Content type · 724 documents

Enforcement

Regulatory actions, fines, warnings, and enforcement decisions

🇪🇺 EU 🇳🇱 NL
Enforcement dashboard — fines by country, authority and article →
Filtering by Topic Clear filter Supervisory Authorities3518 Processing Agreement2798 Processing2594 Personal Data2548 Controllers2165 Data Controller1854 Law Enforcement1541 IP Address1278 Security1007 Supervision854 Monitoring523 Consent498
Italy · €20,000 Garante per la protezione dei dati personali (Italy) - 471/2026 Facts — The provincial Health Authority of Enna (the controller) published a resolution that contained the personal data of a data subject (specifically related to their judicial… Personal Data Fairness & Transparency Right to be Forgotten Jul 18, 2026
Italy · €16,000 Garante per la protezione dei dati personali (Italy) - 10192784 Facts — The data subject, a professional registered with the OPI of Pisa, discovered while consulting the Public Register of Professionals online that the database included the… Personal Data Processing Controllers Jul 16, 2026
Spain · €200,000 AEPD (Spain) - PS-00020-2025 Facts — Alkora, S.A., the controller, is an insurance broker that was victim of a ransomware attack. The controller notified the DPA of a personal data breach after a ransomware… DPIA Privacy Impact Assessment Security Jul 16, 2026
Spain AEPD (Spain) - EXP202102529 Facts — A student handed in a complaint against the University of Navarra because they asked the students to fill in their vaccination status. The complainant understands this as… Consent Health Data Healthcare Jul 16, 2026
Spain · €140 AEPD (Spain) - EXP202310345 Facts — On December 28, 2022, DIGI Telecom, the controller, delivered a duplicate SIM card to an unauthorized third party without the consent of the original line holder (the data… Telecommunications Controllers Personal Data Jul 13, 2026
Romania · €57,839 ANSPDCP (Romania) - Fine against Ascendex Technology SRL Facts — The Romanian DPA (ANSPDCP) launched an investigation into the cryptocurrency exchange platform Ascendex Technology SRL (the controller). The DPA was notified by the French… Supervisory Authorities Controllers Personal Data Jul 9, 2026
Romania · €26,172 ANSPDCP (Romania) - 02/07/2026 Facts — The Romanian DPA (ANSPDCP) launched an investigation into a bank, Banca Transilvania S.A. (the controller), following a data subject’s complaint. The data subject claimed… Data Breaches Integrity and Confidentiality Principle Security Jul 3, 2026
Sweden IMY (Sweden) - IMY-2024-2904 Facts — The supervisory authority launched an investigation into the border control unit of the national police authority (the controller) at Arlanda Airport concerning the… Personal Data Controllers Information Provision Modalities and Communication Methods Jul 3, 2026
Italy · €158,000 Garante per la protezione dei dati personali (Italy) - 487/2026 Facts — Character Technologies, Inc (the controller) is a company established in the US that operates the site Character.AI. Character.AI is a generative AI service that allows… Personal Data Artificial Intelligence DPIA Jul 3, 2026
Lithuania · €450,000 VDAI (Lithuania) - 3R-1143 Facts — Two medical companies (the controllers) had fallen victim to data breaches where a third party had gained access to their internal systems containing both health data and… Security Data Breaches Access Controls Jun 19, 2026
ANSPDCP · €2,000 SSG SELECT SOLUTIONS S.R.L: Insufficient technical and organisational measures to ensure information security The Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) fined SSG Select Solutions S.R.L. €2,000 for failing to implement adequate technical and… Security Supervisory Authorities Personal Data Jun 15, 2026
Poland · €2,760 UODO (Poland) - DKN.5131.34.2023 Facts — An unauthorised entity gained access to an email account belonging to an employee at an accounting, bookkeeping and tax consulting company (the controller). The account… Data Breaches Right of Access Notification Obligation Jun 13, 2026
ANSPDCP · €5,000 Națională Poșta Română: Insufficient technical and organisational measures to ensure information security Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) fined Națională Poșta Română €5,000 on 2026-06-12 for: Insufficient technical and organisational… Security Personal Data Supervision Jun 12, 2026
€300,000 Midlands Regional Hospital Tullamore, County Offaly: Insufficient technical and organisational measures to ensure information security The Data Protection Authority of Ireland fined Midlands Regional Hospital Tullamore €300,000 for failing to implement sufficient technical and organizational measures to ensure… Notification Obligation Data Breaches Security Jun 11, 2026
Datatilsynet · €1,820,000 Elkjøp AS: Insufficient legal basis for data processing Norwegian Supervisory Authority (Datatilsynet) fined Elkjøp AS €1,820,000 on 2026-06-01 for: Insufficient legal basis for data processing. Processing Supervisory Authorities Supervision Jun 1, 2026
ANSPDCP · €12,000 Unicredit Bank SA: Insufficient technical and organisational measures to ensure information security Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) fined Unicredit Bank SA €12,000 on 2026-05-29 for: Insufficient technical and organisational… Security Personal Data Supervisory Authorities May 29, 2026
Italy · €6,000 Garante per la protezione dei dati personali (Italy) - 382/2026 Facts — A data subject filed a complaint before the DPA against the Liguria Health Protection Agency (the controller). The data subject was employed by the Ligurian Social and… DPIA Privacy by Design Privacy by Default May 28, 2026
Italy · €55,000 Garante per la protezione dei dati personali (Italy) - 419/2026 Facts — The data controller for the case is a government body called the Agency for Digital Italy (AgID). AgID is tasked with driving the adoption of digital technologies in both… Controllers Personal Data Processing May 28, 2026
Italy · €700 Garante per la protezione dei dati personali (Italy) - 385/2026 Facts — A data subject brought a complaint to the DPA through a non-profit organisation (LILA) against the Italian Red Cross (the controller). While the data subject was… Personal Data Healthcare Retention Period May 28, 2026
Poland · €26,711 UODO (Poland) - DKE.561.4.2026 Facts — The DPA initiated an ex officio investigation against an individual (the controller) after several data subjects complained about the controller’s video surveillance… Monitoring Accountability Video Surveillance May 22, 2026
UK · €300 ICO (UK) - KRA Consultancy Ltd Facts — The Information Commissioner, the DPA, investigated KRA Consultancy Ltd, the controller, in relation to unsolicited direct marketing SMS messages promoting debt-related… Direct Marketing Telecommunications Marketing May 20, 2026
Poland · €33,700 UODO (Poland) - DKN.5131.27.2023 Facts — A municipal social welfare unit (the controller) processed the personal data of the residents of the municipality (the data subjects), including names, addresses, and… Personal Data Controllers Supervisory Authorities May 19, 2026
€277,500 Permanent TSB: Insufficient technical and organisational measures to ensure information security Data Protection Authority of Ireland fined Permanent TSB €277,500 on 2026-05-08 for: Insufficient technical and organisational measures to ensure information security. Data Breaches Risk Management System Accountability May 8, 2026
ANSPDCP · €2,500 BLUE PROJECTS INDUSTRIES S.R.L.: Insufficient technical and organisational measures to ensure information security Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) fined BLUE PROJECTS INDUSTRIES S.R.L. €2,500 on 2026-04-30 for: Insufficient technical and… Security Personal Data Supervisory Authorities Apr 30, 2026
UODO · €1,790 Mayor of the City and Municipality of Myślenice: Insufficient fulfilment of data breach notification obligations The Polish DPA (UODO) fined the Mayor of the City and Municipality of Myślenice €1,790 for insufficient fulfilment of personal data breach notification obligations under Article… Notification Obligation Data Breaches Public Authority Apr 30, 2026
APD · €1,000 Non-Profit Foundation: Insufficient cooperation with supervisory authority Belgian Data Protection Authority (APD) fined Non-Profit Foundation €1,000 on 2026-04-28 for: Insufficient cooperation with supervisory authority. Supervisory Authorities Supervision Apr 28, 2026
aepd · €6,000 GATIGOS, S.L.: Insufficient cooperation with supervisory authority Spanish Data Protection Authority (aepd) fined GATIGOS, S.L. €6,000 on 2026-04-28 for: Insufficient cooperation with supervisory authority. Supervisory Authorities Supervision Apr 28, 2026
aepd · €1,800 RESIDENCIAL ETXE-LAN, S.L.: Insufficient cooperation with supervisory authority Spanish Data Protection Authority (aepd) fined RESIDENCIAL ETXE-LAN, S.L. €1,800 on 2026-04-28 for: Insufficient cooperation with supervisory authority. Supervisory Authorities Supervision Apr 28, 2026
ANSPDCP · €35,000 Crowd Entertainment Ltd: Insufficient legal basis for data processing Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) fined Crowd Entertainment Ltd €35,000 on 2026-04-28 for: Insufficient legal basis for data… Personal Data Processing Telecommunications Apr 28, 2026
Estonia · €1,000 AKI (Estonia) - No. 2.1-1/24/397-890-38 Facts — OÜ Dr Mõttus Hambaravi, the controller, is a Dental Clinic. On March 2024, the DPA received a complaint from a data subject regarding the fact that the controller had… Controllers Processors Data Controller Apr 16, 2026
aepd · €400,000 CAIXABANK, S.A.: Insufficient technical and organisational measures to ensure information security The Spanish Data Protection Authority (AEPD) fined Caixabank, S.A. €400,000 for failing to implement sufficient technical and organizational measures to ensure information… Privacy by Default Security Privacy by Design Apr 15, 2026
€6,600 Utility Company: Insufficient legal basis for data processing Slovenian Supervisory Authority (Informacijski pooblaščenec) fined Utility Company €6,600 on 2026-04-15 for: Insufficient legal basis for data processing. IP Address Processing Supervisory Authorities Apr 15, 2026
Poland · €2,415 UODO (Poland) - DKN.5131.7.2022 Facts — An electricity sales company (the controller) had outsourced some of its operations to two processors and one sub-processor. Employees of the sub-processor had used a… Processors Notification Obligation Data Breaches Apr 13, 2026
ANSPDCP · €2,500 BLUE PROJECTS S.R.L.: Insufficient technical and organisational measures to ensure information security Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) fined BLUE PROJECTS S.R.L. €2,500 on 2026-04-03 for: Insufficient technical and organisational… Security Personal Data Supervisory Authorities Apr 3, 2026
AP · €100,000,000 Ridetech International B.V.: Insufficient legal basis for data processing Dutch Supervisory Authority for Data Protection (AP) fined Ridetech International B.V. €100,000,000 on 2026-04-01 for: Insufficient legal basis for data processing. Processing Personal Data Supervisory Authorities Apr 1, 2026
€13,491 Legal Person: Insufficient technical and organisational measures to ensure information security Slovenian Supervisory Authority (Informacijski pooblaščenec) fined Legal Person €13,491 on 2026-03-27 for: Insufficient technical and organisational measures to ensure information… Security Supervision IP Address Mar 27, 2026
ANSPDCP · €125,000 RENAULT COMMERCIAL ROUMANIE S.R.L.: Insufficient technical and organisational measures to ensure information security Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) fined RENAULT COMMERCIAL ROUMANIE S.R.L. €125,000 on 2026-03-25 for: Insufficient technical and… Security Personal Data Supervisory Authorities Mar 25, 2026
ANSPDCP · €4,000 ING Bank NV Amsterdam – Sucursala București S.A.: Insufficient technical and organisational measures to ensure information security Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) fined ING Bank NV Amsterdam – Sucursala București S.A. €4,000 on 2026-03-23 for: Insufficient… Security Personal Data Supervisory Authorities Mar 23, 2026
ANSPDCP · €3,000 Domeniul Public și Privat SA: Insufficient legal basis for data processing Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) fined Domeniul Public și Privat SA €3,000 on 2026-03-20 for: Insufficient legal basis for data… Education Public Authority Personal Data Mar 20, 2026
aepd · €150,000 ALÍA GESTIÓN INTEGRAL DE SERVICIOS, S.L.: Insufficient technical and organisational measures to ensure information security The Spanish Data Protection Authority (AEPD) fined ALÍA GESTIÓN INTEGRAL DE SERVICIOS, S.L. €150,000 for failing to implement sufficient technical and organizational measures to… Integrity and Confidentiality Principle Security Personal Data Mar 20, 2026
ANSPDCP · €3,000 Public and Private Domain SA: Insufficient legal basis for data processing Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) fined Public and Private Domain SA €3,000 on 2026-03-20 for: Insufficient legal basis for data… Personal Data Employees Processing Mar 20, 2026
aepd · €600 SERVICIOS INMOBILIARIOS Y GESTIÓN RCL MADRID, S.L.: Insufficient cooperation with supervisory authority Spanish Data Protection Authority (aepd) fined SERVICIOS INMOBILIARIOS Y GESTIÓN RCL MADRID, S.L. €600 on 2026-03-13 for: Insufficient cooperation with supervisory authority. Supervisory Authorities Supervision Mar 13, 2026
aepd · €450 Housing Association: Insufficient cooperation with supervisory authority Spanish Data Protection Authority (aepd) fined Housing Association €450 on 2026-03-13 for: Insufficient cooperation with supervisory authority. Supervisory Authorities Supervision Mar 13, 2026
ANSPDCP · €8,000 Altex Romania S.R.L.: Insufficient cooperation with supervisory authority Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) fined Altex Romania S.R.L. €8,000 on 2026-03-05 for: Insufficient cooperation with supervisory… Supervisory Authorities Supervision Personal Data Mar 5, 2026
Enforcement Tien gemeenten elk EUR 25.000 boete voor overtreding AVG-artikelen 5, 6 en 9 Het gaat om de gemeenten Delft, Ede, Eindhoven, Gooise Meren, Haarlemmermeer, Hilversum, Huizen, Tilburg, Veenendaal en Zoetermeer. Ze krijgen elk een boete van EUR 25.000,- voor… Supervision NL Mar 2, 2026
Enforcement Woo-besluit: Boetebesluit en besluit op bezwaar Supervision NL Mar 2, 2026
Garante · €1,000 Ciemme S.r.l.s.: Insufficient cooperation with supervisory authority Italian Data Protection Authority (Garante) fined Ciemme S.r.l.s. €1,000 on 2026-02-26 for: Insufficient cooperation with supervisory authority. Supervision Supervisory Authorities Telecommunications Feb 26, 2026
ANSPDCP · €2,000 SC Hayat Dent SRL: Insufficient cooperation with supervisory authority Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) fined SC Hayat Dent SRL €2,000 on 2026-02-20 for: Insufficient cooperation with supervisory… Supervisory Authorities Supervision Personal Data Feb 20, 2026
ANSPDCP · €3,000 Your Consulting SRL: Insufficient technical and organisational measures to ensure information security Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) fined Your Consulting SRL €3,000 on 2026-02-19 for: Insufficient technical and organisational… Security Supervisory Authorities Personal Data Feb 19, 2026
€5,500 Slovenia DPA: Insufficient technical and organisational measures to ensure information security Slovenian Supervisory Authority (Informacijski pooblaščenec) fined an unnamed party €5,500 on 2026-02-16 for: Insufficient technical and organisational measures to ensure… Security Supervision Processing Agreement Feb 16, 2026