▲ Enforcement Tracker
3,488 GDPR enforcement decisions from 52 countries, updated daily.
Total fines · last 12 months
€1.3B
+872% vs previous year
Decisions · last 12 months
525
44 per month avg
Monthly fine totals · last 12 months
AugSepOctNovDecJanFebMarAprMayJunJul
| Date ↓ | Company / party | Authority | Articles | Fine |
|---|---|---|---|---|
| 2019-04-12 | Company in the financial sector Insufficient technical and organisational measures to ensure information security | 🇪🇺 Data Protection Authority of Baden-Wuerttemberg | Art. 5Art. 32 | €80,000 |
| 2019-04-08 | Medical centers Insufficient legal basis for data processing | 🇪🇺 Data Protection Commision of Bulgaria (KZLD) | Art. 5Art. 9Art. 6 | €510 |
| 2019-04-05 | Hungarian political party Insufficient fulfilment of data breach notification obligations | 🇪🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH) | Art. 33Art. 34 | €34,375 |
| 2019-04-05 | HUNGARY DPA: Insufficient fulfilment of data subjects rights Insufficient fulfilment of data subjects rights | 🇪🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH) | Art. 15 | €1,900 |
| 2019-03-26 | Private company working with data from publicly available sources Insufficient fulfilment of information obligations | 🇪🇺 Polish National Personal Data Protection Office (UODO) | Art. 14 | €220,000 |
| 2019-03-26 | A.P. EOOD Insufficient legal basis for data processing | 🇪🇺 Data Protection Commision of Bulgaria (KZLD) | Art. 5Art. 6 | €5,100 |
| 2019-03-25 | PORTUGAL DPA: Insufficient fulfilment of information obligations Insufficient fulfilment of information obligations | 🇪🇺 Portuguese Data Protection Authority (CNPD) | Art. 13 | €2,000 |
| 2019-03-21 | CZECH REPUBLIC DPA: Non-compliance with general data processing principles Non-compliance with general data processing principles | 🇪🇺 Czech Data Protection Auhtority (UOOU) | Art. 5 | €10,000 |
| 2019-03-19 | PORTUGAL DPA: Insufficient fulfilment of information obligations Insufficient fulfilment of information obligations | 🇪🇺 Portuguese Data Protection Authority (CNPD) | Art. 13 | €2,000 |
| 2019-03-04 | Unnamed financial institution Insufficient fulfilment of data subjects rights | 🇪🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH) | Art. 5Art. 13Art. 17Art. 6 | €3,200 |
| 2019-03-01 | Bergen Municipality Insufficient technical and organisational measures to ensure information security | 🇪🇺 Norwegian Supervisory Authority (Datatilsynet) | Art. 5Art. 32 | €170,000 |
| 2019-03-01 | N26 Insufficient legal basis for data processing | 🇪🇺 Data Protection Authority of Berlin | Art. 6 | €50,000 |
| 2019-02-28 | Mayor's Office of the city of Kecdkemét Insufficient legal basis for data processing | 🇪🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH) | Art. 5Art. 6 | €3,200 |
| 2019-02-28 | CZECH REPUBLIC DPA: Insufficient technical and organisational measures to ensure information security Insufficient technical and organisational measures to ensure information security | 🇪🇺 Czech Data Protection Auhtority (UOOU) | Art. 32 | €582 |
| 2019-02-26 | Telecommunication service provider Insufficient legal basis for data processing | 🇪🇺 Bulgarian Commission for Personal Data Protection (KZLD) | Art. 6Art. 5 | €27,100 |
| 2019-02-26 | CZECH REPUBLIC DPA: Insufficient fulfilment of data subjects rights Insufficient fulfilment of data subjects rights | 🇪🇺 Czech Data Protection Auhtority (UOOU) | Art. 15 | €776 |
| 2019-02-22 | Employer Insufficient fulfilment of data subjects rights | 🇪🇺 Bulgarian Commission for Personal Data Protection (KZLD) | Art. 15 | €500 |
| 2019-02-20 | Debt collector Non-compliance with general data processing principles | 🇪🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH) | Art. 5 | €1,560 |
| 2019-02-18 | Lands Authority Insufficient technical and organisational measures to ensure information security | 🇪🇺 Data Protection Commissioner of Malta | Art. 5Art. 32 | €5,000 |
| 2019-02-08 | Bank Non-compliance with general data processing principles | 🇪🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH) | Art. 5 | €1,560 |
| 2019-02-05 | PORTUGAL DPA: Insufficient fulfilment of data subjects rights Insufficient fulfilment of data subjects rights | 🇪🇺 Portuguese Data Protection Authority (CNPD) | Art. 15 | €20,000 |
| 2019-02-05 | Private person Insufficient legal basis for data processing | 🇪🇺 Data Protection Authority of Sachsen-Anhalt | Art. 6Art. 5 | €2,500 |
| 2019-02-04 | Car renting company Insufficient fulfilment of information obligations | 🇪🇺 Czech Data Protection Auhtority (UOOU) | Art. 5 | €1,165 |
| 2019-02-04 | Credit brokerage Insufficient technical and organisational measures to ensure information security | 🇪🇺 Czech Data Protection Auhtority (UOOU) | Art. 32 | €1,165 |
| 2019-01-21 | Google LLC Insufficient legal basis for data processing | 🇪🇺 French Data Protection Authority (CNIL) | Art. 13Art. 14Art. 6Art. 5 | €50,000,000 |