▲ Enforcement Tracker
3,510 GDPR enforcement decisions from 66 countries, updated daily. Compare fines by country or authority →
Total fines · last 12 months
€2.4B
+307% vs previous year
Decisions · last 12 months
539
45 per month avg
Monthly fine totals · last 12 months
NovDecJanFebMarAprMayJunJulAugSepOct
| Date ↓ | Company / party | Authority | Articles | Fine |
|---|---|---|---|---|
| 2021-10-19 | Vodafone España, S.A.U. Insufficient fulfilment of data subjects rights | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 21 | €70,000 |
| 2021-10-19 | Vodafone España, S.A.U. Insufficient legal basis for data processing | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 6 | €40,000 |
| 2021-10-19 | BEEPING FULFILMENT S.L. Insufficient fulfilment of information obligations | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 13 | €2,000 |
| 2021-10-18 | Østre Toten municipality Insufficient technical and organisational measures to ensure information security | 🇪🇺 Norwegian Supervisory Authority (Datatilsynet) | Art. 5Art. 32 | €412,000 |
| 2021-10-18 | HIV Scotland Insufficient technical and organisational measures to ensure information security | 🇪🇺 Information Commissioner (ICO) | Art. 5Art. 32 | €11,800 |
| 2021-10-14 | Bank Millennium S.A Insufficient fulfilment of data breach notification obligations | 🇪🇺 Polish National Personal Data Protection Office (UODO) | Art. 33Art. 34 | €78,000 |
| 2021-10-14 | ΚΑΠΑ ΛΑΜΔΑ ΩΜΕΓΑ ΔΙΑΦΗΜΙΣΤΙΚΗ ΕΜΠΟΡΙΚΗ ΜΟΝΟΠΡΟΣΩΠΗ ΕΤΑΙΡΕΙΑ ΠΕΡΙΟΡΙΣΜΕΝΗΣ ΕΥΘΥΝΗΣ Insufficient legal basis for data processing | 🇪🇺 Hellenic Data Protection Authority (HDPA) | Art. 6Art. 12Art. 21 | €20,000 |
| 2021-10-14 | Health Protection Agency of Sardinia (ATS) Insufficient legal basis for data processing | 🇪🇺 Italian Data Protection Authority (Garante) | Art. 5Art. 9 | €8,000 |
| 2021-10-13 | Vodafone España, S.A.U. Non-compliance with general data processing principles | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 5Art. 32 | €40,000 |
| 2021-10-13 | LUXEMBOURG DPA: Insufficient involvement of data protection officer Insufficient involvement of data protection officer | 🇪🇺 National Commission for Data Protection (CNPD) | Art. 37Art. 38Art. 39 | €18,000 |
| 2021-10-13 | LUXEMBOURG DPA: Insufficient involvement of data protection officer Insufficient involvement of data protection officer | 🇪🇺 National Commission for Data Protection (CNPD) | Art. 38Art. 39 | €13,200 |
| 2021-10-11 | MAF.COM ESQUI CLUB Insufficient legal basis for data processing | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 7 | €10,000 |
| 2021-10-08 | ORANGE ESPAGNE, S.A.U. Insufficient legal basis for data processing | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 6 | €30,000 |
| 2021-10-08 | DSB Austria: Publishing companies-register data on free ad-funded platform unlawful | 🇦🇹 DSB (Austria) | Art. 61Art. 6Art. 511Art. 51 | — |
| 2021-10-06 | LUXEMBOURG DPA: Non-compliance with general data processing principles Non-compliance with general data processing principles | 🇪🇺 National Commission for Data Protection (CNPD) | Art. 5Art. 13 | €5,300 |
| 2021-10-06 | Facebook Ireland Limited Insufficient fulfilment of information obligations | 🇪🇺 Data Protection Authority of Ireland | Art. 5Art. 12Art. 13 | — |
| 2021-10-05 | CLUB DEPORTIVO SANSUEÑA, S.L. Insufficient legal basis for data processing | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 5Art. 6Art. 32 | €4,000 |
| 2021-10-04 | PREMIUMMEDIA ΠΑΡΑΓΩΓΗ ΟΠΤΙΚΟ-ΑΚΟΥΣΤΙΚΩΝ ΕΡΓΩΝ ΙΔΙΩΤΙΚΗ ΚΕΦΑΛΑΙΟΥΧΙΚΗ ΕΤΑΙΡΙΑ Insufficient fulfilment of data subjects rights | 🇪🇺 Hellenic Data Protection Authority (HDPA) | Art. 21Art. 25 | €5,000 |
| 2021-10-04 | CALDERERIA Y SOLDADURA DE ESTRUCTURAS METALICAS, S.L. Insufficient legal basis for data processing | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 6 | €5,000 |
| 2021-10-04 | Store owner Non-compliance with general data processing principles | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 5 | €2,000 |
| 2021-10-04 | Store owner Insufficient fulfilment of information obligations | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 13 | €1,000 |
| 2021-09-29 | Danish Cancer Society Insufficient technical and organisational measures to ensure information security | 🇪🇺 Danish Data Protection Authority (Datatilsynet) | Art. 32 | €107,000 |
| 2021-09-29 | Territorial Administration of the Government of Genoa Insufficient legal basis for data processing | 🇪🇺 Italian Data Protection Authority (Garante) | Art. 5Art. 6Art. 2 | €11,000 |
| 2021-09-29 | ACONCAGUA JUEGOS S.A. Insufficient involvement of data protection officer | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 37 | €10,000 |
| 2021-09-29 | CYNGASA, S.L. Insufficient legal basis for data processing | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 6 | €5,000 |