▲ Enforcement Tracker
3,788 GDPR enforcement decisions from 64 countries, updated daily.
Total fines · last 12 months
€202.5B
+18231% vs previous year
Decisions · last 12 months
612
51 per month avg
Monthly fine totals · last 12 months
NovDecJanFebMarAprMayJunJulAugSepOct
| Date ↓ | Company / party | Authority | Articles | Fine |
|---|---|---|---|---|
| 2026-01-13 | PREMIER RESTAURANTS ROMANIA SRL Insufficient technical and organisational measures to ensure information security | 🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) | Art. 28Art. 32 | €8,000 |
| 2026-01-13 | PREMIER RESTAURANTS ROMANIA SRL Insufficient technical and organisational measures to ensure information security | 🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) | Art. 28Art. 32 | €8,000 |
| 2026-01-13 | CNIL: eerlijkheid procedure geschikt, delen interne rapporten klager schendt art. 6 EVRM | 🇪🇺 Commission nationale de l’informatique et des libertés | — | |
| 2026-01-12 | CNIL fines data processor €1.7M for misconfigured disability-records software causing | 🇫🇷 Commission nationale de l’informatique et des libertés | €1,700,000 | |
| 2026-01-12 | Medical Student Insufficient legal basis for data processing | 🇦🇹 Austrian Data Protection Authority (dsb) | Art. 6Art. 9 | €200 |
| 2026-01-12 | DSB (Austria) - 2026-0.016.479 | 🇦🇹 DSB (Austria) | Art. 415Art. 4Art. 51Art. 5 | €200 |
| 2026-01-12 | DSB: Art. 15 GDPR access right does not extend to full documents with third-party data | 🇦🇹 Datenschutzbehörde | Art. 15 | — |
| 2026-01-10 | KVIKU SPAIN, S.L. Non-compliance with general data processing principles | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 5 | €8,000 |
| 2026-01-10 | VOX ESPAÑA Insufficient legal basis for data processing | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 6 | €500 |
| 2026-01-09 | Komendanta Miejskiego Policji w Krakowie Non-compliance with general data processing principles | 🇪🇺 Polish National Personal Data Protection Office (UODO) | €18,500 | |
| 2026-01-09 | Komendanta Miejskiego Policji w Krakowie Non-compliance with general data processing principles | 🇪🇺 Polish National Personal Data Protection Office (UODO) | €18,500 | |
| 2026-01-09 | DSB (Austria) - DSB-D124.2437/25 | 🇦🇹 DSB (Austria) | Art. 2Art. 41Art. 4Art. 42 | — |
| 2026-01-08 | FREE MOBILE Insufficient technical and organisational measures to ensure information security | 🇪🇺 French Data Protection Authority (CNIL) | Art. 5Art. 32 | €27,000,000 |
| 2026-01-08 | FREE MOBILE Insufficient technical and organisational measures to ensure information security | 🇪🇺 French Data Protection Authority (CNIL) | Art. 5Art. 32 | €27,000,000 |
| 2026-01-08 | FREE Insufficient technical and organisational measures to ensure information security | 🇪🇺 French Data Protection Authority (CNIL) | Art. 32Art. 34 | €15,000,000 |
| 2026-01-08 | FREE Insufficient technical and organisational measures to ensure information security | 🇪🇺 French Data Protection Authority (CNIL) | Art. 32Art. 34 | €15,000,000 |
| 2026-01-08 | Headquarter of a Fire Brigade Insufficient legal basis for data processing | 🇪🇺 Hellenic Data Protection Authority (HDPA) | Art. 5 | €10,000 |
| 2026-01-08 | Money Seeds S.R.L. Insufficient fulfilment of data subjects rights | 🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) | Art. 12Art. 13Art. 14 | €2,000 |
| 2026-01-08 | Money Seeds S.R.L. Insufficient fulfilment of data subjects rights | 🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) | Art. 12Art. 13Art. 14 | €2,000 |
| 2026-01-07 | AEPD fines two telecom providers €400,000 and €300,000 for SIM card fraud | 🇪🇸 Agencia Española de Protección de Datos | Art. 6 | €400,000 |
| 2026-01-07 | Austrian media company fined €6,820 for failing to comply with order to fix cookie banner | 🇦🇹 Datenschutzbehörde | Art. 58 | €6,820 |
| 2026-01-07 | AEPD: boetes van €400.000 en €300.000 voor telecomproviders bij SIM-kaartfraude | 🇪🇺 Agencia Española de Protección de Datos | — | |
| 2026-01-07 | VDAI (Lithuania) - Decision No. 3R-1700. | 🇱🇹 Valstybinė duomenų apsaugos inspekcija | — | |
| 2026-01-07 | VDAI (Litouwen) - Besluit nr. 3R-1700. | 🇪🇺 Valstybinė duomenų apsaugos inspekcija | — | |
| 2026-01-07 | DSB: klacht tegen Oostenrijks mediabedrijf afgewezen, wel aanwijzing cookie-banner | 🇪🇺 Datenschutzbehörde | — |