▲ Enforcement Tracker

3,488 GDPR enforcement decisions from 52 countries, updated daily.

Total fines · last 12 months

€1.3B

+875% vs previous year

Decisions · last 12 months

531

44 per month avg

Largest · last 90 days

€6.6M

Poste Italiane S.p.a. · Italy

Most active authority

Spanish Data Protection Authority (aepd)

110 decisions · SPAIN

Monthly fine totals · last 12 months

AugSepOctNovDecJanFebMarAprMayJunJul

Date ↓	Company / party	Authority	Articles	Fine
2020-12-18	Legal Person Insufficient legal basis for data processing	🇪🇺 Czech Data Protection Auhtority (UOOU)	Art. 6 Art. 14	€26,710
2020-12-18	Legal Person Insufficient legal basis for data processing	🇪🇺 Czech Data Protection Auhtority (UOOU)	Art. 6 Art. 14	€12,910
2020-12-18	Legal Person Insufficient legal basis for data processing	🇪🇺 Czech Data Protection Auhtority (UOOU)	Art. 6 Art. 14	€11,830
2020-12-18	Legal Person Insufficient legal basis for data processing	🇪🇺 Czech Data Protection Auhtority (UOOU)	Art. 6 Art. 14	€11,430
2020-12-18	Legal Person Insufficient legal basis for data processing	🇪🇺 Czech Data Protection Auhtority (UOOU)	Art. 6 Art. 14	€11,430
2020-12-18	Legal Person Insufficient legal basis for data processing	🇪🇺 Czech Data Protection Auhtority (UOOU)	Art. 6 Art. 14	€10,070
2020-12-18	Legal Person Insufficient legal basis for data processing	🇪🇺 Czech Data Protection Auhtority (UOOU)	Art. 6 Art. 14	€9,420
2020-12-18	Legal Person Insufficient legal basis for data processing	🇪🇺 Czech Data Protection Auhtority (UOOU)	Art. 6 Art. 14	€8,800
2020-12-18	Legal Person Insufficient legal basis for data processing	🇪🇺 Czech Data Protection Auhtority (UOOU)	Art. 6 Art. 14	€8,800
2020-12-18	Legal Person Insufficient legal basis for data processing	🇪🇺 Czech Data Protection Auhtority (UOOU)	Art. 6 Art. 14	€8,340
2020-12-18	Legal Person Insufficient legal basis for data processing	🇪🇺 Czech Data Protection Auhtority (UOOU)	Art. 6 Art. 14	€8,100
2020-12-18	Legal Person Insufficient fulfilment of data subjects rights	🇪🇺 Czech Data Protection Auhtority (UOOU)	Art. 17	€200
2020-12-17	Roma Capitale (Rome Municipality) Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 13 Art. 14 Art. 28	€500,000
2020-12-17	ID Finance Poland Sp. z o.o. Insufficient technical and organisational measures to ensure information security	🇪🇺 Polish National Personal Data Protection Office (UODO)	Art. 5 Art. 25 Art. 32	€235,300
2020-12-17	Azienda Unità Sanitaria Locale Toscana Sud Est Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 13 Art. 14 Art. 28	€100,000
2020-12-17	Banca Transilvania SA Insufficient technical and organisational measures to ensure information security	🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 5 Art. 32	€100,000
2020-12-17	University College Dublin Insufficient technical and organisational measures to ensure information security	🇪🇺 Data Protection Authority of Ireland	Art. 5 Art. 32 Art. 33	€70,000
2020-12-17	Miropass S.r.l. Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9 Art. 28	€40,000
2020-12-17	Comune di Luino Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 37	€10,000
2020-12-17	Doctor Insufficient technical and organisational measures to ensure information security	🇪🇺 French Data Protection Authority (CNIL)	Art. 32 Art. 33	€6,000
2020-12-17	Comune di Santo Stefano Belbo Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6	€4,000
2020-12-17	Doctor Insufficient technical and organisational measures to ensure information security	🇪🇺 French Data Protection Authority (CNIL)	Art. 32 Art. 33	€3,000
2020-12-17	Ordine degli Assistenti Sociali della Regione Lazio Insufficient fulfilment of data subjects rights	🇪🇺 Italian Data Protection Authority (Garante)	Art. 12	€2,000
2020-12-16	HUNGARY DPA: Insufficient legal basis for data processing Insufficient legal basis for data processing	🇪🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)	Art. 5 Art. 6 Art. 9 Art. 12	€97,150
2020-12-16	Robinson Tours Ltd. (Robinson Tours Idegenforgalmi és Szolgáltató Kft.) Insufficient technical and organisational measures to ensure information security	🇪🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)	Art. 25 Art. 32 Art. 34	€55,400

← previous 2901–2925 of 3,488 next →