Content type · 3,808 documents in this view · 3,813 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filter by Topic Supervisory Authorities 3589 Processing 2636 Personal Data 2395 Controllers 2018 Processing Agreement 1114 Security 1013 Supervision 847 Healthcare 621 Law Enforcement 568 Monitoring 547 Public Authority 539 Consent 508
€15,000 Depac Società Cooperativa Sociale a r.l.: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Depac Società Cooperativa Sociale a r.l. €15,000 on 2026-02-26 for: Insufficient legal basis for data processing. Italy · ·Art. 5, 9, 13 +2 Feb 26, 2026
€30,000 S.M. Trattamento Acqua di XX: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined S.M. Trattamento Acqua di XX €30,000 on 2026-02-26 for: Insufficient legal basis for data processing. Italy · ·Art. 4, 5, 6 +6 Feb 26, 2026
€5,000 Conservatory: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Conservatory €5,000 on 2026-02-26 for: Insufficient legal basis for data processing. Italy · ·Art. 5, 6, 10 Feb 26, 2026
€15,000 Ministry of Enterprises and Made in Italy: Insufficient data processing agreement ⇄ Italian Data Protection Authority (Garante) fined Ministry of Enterprises and Made in Italy €15,000 on 2026-02-26 for: Insufficient data processing agreement. ·Art. 28 ·Insufficient data processing agreement Feb 26, 2026
€15,000 Flamel S.r.l.: Non-compliance with general data processing principles Italian Data Protection Authority (Garante) fined Flamel S.r.l. €15,000 on 2026-02-26 for: Non-compliance with general data processing principles. Italy · ·Art. 8, 11, 25 +3 Feb 26, 2026
€15,000 Ministero delle Imprese e del Made in Italy: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Ministero delle Imprese e del Made in Italy €15,000 on 2026-02-26 for: Insufficient legal basis for data processing. ·Art. 5, 6, 9 +1 ·Insufficient legal basis for data processing Feb 26, 2026
€1,000 Ciemme S.r.l.s.: Insufficient cooperation with supervisory authority Italian Data Protection Authority (Garante) fined Ciemme S.r.l.s. €1,000 on 2026-02-26 for: Insufficient cooperation with supervisory authority. Italy · ·Art. 58 Feb 26, 2026
€3,000 Groupharma s.r.l.s.: Insufficient fulfilment of data subjects rights Italian Data Protection Authority (Garante) fined Groupharma s.r.l.s. €3,000 on 2026-02-26 for: Insufficient fulfilment of data subjects rights. Italy · ·Art. 5, 12, 15 +1 Feb 26, 2026
€12,000 Ministero dell’Economia e delle Finanze: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Ministero dell’Economia e delle Finanze €12,000 on 2026-02-26 for: Insufficient legal basis for data processing. Italy · ·Art. 5, 6, 28 Feb 26, 2026
€17M Reddit, Inc.: Non-compliance with general data processing principles Information Commissioner (ICO) fined Reddit, Inc. €16,610,000 on 2026-02-23 for: Non-compliance with general data processing principles. United Kingdom · ·Art. 5, 6, 8 +1 Feb 23, 2026
€2,000 SC Hayat Dent SRL: Insufficient cooperation with supervisory authority Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) fined SC Hayat Dent SRL €2,000 on 2026-02-20 for: Insufficient cooperation with supervisory… Romania · ·Art. 83 Feb 20, 2026
€5,000 KEAT - Centre for Education & Rehabilitation of the Blind: Insufficient fulfilment of data subjects rights Hellenic Data Protection Authority (HDPA) fined KEAT - Centre for Education & Rehabilitation of the Blind €5,000 on 2026-02-20 for: Insufficient fulfilment of data subjects rights. Greece · ·Art. 12, 15 Feb 20, 2026
€5,570 University of Szeged: Insufficient legal basis for data processing Hungarian National Authority for Data Protection and the Freedom of Information (NAIH) fined University of Szeged €5,570 on 2026-02-20 for: Insufficient legal basis for data… Hungary · ·Art. 5, 6, 9 +1 Feb 20, 2026
€3,000 Your Consulting SRL: Insufficient technical and organisational measures to ensure information security Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) fined Your Consulting SRL €3,000 on 2026-02-19 for: Insufficient technical and organisational… Romania · ·Art. 25, 32 Feb 19, 2026
€1.4M Restaurant Partner Polska: Insufficient legal basis for data processing Polish National Personal Data Protection Office (UODO) fined Restaurant Partner Polska €1,393,300 on 2026-02-19 for: Insufficient legal basis for data processing. Poland · ·Art. 5, 6 Feb 19, 2026
€5,500 Slovenia DPA: Insufficient technical and organisational measures to ensure information security Slovenian Supervisory Authority (Informacijski pooblaščenec) fined an unnamed party €5,500 on 2026-02-16 for: Insufficient technical and organisational measures to ensure… ·Art. 32 ·Insufficient technical and organisational measures to ensure information security Feb 16, 2026
€8,470 Election Committee of Karol Nawrocki: Insufficient legal basis for data processing Polish National Personal Data Protection Office (UODO) fined Election Committee of Karol Nawrocki €8,470 on 2026-02-13 for: Insufficient legal basis for data processing. Poland · ·Art. 5, 6 Feb 13, 2026
€1,500 Sole Trader: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Sole Trader €1,500 on 2026-02-12 for: Insufficient legal basis for data processing. Italy · ·Art. 5, 13, 25 Feb 12, 2026
€15,000 Bressanelli Galli Gelpi Porta & C. S.r.l.: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Bressanelli Galli Gelpi Porta & C. S.r.l. €15,000 on 2026-02-12 for: Insufficient legal basis for data processing. Italy · ·Art. 5, 6, 7 +3 Feb 12, 2026
€2,000 Sole Trader: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Sole Trader €2,000 on 2026-02-12 for: Insufficient legal basis for data processing. Italy · ·Art. 5, 6, 13 +1 Feb 12, 2026
€1,000 Sole Trader: Insufficient fulfilment of information obligations Italian Data Protection Authority (Garante) fined Sole Trader €1,000 on 2026-02-12 for: Insufficient fulfilment of information obligations. Italy · ·Art. 5, 13 Feb 12, 2026
€4,000 Comune di Mazara del Vallo: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Comune di Mazara del Vallo €4,000 on 2026-02-12 for: Insufficient legal basis for data processing. Italy · ·Art. 5, 6, 12 +2 Feb 12, 2026
€15,000 Lex Iuris S.r.l.: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Lex Iuris S.r.l. €15,000 on 2026-02-12 for: Insufficient legal basis for data processing. Italy · ·Art. 6, 15 Feb 12, 2026
€2,000 Comune di Monterotondo: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Comune di Monterotondo €2,000 on 2026-02-12 for: Insufficient legal basis for data processing. Italy · ·Art. 5, 13, 88 Feb 12, 2026
€4,000 Order of Physicians, Surgeons and Dentists of the Province of Macerata: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Order of Physicians, Surgeons and Dentists of the Province of Macerata €4,000 on 2026-02-12 for: Insufficient legal basis for… Italy · ·Art. 5, 6 Feb 12, 2026
€6,000 Comune di Coccaglio: Non-compliance with general data processing principles Italian Data Protection Authority (Garante) fined Comune di Coccaglio €6,000 on 2026-02-12 for: Non-compliance with general data processing principles. Italy · ·Art. 5, 6, 12 +3 Feb 12, 2026
€15,000 Depurazione Acqua S.r.l.: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Depurazione Acqua S.r.l. €15,000 on 2026-02-12 for: Insufficient legal basis for data processing. Italy · ·Art. 4, 5, 6 +3 Feb 12, 2026
€5,000 Unleadmited S.r.l.: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Unleadmited S.r.l. €5,000 on 2026-02-12 for: Insufficient legal basis for data processing. Italy · ·Art. 5, 6, 7 +1 Feb 12, 2026
€2,000 Comune di Velletri: Non-compliance with general data processing principles Italian Data Protection Authority (Garante) fined Comune di Velletri €2,000 on 2026-02-12 for: Non-compliance with general data processing principles. Italy · ·Art. 5, 6, 12 +2 Feb 12, 2026
€30,000 Sportitalia Società Sportiva Dilettantistica a.r.l.: Insufficient fulfilment of data subjects rights Italian Data Protection Authority (Garante) fined Sportitalia Società Sportiva Dilettantistica a.r.l. €30,000 on 2026-02-12 for: Insufficient fulfilment of data subjects rights. Italy · ·Art. 12, 17 Feb 12, 2026
€12,000 Based s.r.l.: Insufficient fulfilment of data subjects rights Italian Data Protection Authority (Garante) fined Based s.r.l. €12,000 on 2026-02-12 for: Insufficient fulfilment of data subjects rights. Italy · ·Art. 5, 12, 13 +2 Feb 12, 2026
€30,000 Vodafone – PANAFON A.E.E.T.: Insufficient fulfilment of data subjects rights Hellenic Data Protection Authority (HDPA) fined Vodafone – PANAFON A.E.E.T. €30,000 on 2026-02-11 for: Insufficient fulfilment of data subjects rights. Greece · ·Art. 12, 15, 18 Feb 11, 2026
€150,000 The Spanish Data Protection Agency (AEPD) investigated Vodafone España, S.A.U as controller after a SIM swapping incident. On 21 September 2021, an unknown third party requested a duplicate SIM card for the mobile line of a data subject. The request was… EXP202306354 (PS/00312/2024) ·Spain ·Art. 5, 6 Feb 11, 2026
€5,220 Fundację Lumus: Non-compliance with general data processing principles Polish National Personal Data Protection Office (UODO) fined Fundację Lumus €5,220 on 2026-02-10 for: Non-compliance with general data processing principles. Poland · ·Art. 33, 34, 37 +1 Feb 10, 2026
€1,800 Landlord: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 1,800 on a Landlord. The landlord used video surveillance in rental apartments without having a sufficient legal basis. The original fine… SPAIN · ·Art. 6 Feb 6, 2026
€284,450 MediaLab.AI, Inc.: Insufficient legal basis for data processing The UK DPA has imposed a fine of GBP 247,590 (EUR 284,450) on MediaLab.AI, Inc.The controller of the image-sharing and hosting platform Imgur failed to implement age verification.… UNITED KINGDOM · ·Insufficient legal basis for data processing Feb 5, 2026
€4,200 Obuda University: Insufficient legal basis for data processing Hungarian National Authority for Data Protection and the Freedom of Information (NAIH) fined Obuda University €4,200 on 2026-02-05 for: Insufficient legal basis for data… Hungary · ·Art. 5, 6, 9 Feb 5, 2026
€2.7M DPD Polska sp. z o.o.: Insufficient data processing agreement ⇄ Polish National Personal Data Protection Office (UODO) fined DPD Polska sp. z o.o. €2,682,000 on 2026-02-05 for: Insufficient data processing agreement. Poland · ·Art. 5, 24, 29 +1 Feb 5, 2026
€20,000 Tensa Art Design S.A: Insufficient cooperation with supervisory authority The Romanian DPA has imposed a fine of EUR 20,000 onTensa Art Design S.A.The DPA began investigating the controller's data processing activities, but the controller failed to… ROMANIA · ·Art. 58, 83 Feb 5, 2026
€10,000 GENPACT ROMANIA SRL: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 10,000 on GENPACT ROMANIA SRL. The controller suffered a successful cyber attack due to insufficient technical and organisational… ·Art. 32 ·Insufficient technical and organisational measures to ensure information security Feb 4, 2026
€25,000 Municipality of Eindhoven: Insufficient legal basis for data processing The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Eindhoven. The controller, one of ten municipalities that were fined, processed data regarding the Islamic… THE NETHERLANDS · ·Art. 6, 9 Feb 3, 2026
€1,000 Alliance for the Union of Romanians (AUR) Party: Insufficient fulfilment of data subjects rights The Romanian DPA has imposed a fine of EUR 1,000 on the Alliance for the Union of Romanians (AUR) Party. The controller failed to react adequately to a data subject's request to… ROMANIA · ·Art. 12, 15, 17 +1 Feb 3, 2026
€25,000 Municipality of Delft: Insufficient legal basis for data processing The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Delft. The controller, one of ten municipalities that were fined, processed data regarding the Islamic… THE NETHERLANDS · ·Art. 6, 9 Feb 3, 2026
€25,000 Municipality of Huizen: Insufficient legal basis for data processing The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Huizen. The controller, one of ten municipalities that were fined, processed data regarding the Islamic… THE NETHERLANDS · ·Art. 6, 9 Feb 3, 2026
€25,000 Municipality of Hilversum: Insufficient legal basis for data processing The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Hilversum. The controller, one of ten municipalities that were fined, processed data regarding the Islamic… THE NETHERLANDS · ·Art. 6, 9 Feb 3, 2026
€25,000 Municipality of Haarlemmermeer: Insufficient legal basis for data processing The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Haarlemmermeer. The controller, one of ten municipalities that were fined, processed data regarding the… THE NETHERLANDS · ·Art. 6, 9 Feb 3, 2026
€25,000 Municipality of Zoetermeer: Insufficient legal basis for data processing The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Zoetermeer. The controller, one of ten municipalities that were fined, processed data regarding the Islamic… THE NETHERLANDS · ·Art. 6, 9 Feb 3, 2026
€25,000 Municipality of Tilburg: Insufficient legal basis for data processing The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Tilburg. The controller, one of ten municipalities that were fined, processed data regarding the Islamic… THE NETHERLANDS · ·Art. 6, 9 Feb 3, 2026
€25,000 Municipality of Veenendaal: Insufficient legal basis for data processing The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Veenendaal. The controller, one of ten municipalities that were fined, processed data regarding the Islamic… THE NETHERLANDS · ·Art. 6, 9 Feb 3, 2026
€25,000 Municipality of Ede: Insufficient legal basis for data processing The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Ede. The controller, one of ten municipalities that were fined, processed data regarding the Islamic… THE NETHERLANDS · ·Art. 6, 9 Feb 3, 2026