Content type · 3,651 documents

Enforcement

Regulatory actions, fines, warnings, and enforcement decisions

🇪🇺 EU 🇳🇱 NL
Enforcement dashboard — fines by country, authority and article →
Filter by Topic Supervisory Authorities3581 Processing Agreement2804 Processing2648 Personal Data2613 Controllers2228 Data Controller1873 Law Enforcement1546 IP Address1284 Security1034 Supervision890 Monitoring548 Consent522
501–550 of 3,651 sort newestlargest fineoldest
€1,000 Giada FM S.r.l.: Onvoldoende naleving van de rechten van betrokkenen. Een boete van €1.000 - Italiaanse Autoriteit voor Gegevensbescherming (Garante). ITALY ·Garante ·Art. 5, 12, 15 Right of Access Data Controller Personal Data NL Sep 11, 2025
€8,000 Migliarino San Rossore Massaciuccoli Regional Park Authority: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 8,000 on Migliarino San Rossore Massaciuccoli Regional Park Authority. The controller published personal data of a job applicant on its… ITALY ·Garante ·Art. 5, 6, 20 Personal Data Controllers Employees Sep 11, 2025
€12,000 Casa di Cura Città di Roma: Insufficient technical and organisational measures to ensure information security The Italian DPA has imposed a fine of EUR 12,000 on the Casa di Cura Città di Roma. The controller used patient management software that gave users access to excessive amounts of… ITALY ·Garante ·Art. 5, 9, 25 +1 Healthcare Health Data Security Sep 11, 2025
€8,000 Autoriteit van het regionale park Migliarino San Rossore Massaciuccoli: Onvoldoende juridische basis voor de verwerking van gegevens. 8.000 euro boete - Italiaanse Autoriteit voor Gegevensbescherming (Garante). ITALY ·Garante ·Art. 5, 6, 20 Processing Data Controller Controllers NL Sep 11, 2025
€12,000 Ministry of the Interior - Department of Firefighters, Public Rescue, and Civil Defense - Provincial Command of Florence: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 12,000 on the Minstry of the Interior. During the Covid-19 pandemic, the controller published a list of employees' with names and… ITALY ·Garante ·Art. 5, 6, 9 IP Address Education Public Authority Sep 11, 2025
€12,000 Casa di Cura Città di Roma: Onvoldoende technische en organisatorische maatregelen om de informatiebeveiliging te waarborgen. Een boete van 12.000 euro - van de Italiaanse Autoriteit voor Gegevensbescherming (Garante). ITALY ·Garante ·Art. 5, 9, 25 +1 Health Data Healthcare Healthcare NL Sep 11, 2025
€18,000 Gemeente Nichelino: Onvoldoende juridische basis voor de verwerking van gegevens. Een boete van 18.000 euro - van de Italiaanse Autoriteit voor Gegevensbescherming (Garante). ITALY ·Garante ·Art. 5, 6, 12 +1 Education Processing Data Controller NL Sep 11, 2025
€6,000 Bedrijf: Onvoldoende juridische basis voor de verwerking van gegevens. Een boete van 6.000 euro - van de Italiaanse Autoriteit voor Gegevensbescherming (Garante). ITALY ·Garante ·Art. 5, 13 Video Surveillance Processing Personal Data NL Sep 11, 2025
€18,000 Comune di Nichelino: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 18,000 on the Comune di Nichelino. The controller published the sensitive personal data of a former employee, including the decision to… ITALY ·Garante ·Art. 5, 6, 12 +1 Personal Data Education Controllers Sep 11, 2025
€6,000 Company: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 6,000 on a company. The controller used video surveillance at its sites, but did not display adequate signs to inform data subjects about… ITALY ·Garante ·Art. 5, 13 Video Surveillance Controllers Monitoring Sep 11, 2025
€1,000 Giada FM S.r.l.: Insufficient fulfilment of data subjects rights The Italian DPA has imposed a fine of EUR 1,000 on Giada FM S.r.l. The controller failed to provide an employee with requested certificates. ITALY ·Garante ·Art. 5, 12, 15 Controllers Personal Data Employees Sep 11, 2025
€5,000 Unita Turism Holding S.A.: Onvoldoende technische en organisatorische maatregelen om de informatiebeveiliging te waarborgen. Een boete van 5.000 euro - van de Roemeense nationale toezichthoudende autoriteit voor de verwerking van persoonsgegevens (ANSPDCP). ROMANIA ·ANSPDCP ·Art. 32 Security Controllers Processing NL Sep 9, 2025
€5,000 Unita Turism Holding S.A.: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 5,000 on Unita Turism Holding S.A. The controller did not implement adequate technical and organisational measures to ensure… ROMANIA ·ANSPDCP ·Art. 32 Security Controllers Employees Sep 9, 2025
€1.8M S-Pankki Oyj: Onvoldoende technische en organisatorische maatregelen om de informatiebeveiliging te waarborgen. 1.800.000 euro boete - Waarnemend ombudsman gegevensbescherming. FINLAND ·Deputy Data Protection Ombudsman ·Art. 5, 25, 32 Security Accountability Supervisory Authorities NL Sep 8, 2025
€1.8M S-Pankki Oyj: Insufficient technical and organisational measures to ensure information security The Finish DPA has imposed a fine of EUR 1,800,000 on S-Pankki Oyj. Due to a software error, customers of the controller were able to log in to the bank accounts of other… FINLAND ·Deputy Data Protection Ombudsman ·Art. 5, 25, 32 Security Processing Agreement Controllers Sep 8, 2025
€3M Allium UPI: Onvoldoende technische en organisatorische maatregelen om de informatiebeveiliging te waarborgen. Een boete van 3.000.000 euro - De Estische Autoriteit voor Gegevensbescherming (AKI). ESTONIA ·AKI ·Insufficient technical and organisational measures to ensure information security Security Data Breaches Controllers NL Sep 5, 2025
€33,500 Bakkerijketen: Niet-naleving van algemene principes voor gegevensverwerking. Een boete van 33.500 euro - van de Oostenrijkse Autoriteit voor Gegevensbescherming (DSB). AUSTRIA ·dsb ·Art. 5, 6 Video Surveillance Processing IP Address NL Sep 5, 2025
€33,500 Bakery Chain: Non-compliance with general data processing principles The Austrian DPA has imposed a fine of EUR 33,500 on a bakery chain. The controller used video surveillance which affected both public areas and areas intended solely for… AUSTRIA ·dsb ·Art. 5, 6 Video Surveillance IP Address Retention Period Sep 5, 2025
€3M Allium UPI: Insufficient technical and organisational measures to ensure information security The Estonian DPA has imposed a fine of EUR 3,000,000 on Allium UPI. The controller failed to implement adequate technical and organisational measures to ensure data security. This… ESTONIA ·AKI ·Insufficient technical and organisational measures to ensure information security Data Breaches Security Controllers Sep 5, 2025
€180,000 Sociedad de Gestión de Activos Procedentes de la Reestructuración Bancaria S.A.: Onvoldoende technische en organisatorische maatregelen om de informatiebeveiliging te waarborgen. Een boete van 180.000 euro - opgelegd door de Spaanse autoriteit voor gegevensbescherming (AEPD). SPAIN ·aepd ·Art. 5, 28 Security Processors Processing NL Sep 4, 2025
€180,000 Sociedad de Gestión de Activos Procedentes de la Reestructuración Bancaria S.A.: Insufficient technical and organisational measures to ensure information security The Spanish DPA has imposed a fine of EUR 180,000 on Sociedad de Gestión de Activos Procedentes de la Reestructuración Bancaria S.A. The controller suffered a cyber attack due to… SPAIN ·aepd ·Art. 5, 28 Controllers Processors Processing Agreement Sep 4, 2025
€870 Bedrijf: Onvoldoende nakoming van de verplichtingen met betrekking tot het melden van datalekken. 870 euro boete - Oostenrijkse Autoriteit voor Gegevensbescherming (dsb). AUSTRIA ·dsb ·Art. 33 Data Breaches Notification Obligation Controllers NL Sep 4, 2025
€9,700 Verhuurder: Er is onvoldoende juridische basis voor de verwerking van persoonsgegevens. 9.700 euro boete - Belgische Autoriteit voor gegevensbescherming (APD). BELGIUM ·APD ·Art. 5, 6 Video Surveillance Processing Controllers NL Sep 4, 2025
€870 Company: Insufficient fulfilment of data breach notification obligations The Austrian DPA has imposed a fine of EUR 870 on a company. After being informed of a data breach, the controller took adequate measures to close it but failed to inform the DPA. AUSTRIA ·dsb ·Art. 33 Notification Obligation Data Breaches Article 19 GDPR - Notification of Rectification, Erasure or Restriction Sep 4, 2025
€9,700 Landlord: Insufficient legal basis for data processing The Belgian DPA has imposed a fine of EUR 9,700 on a Landlord. The controller installed video surveillance in and around a student residence. However, the surveillance was too… BELGIUM ·APD ·Art. 5, 6 Video Surveillance Controllers Monitoring Sep 4, 2025
€200,900 ILVA A/S: Non-compliance with general data processing principles The Danish DPA has imposed a fine of EUR 200,900 on ILVA A/S. The controller failed to implement data deletion deadlines. This led to an infringement of the principle of storage… DENMARK ·Datatilsynet ·Non-compliance with general data processing principles Storage Limitation Retention Period Controllers Sep 2, 2025
€200,900 ILVA A/S: Overtreding van algemene principes voor gegevensverwerking. Een boete van 200.900 euro - De Deense Autoriteit voor Gegevensbescherming (Datatilsynet). DENMARK ·Datatilsynet ·Non-compliance with general data processing principles Storage Limitation Retention Period Processing NL Sep 2, 2025
€10,000 La Fântâna S.R.L.: Onvoldoende technische en organisatorische maatregelen om de informatiebeveiliging te waarborgen. Een boete van €10.000 - De Roemeense nationale toezichthoudende autoriteit voor de verwerking van persoonsgegevens (ANSPDCP). ROMANIA ·ANSPDCP ·Art. 32 Security Processing Controllers NL Sep 1, 2025
€200M GOOGLE LLC: Onvoldoende juridische basis voor de verwerking van gegevens. 200 miljoen euro boete - Frans Nationaal Instituut voor Gegevensbescherming (CNIL). FRANCE ·CNIL ·Art. 82 Marketing Cookies Consent NL Sep 1, 2025
€200M GOOGLE LLC: Insufficient legal basis for data processing The French DPA has imposed a fine of EUR 200,000,000 on GOOGLE LLC. While creating an account for the controller's services, the controller designed the cookie consent process in… FRANCE ·CNIL ·Art. 82 Direct Marketing Cookies Marketing Sep 1, 2025
€150M INFINITE STYLES SERVICES CO. LIMITED: Onvoldoende juridische basis voor de verwerking van persoonsgegevens. 150 miljoen euro boete - Franse Autoriteit voor Gegevensbescherming (CNIL). FRANCE ·CNIL ·Art. 82 Cookies Personal Data Processing NL Sep 1, 2025
€125M GOOGLE IRELAND LIMITED: Onvoldoende juridische basis voor de verwerking van gegevens. 125.000.000 euro boete - Franse Autoriteit voor Gegevensbescherming (CNIL). FRANCE ·CNIL ·Art. 82 Marketing Consent Cookies NL Sep 1, 2025
€150M INFINITE STYLES SERVICES CO. LIMITED: Insufficient legal basis for data processing The French DPA has imposed a fine of EUR 150,000,000 on INFINITE STYLES SERVICES CO. LIMITED, which operates under the name 'SHEIN'. The controller used cookies unlawfully on its… FRANCE ·CNIL ·Art. 82 Cookies Controllers Processing Agreement Sep 1, 2025
€1,200 Company: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 1,200 on a company. The controller used personal data for a purpose, which did not align with the initial purpose. The original fine of… SPAIN ·aepd ·Art. 6 Controllers Processing Agreement Personal Data Sep 1, 2025
€1,200 Bedrijf: Onvoldoende juridische basis voor de verwerking van gegevens. 1.200 euro boete - Spaanse Autoriteit voor Gegevensbescherming (AEPD). SPAIN ·aepd ·Art. 6 Processing Data Controller Controllers NL Sep 1, 2025
€10,000 La Fântâna S.R.L.: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 10,000 on La Fântâna S.R.L. The controller suffered a cyber attack due to insufficient technical and organisational measures to ensure… ROMANIA ·ANSPDCP ·Art. 32 Security Controllers Processing Agreement Sep 1, 2025
€2,000 Primary School: Insufficient legal basis for data processing Croatian Data Protection Authority (azop) fined Primary School €2,000 on 2025-09-01 for: Insufficient legal basis for data processing. Croatia ·azop ·Art. 5, 6 Education Processing Public Authority Sep 1, 2025
€125M GOOGLE IRELAND LIMITED: Insufficient legal basis for data processing The French DPA has imposed a fine of EUR 125,000,000 on GOOGLE IRELAND LIMITED. While creating an account for the controller's services, the controller designed the cookie consent… FRANCE ·CNIL ·Art. 82 Direct Marketing Cookies Marketing Sep 1, 2025
€2,000 GESTIÓN DE VENTAS IBERIA S.L.: Onvoldoende naleving van de rechten van betrokkenen. Een boete van 2.000 euro - Spaanse Autoriteit voor Gegevensbescherming (AEPD). SPAIN ·aepd ·Art. 14 Personal Data Data Controller Controllers NL Aug 31, 2025
€2,000 GESTIÓN DE VENTAS IBERIA S.L.: Insufficient fulfilment of data subjects rights The Spanish DPA has imposed a fine of EUR 2,000 on GESTIÓN DE VENTAS IBERIA S.L. The controller contacted a data subject for direct marketing purposes, thereby violating local… SPAIN ·aepd ·Art. 14 Personal Data Direct Marketing Controllers Aug 31, 2025
€1,200 GOHIPOTECA, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR on GOHIPOTECA, S.L. The controller processed data of a data subject without a sufficient legal basis. The contract used as the basis for… SPAIN ·aepd ·Art. 6 Controllers Insurance IP Address Aug 29, 2025
€2,400 KVIKU SPAIN, S.L.: Onvoldoende juridische basis voor de verwerking van persoonsgegevens. Een boete van 2.400 euro - opgelegd door de Spaanse autoriteit voor gegevensbescherming (AEPD). aepd ·Art. 6 ·Insufficient legal basis for data processing Personal Data Processing Data Controller NL Aug 29, 2025
€2,400 KVIKU SPAIN, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 2,400 on KVIKU SPAIN, S.L. The controller processed personal data of a data subject without sufficient consent. The original fine of EUR… aepd ·Art. 6 ·Insufficient legal basis for data processing Personal Data Controllers Processing Agreement Aug 29, 2025
€1,200 GOHIPOTECA, S.L.: Onvoldoende juridische basis voor de verwerking van persoonsgegevens. 1.200 euro boete - Spaanse Autoriteit voor Gegevensbescherming (AEPD). SPAIN ·aepd ·Art. 6 Personal Data Processing Controllers NL Aug 29, 2025
€300 Rijschool: Onvoldoende nakoming van de informatieverplichtingen. Een boete van 300 euro - Spaanse Autoriteit voor Gegevensbescherming (AEPD). SPAIN ·aepd ·Art. 13 Education Video Surveillance Processing NL Aug 26, 2025
€4.3M ING Bank Śląski: Onvoldoende juridische basis voor de verwerking van gegevens. 4.323.250 euro boete - Pools Nationaal Bureau voor de Bescherming van Persoonsgegevens (UODO). POLAND ·UODO ·Art. 5, 6 Processing Personal Data Accountability NL Aug 26, 2025
€300 Driving School: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine of EUR 300 on a driving school. The controller has installed video surveillance, but failed to adequatly inform data subjects. The original fine… SPAIN ·aepd ·Art. 13 Video Surveillance Monitoring Education Aug 26, 2025
€4.3M ING Bank Śląski: Insufficient legal basis for data processing The Polish DPA has imposed a fine of EUR 4,323,250 on ING Bank Śląski. The controller scanned the identity documents of every customer and potential customer without a sufficient… POLAND ·UODO ·Art. 5, 6 Controllers Insurance Processing Agreement Aug 26, 2025
€1,800 LEIVA BUS, S.L.: Onvoldoende technische en organisatorische maatregelen om de informatiebeveiliging te waarborgen. 1.800 euro boete - Spaanse Autoriteit voor Gegevensbescherming (AEPD). SPAIN ·aepd ·Art. 5 Security Controllers Data Controller NL Aug 25, 2025
€5,400 YUNEXPRESS SPAIN, S.L.: Onvoldoende overeenkomst met betrekking tot de verwerking van gegevens. Boete van €5.400 - Spaanse Autoriteit voor Gegevensbescherming (AEPD). aepd ·Art. 5, 28 ·Insufficient data processing agreement Processing Controllers Data Processor NL Aug 25, 2025