▲ Enforcement Tracker
3,488 GDPR enforcement decisions from 52 countries, updated daily.
Total fines · last 12 months
€1.3B
+875% vs previous year
Decisions · last 12 months
531
44 per month avg
Monthly fine totals · last 12 months
AugSepOctNovDecJanFebMarAprMayJunJul
| Date ↓ | Company / party | Authority | Articles | Fine |
|---|---|---|---|---|
| 2020-12-16 | HUNGARY DPA: Insufficient fulfilment of information obligations Insufficient fulfilment of information obligations | 🇪🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH) | Art. 5Art. 13 | €1,940 |
| 2020-12-16 | Next Time Media Agency Ltd. (Next Time Media Ügynökség Kft.) Insufficient technical and organisational measures to ensure information security | 🇪🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH) | Art. 32 | €1,385 |
| 2020-12-15 | Twitter International Company Insufficient fulfilment of data breach notification obligations | 🇪🇺 Data Protection Authority of Ireland | Art. 33 | €450,000 |
| 2020-12-15 | Uppsalahem AB Insufficient legal basis for data processing | 🇪🇺 Data Protection Authority of Sweden (Integritetsskyddsmyndigheten) | Art. 5Art. 6 | €29,500 |
| 2020-12-15 | HH Invest SIA Insufficient fulfilment of information obligations | 🇪🇺 Data State Inspectorate (DSI) | Art. 13 | €15,000 |
| 2020-12-15 | Online Services Insufficient fulfilment of information obligations | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 13Art. 8Art. 6 | €10,000 |
| 2020-12-15 | LATVIA DPA: Insufficient legal basis for data processing Insufficient legal basis for data processing | 🇪🇺 Data State Inspectorate (DSI) | Art. 5Art. 6 | €6,250 |
| 2020-12-14 | Virgin Mobile Polska Insufficient technical and organisational measures to ensure information security | 🇪🇺 Polish National Personal Data Protection Office (UODO) | Art. 5Art. 25Art. 32 | €443,000 |
| 2020-12-11 | Banco Bilbao Vizcaya Argentaria, S.A. Insufficient fulfilment of information obligations | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 6Art. 13 | €5,000,000 |
| 2020-12-11 | Umeå University Insufficient technical and organisational measures to ensure information security | 🇪🇺 Data Protection Authority of Sweden (Integritetsskyddsmyndigheten) | Art. 5Art. 32 | €54,000 |
| 2020-12-11 | Cosmetic Medical Limited Insufficient cooperation with supervisory authority | 🇪🇺 Information Commissioner of Isle of Man | Art. 31 | €3,250 |
| 2020-12-10 | Booking.com B.V. Insufficient fulfilment of data breach notification obligations | 🇪🇺 Dutch Supervisory Authority for Data Protection (AP) | Art. 33 | €475,000 |
| 2020-12-10 | Budapesti Műszaki és Gazdaságtudományi Egyetem (Budapest University of Technology and Economics) Insufficient legal basis for data processing | 🇪🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH) | Art. 5Art. 6Art. 9Art. 12 | €22,200 |
| 2020-12-10 | Borjamotor, S.A. Insufficient legal basis for data processing | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 7 | €4,000 |
| 2020-12-09 | Xfera Moviles S.A. Insufficient legal basis for data processing | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 6 | €40,000 |
| 2020-12-09 | TUiR Warta S.A. Insufficient fulfilment of data breach notification obligations | 🇪🇺 Polish National Personal Data Protection Office (UODO) | Art. 33Art. 34 | €18,850 |
| 2020-12-09 | SPAIN DPA: Non-compliance with general data processing principles Non-compliance with general data processing principles | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 5 | €10,000 |
| 2020-12-09 | Smart Cities Sp. z o.o. Insufficient cooperation with supervisory authority | 🇪🇺 Polish National Personal Data Protection Office (UODO) | Art. 31Art. 58 | €2,850 |
| 2020-12-07 | Perfomeclic Insufficient legal basis for data processing | 🇪🇺 French Data Protection Authority (CNIL) | Art. 5Art. 14Art. 21Art. 28 | €7,300 |
| 2020-12-03 | Capio St. Göran AB Insufficient technical and organisational measures to ensure information security | 🇪🇺 Data Protection Authority of Sweden (Integritetsskyddsmyndigheten) | Art. 5Art. 32 | €2,900,000 |
| 2020-12-03 | Aleris Sjukvård AB Insufficient technical and organisational measures to ensure information security | 🇪🇺 Data Protection Authority of Sweden (Integritetsskyddsmyndigheten) | Art. 5Art. 32 | €1,463,000 |
| 2020-12-03 | Aleris Sjukvård AB Insufficient technical and organisational measures to ensure information security | 🇪🇺 Data Protection Authority of Sweden (Integritetsskyddsmyndigheten) | Art. 5Art. 32 | €1,168,000 |
| 2020-12-03 | Karolinska University Hospital of Solna Insufficient technical and organisational measures to ensure information security | 🇪🇺 Data Protection Authority of Sweden (Integritetsskyddsmyndigheten) | Art. 5Art. 32 | €390,100 |
| 2020-12-03 | Sahlgrenska University Hospital Insufficient technical and organisational measures to ensure information security | 🇪🇺 Data Protection Authority of Sweden (Integritetsskyddsmyndigheten) | Art. 5Art. 32 | €341,300 |
| 2020-12-03 | Östergötland Region Insufficient technical and organisational measures to ensure information security | 🇪🇺 Data Protection Authority of Sweden (Integritetsskyddsmyndigheten) | Art. 5Art. 32 | €243,800 |