▲ Enforcement Tracker

3,609 GDPR enforcement decisions from 59 countries, updated daily.

Total fines · last 12 months

€1.4B

+896% vs previous year

Decisions · last 12 months

534

45 per month avg

Largest · last 90 days

€5.8M

Garante per la protezione dei dati personali (Italy) · Italy

Most active authority

Spanish Data Protection Authority (aepd)

84 decisions · SPAIN

Monthly fine totals · last 12 months

SepOctNovDecJanFebMarAprMayJunJulAug

Date ↓	Company / party	Authority	Articles	Fine
2026-07-14	Italian DPA sanctions Lusha Systems for processing contact data without consent in B2B	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 32 Art. 3 Art. 32 Art. 51	€2,000,000
2026-07-13	AEPD: Digi Telecom violated Art 6(1) GDPR by issuing duplicate SIM to impersonator	🇪🇸 AEPD (Spain)	Art. 52 Art. 5 Art. 61 Art. 6	€140
2026-07-09	ANSPDCP (Romania) - Fine against Ascendex Technology SRL	🇷🇴 ANSPDCP (Romania)	Art. 423 Art. 4 Art. 121 Art. 12	€57,839
2026-07-08	Slovenian DPA fines controller €1,198 for Art. 32 GDPR breach via pirated software	🇸🇮 IP (Slovenia)	Art. 32	€1,198
2026-07-03	Italian Garante sanctions Hera Comm for automated credit-check refusals of contracts	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 13 Art. 14	€5,800,000
2026-07-03	Italian Garante sanctions EstEnergy for automated creditworthiness scoring in energy	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 51 Art. 51	€1,400,000
2026-07-03	Italian DPA finds GDPR applies to US-based Character.AI service	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 32 Art. 3 Art. 52 Art. 5	€158,000
2026-07-03	ANSPDCP fines Banca Transilvania RON 26,172 for inadequate security over unauthorized	🇷🇴 ANSPDCP (Romania)	Art. 321 Art. 32 Art. 322 Art. 324	€26,172
2026-07-03	IMY reprimands Swedish Police for inadequate GDPR Article 13 info at Arlanda border	🇸🇪 IMY (Sweden)	Art. 13	—
2026-07-01	Persónuvernd examines BL ehf over alleged unlawful employee monitoring via shared OneDrive	🇮🇸 Persónuvernd (Island)	Art. 51 Art. 5 Art. 52 Art. 321	—
2026-06-19	VDAI (Lithuania) - 3R-1143	🇱🇹 VDAI (Lithuania)	Art. 51 Art. 5 Art. 241 Art. 24	€450,000
2026-06-18	Garante: Piaggio violated GDPR by accessing former employees' emails in disciplinary probe	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 123 Art. 12 Art. 17 Art. 6	€460,000
2026-06-18	Italian Garante: Employer's recording of locker opening and destruction of contents	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 21 Art. 2 Art. 41 Art. 4	€6,600
2026-06-18	Italian DPA: Vasto municipality breached transparency duties over traffic cameras	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 51 Art. 61	€5,000
2026-06-16	SILVANERGIA 2022, S.L. Insufficient legal basis for data processing	🇪🇸 Spanish Data Protection Authority (aepd)	Art. 6	€3,000
2026-06-15	SSG SELECT SOLUTIONS S.R.L Insufficient technical and organisational measures to ensure information security	🇷🇴 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 29 Art. 32	€2,000
2026-06-13	UODO (Poland) - DKN.5131.34.2023	🇵🇱 UODO (Poland)	Art. 51 Art. 5 Art. 52 Art. 241	€2,760
2026-06-12	Market-In Non-compliance with general data processing principles	🇬🇷 Hellenic Data Protection Authority (HDPA)	Art. 5 Art. 12 Art. 13 Art. 15	€95,000
2026-06-12	MEDE S.A. Non-compliance with general data processing principles	🇬🇷 Hellenic Data Protection Authority (HDPA)	Art. 5 Art. 12 Art. 13 Art. 15	€65,000
2026-06-12	Națională Poșta Română Insufficient technical and organisational measures to ensure information security	🇷🇴 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 32	€5,000
2026-06-11	Midlands Regional Hospital Tullamore, County Offaly Insufficient technical and organisational measures to ensure information security	🇮🇪 Data Protection Authority of Ireland	Art. 5 Art. 28 Art. 30 Art. 32	€300,000
2026-06-11	UODO (Poland) - DKN.5131.12.2022	🇵🇱 UODO (Poland)	Art. 51 Art. 5 Art. 52 Art. 241	—
2026-06-05	Reda Naujokaitienė Insufficient legal basis for data processing	🇱🇹 Lithuanian Data Protection Authority (VDAI)	Art. 5 Art. 6 Art. 9	€1,153
2026-06-02	HDPA fines DEI for unlawful telemarketing calls to opt-out registered subscribers	🇬🇷 HDPA (Greece)	Art. 51 Art. 5 Art. 51 Art. 51	€880,000
2026-06-02	Minister of Justice Insufficient technical and organisational measures to ensure information security	🇵🇱 Polish National Personal Data Protection Office (UODO)	Art. 32	€23,540

← previous 26–50 of 3,609 next →