# Xandr Inc.: Insufficient legal basis for data processing

- Type: Enforcement
- Source: Norwegian Supervisory Authority (Datatilsynet)
- Date: 2026-10-02
- Original: https://www.enforcementtracker.com/ETid-3355
- Canonical: https://overview.legal/posts/603870
- Topics: Supervision, Supervisory Authorities

## Summary

The Norwegian Supervisory Authority (Datatilsynet) fined Xandr Inc. €8,500,000 for processing personal data without a sufficient legal basis under GDPR Article 6(1), with the case also involving the processing of special category data under Article 9(1). The enforcement action targeted Xandr's data practices in the industry and commerce sector, finding that the company failed to establish a valid lawful basis for its processing activities. The fine was imposed on October 2, 2026, following the authority's assessment that Xandr's data processing operations violated core GDPR principles regarding legal basis requirements.

## Full text

Norwegian Supervisory Authority (Datatilsynet) fined Xandr Inc. €8,500,000 on 2026-10-02 for: Insufficient legal basis for data processing.
GDPR Articles: Art. 6 (1) GDPR, Art. 9 (1) GDPR
Sector: Industry and Commerce
Country: Norway
Source: https://www.datatilsynet.no/contentassets/213ea490834f4fc2a796aa495cb72fb8/administrative-fine---unlawful-processing-of-personal-data_redacted-public-version.pdf

---
Generated by overview.legal · https://overview.legal/posts/603870 · 2026-10-24