▲ Enforcement Tracker
3,488 GDPR enforcement decisions from 52 countries, updated daily.
Total fines · last 12 months
€1.3B
+875% vs previous year
Decisions · last 12 months
531
44 per month avg
Monthly fine totals · last 12 months
AugSepOctNovDecJanFebMarAprMayJunJul
| Date ↓ | Company / party | Authority | Articles | Fine |
|---|---|---|---|---|
| 2021-10-18 | HIV Scotland Insufficient technical and organisational measures to ensure information security | 🇪🇺 Information Commissioner (ICO) | Art. 5Art. 32 | €11,800 |
| 2021-10-14 | Bank Millennium S.A Insufficient fulfilment of data breach notification obligations | 🇪🇺 Polish National Personal Data Protection Office (UODO) | Art. 33Art. 34 | €78,000 |
| 2021-10-14 | ΚΑΠΑ ΛΑΜΔΑ ΩΜΕΓΑ ΔΙΑΦΗΜΙΣΤΙΚΗ ΕΜΠΟΡΙΚΗ ΜΟΝΟΠΡΟΣΩΠΗ ΕΤΑΙΡΕΙΑ ΠΕΡΙΟΡΙΣΜΕΝΗΣ ΕΥΘΥΝΗΣ Insufficient legal basis for data processing | 🇪🇺 Hellenic Data Protection Authority (HDPA) | Art. 6Art. 12Art. 21 | €20,000 |
| 2021-10-14 | Health Protection Agency of Sardinia (ATS) Insufficient legal basis for data processing | 🇪🇺 Italian Data Protection Authority (Garante) | Art. 5Art. 9 | €8,000 |
| 2021-10-13 | Vodafone España, S.A.U. Non-compliance with general data processing principles | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 5Art. 32 | €40,000 |
| 2021-10-13 | LUXEMBOURG DPA: Insufficient involvement of data protection officer Insufficient involvement of data protection officer | 🇪🇺 National Commission for Data Protection (CNPD) | Art. 37Art. 38Art. 39 | €18,000 |
| 2021-10-13 | LUXEMBOURG DPA: Insufficient involvement of data protection officer Insufficient involvement of data protection officer | 🇪🇺 National Commission for Data Protection (CNPD) | Art. 38Art. 39 | €13,200 |
| 2021-10-11 | MAF.COM ESQUI CLUB Insufficient legal basis for data processing | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 7 | €10,000 |
| 2021-10-08 | ORANGE ESPAGNE, S.A.U. Insufficient legal basis for data processing | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 6 | €30,000 |
| 2021-10-06 | LUXEMBOURG DPA: Non-compliance with general data processing principles Non-compliance with general data processing principles | 🇪🇺 National Commission for Data Protection (CNPD) | Art. 5Art. 13 | €5,300 |
| 2021-10-06 | Facebook Ireland Limited Insufficient fulfilment of information obligations | 🇪🇺 Data Protection Authority of Ireland | Art. 5Art. 12Art. 13 | — |
| 2021-10-05 | CLUB DEPORTIVO SANSUEÑA, S.L. Insufficient legal basis for data processing | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 5Art. 6Art. 32 | €4,000 |
| 2021-10-04 | PREMIUMMEDIA ΠΑΡΑΓΩΓΗ ΟΠΤΙΚΟ-ΑΚΟΥΣΤΙΚΩΝ ΕΡΓΩΝ ΙΔΙΩΤΙΚΗ ΚΕΦΑΛΑΙΟΥΧΙΚΗ ΕΤΑΙΡΙΑ Insufficient fulfilment of data subjects rights | 🇪🇺 Hellenic Data Protection Authority (HDPA) | Art. 21Art. 25 | €5,000 |
| 2021-10-04 | CALDERERIA Y SOLDADURA DE ESTRUCTURAS METALICAS, S.L. Insufficient legal basis for data processing | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 6 | €5,000 |
| 2021-10-04 | Store owner Non-compliance with general data processing principles | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 5 | €2,000 |
| 2021-10-04 | Store owner Insufficient fulfilment of information obligations | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 13 | €1,000 |
| 2021-09-29 | Danish Cancer Society Insufficient technical and organisational measures to ensure information security | 🇪🇺 Danish Data Protection Authority (Datatilsynet) | Art. 32 | €107,000 |
| 2021-09-29 | Territorial Administration of the Government of Genoa Insufficient legal basis for data processing | 🇪🇺 Italian Data Protection Authority (Garante) | Art. 5Art. 6Art. 2 | €11,000 |
| 2021-09-29 | ACONCAGUA JUEGOS S.A. Insufficient involvement of data protection officer | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 37 | €10,000 |
| 2021-09-29 | CYNGASA, S.L. Insufficient legal basis for data processing | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 6 | €5,000 |
| 2021-09-29 | Physician Insufficient legal basis for data processing | 🇪🇺 Italian Data Protection Authority (Garante) | Art. 5Art. 9 | €2,000 |
| 2021-09-28 | Austrian Post Insufficient fulfilment of data subjects rights | 🇪🇺 Austrian Data Protection Authority (dsb) | Art. 12 | €9,500,000 |
| 2021-09-28 | Address Broker Insufficient fulfilment of data subjects rights | 🇪🇺 Austrian Data Protection Authority (dsb) | Art. 12 | €500,000 |
| 2021-09-28 | Bar owner Non-compliance with general data processing principles | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 5 | €3,000 |
| 2021-09-27 | Ferde AS Non-compliance with general data processing principles | 🇪🇺 Norwegian Supervisory Authority (Datatilsynet) | Art. 5Art. 28Art. 32Art. 44 | €496,000 |