▲ Enforcement Tracker
3,488 GDPR enforcement decisions from 52 countries, updated daily.
Total fines · last 12 months
€1.3B
+875% vs previous year
Decisions · last 12 months
531
44 per month avg
Monthly fine totals · last 12 months
AugSepOctNovDecJanFebMarAprMayJunJul
| Date ↓ | Company / party | Authority | Articles | Fine |
|---|---|---|---|---|
| 2021-09-24 | Vattenfall Europe Sales GmbH Insufficient data processing agreement | 🇪🇺 Data Protection Authority of Hamburg | Art. 12Art. 13 | €900,000 |
| 2021-09-24 | SPAIN DPA: Insufficient fulfilment of information obligations Insufficient fulfilment of information obligations | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 13 | €3,000 |
| 2021-09-21 | Ultra-Technology AS Insufficient legal basis for data processing | 🇪🇺 Norwegian Supervisory Authority (Datatilsynet) | Art. 6 | €12,500 |
| 2021-09-21 | Istituto Comprensivo - IC Cosenza III “V. Negroni” Insufficient legal basis for data processing | 🇪🇺 Italian Data Protection Authority (Garante) | Art. 5Art. 6Art. 9Art. 2 | €2,000 |
| 2021-09-20 | ST. OLAVS HOSPITAL HF Insufficient technical and organisational measures to ensure information security | 🇪🇺 Norwegian Supervisory Authority (Datatilsynet) | Art. 32 | €75,600 |
| 2021-09-20 | Høylandet Municipality Insufficient technical and organisational measures to ensure information security | 🇪🇺 Norwegian Supervisory Authority (Datatilsynet) | Art. 32 | €40,200 |
| 2021-09-20 | CEDICO, CENTRO DE DIAGNÓSTICO POR LA IMÁGEN, S.L. Non-compliance with general data processing principles | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 5 | €18,000 |
| 2021-09-17 | Syddanmark Region Insufficient technical and organisational measures to ensure information security | 🇪🇺 Danish Data Protection Authority (Datatilsynet) | Art. 32 | €67,200 |
| 2021-09-17 | Mediterranean Hospital of Cyprus Insufficient cooperation with supervisory authority | 🇪🇺 Cypriot Data Protection Commissioner | Art. 31Art. 58 | €10,000 |
| 2021-09-16 | Sky Italia S.r.l. Insufficient legal basis for data processing | 🇪🇺 Italian Data Protection Authority (Garante) | Art. 5Art. 6Art. 7Art. 12 | €3,296,326 |
| 2021-09-16 | Bocconi University Non-compliance with general data processing principles | 🇪🇺 Italian Data Protection Authority (Garante) | Art. 5Art. 6Art. 9Art. 13 | €200,000 |
| 2021-09-16 | Favrskov municipality Insufficient technical and organisational measures to ensure information security | 🇪🇺 Danish Data Protection Authority (Datatilsynet) | Art. 32 | €10,000 |
| 2021-09-16 | La Prima S.r.l. Insufficient legal basis for data processing | 🇪🇺 Italian Data Protection Authority (Garante) | Art. 5Art. 6Art. 24Art. 25 | €5,000 |
| 2021-09-16 | Ciechi Ardizzone Gioeni di Catania Non-compliance with general data processing principles | 🇪🇺 Italian Data Protection Authority (Garante) | Art. 5Art. 12Art. 13Art. 35 | €5,000 |
| 2021-09-16 | Comune di Montalbano Jonico Non-compliance with general data processing principles | 🇪🇺 Italian Data Protection Authority (Garante) | Art. 5Art. 6Art. 9Art. 2 | €5,000 |
| 2021-09-16 | Frigorifica Botana S.L. Non-compliance with general data processing principles | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 5 | €4,000 |
| 2021-09-16 | Farpa s.r.l. Non-compliance with general data processing principles | 🇪🇺 Italian Data Protection Authority (Garante) | Art. 5Art. 13Art. 88Art. 114 | €1,000 |
| 2021-09-15 | Société nouvelle de l’annuaire français Insufficient fulfilment of data subjects rights | 🇪🇺 French Data Protection Authority (CNIL) | Art. 16Art. 17Art. 30Art. 31 | €3,000 |
| 2021-09-14 | Vodafone España, S.A.U. Insufficient legal basis for data processing | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 6 | €56,000 |
| 2021-09-14 | Vodafone España, S.A.U. Insufficient legal basis for data processing | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 6 | €56,000 |
| 2021-09-14 | Vodafone España, S.A.U. Insufficient legal basis for data processing | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 6 | €56,000 |
| 2021-09-14 | Vodafone España, S.A.U. Insufficient legal basis for data processing | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 6 | €56,000 |
| 2021-09-14 | Vodafone España, S.A.U. Insufficient legal basis for data processing | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 6 | €40,000 |
| 2021-09-13 | Website operator Insufficient legal basis for data processing | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 6Art. 13 | €9,000 |
| 2021-09-13 | GESTIONES AUTO LOW COST S. L. Insufficient fulfilment of information obligations | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 13 | €1,000 |