-04-14	DPP Law Ltd. Insufficient technical and organisational measures to ensure information security	🇪🇺 Information Commissioner (ICO)	Art. 5 Art. 32 Art. 33	€70,300
2024-09-26	Police Service of Northern Ireland Insufficient technical and organisational measures to ensure information security	🇪🇺 Information Commissioner (ICO)	Art. 5 Art. 32	€904,000
2024-04-30	Central Young Men’s Christian Association Insufficient technical and organisational measures to ensure information security	🇪🇺 Information Commissioner (ICO)	Art. 5 Art. 32	€8,700
2023-04-04	TikTok Non-compliance with general data processing principles	🇪🇺 Information Commissioner (ICO)	Art. 5 Art. 12 Art. 13	€14,500,000
2022-10-19	Interserve Group Limited Insufficient technical and organisational measures to ensure information security	🇪🇺 Information Commissioner (ICO)	Art. 5 Art. 32	€5,033,000
2022-10-04	Easylife Ltd. Insufficient legal basis for data processing	🇪🇺 Information Commissioner (ICO)	Art. 5 Art. 6 Art. 9 Art. 13	€1,547,000
2022-06-09	Tavistock & Portman NHS Foundation Trust Insufficient technical and organisational measures to ensure information security	🇪🇺 Information Commissioner (ICO)	Art. 5 Art. 32	€91,000
2022-05-18	Clearview Al Inc. Non-compliance with general data processing principles	🇪🇺 Information Commissioner (ICO)	Art. 5 Art. 6 Art. 9 Art. 14	€9,000,000
2022-03-10	Tuckers Solicitors LLP Non-compliance with general data processing principles	🇪🇺 Information Commissioner (ICO)	Art. 5	€115,000
2021-11-25	Cabinet Office Insufficient technical and organisational measures to ensure information security	🇪🇺 Information Commissioner (ICO)	Art. 5 Art. 32	€585,000
2021-10-18	HIV Scotland Insufficient technical and organisational measures to ensure information security	🇪🇺 Information Commissioner (ICO)	Art. 5 Art. 32	€11,800
2021-07-05	Mermaids Insufficient technical and organisational measures to ensure information security	🇪🇺 Information Commissioner (ICO)	Art. 5 Art. 32	€29,000
2020-11-13	Ticketmaster UK Limited Insufficient technical and organisational measures to ensure information security	🇪🇺 Information Commissioner (ICO)	Art. 5 Art. 32	€1,405,000

1–25 of 26 next →