Content type · 3,808 documents in this view · 3,813 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filter by Topic Supervisory Authorities 3589 Processing 2636 Personal Data 2395 Controllers 2018 Processing Agreement 1114 Security 1013 Supervision 847 Healthcare 621 Law Enforcement 568 Monitoring 547 Public Authority 539 Consent 508
€150,000 DIGI SPAIN TELECOM, S.L.U.: Insufficient legal basis for the processing of personal data. ⇄ Een boete van 150.000 euro - opgelegd door de Spaanse autoriteit voor gegevensbescherming (AEPD). ·Art. 6 ·Insufficient legal basis for data processing Sep 17, 2025
€2,670 POLAND DPA: Lack of appointment of data protection officer The Polish DPA has imposed a fine of EUR 2,670 on an unkonwn company in the health care sector. The controller appointed its CEO as the DPO. ·Art. 38 ·Lack of appointment of data protection officer Sep 12, 2025
€2,670 POLAND, Data Protection Authority: Failure to appoint a data protection officer. ⇄ Een boete van 2.670 euro - van het Poolse nationale bureau voor de bescherming van persoonlijke gegevens (UODO). ·Art. 38 ·Lack of appointment of data protection officer Sep 12, 2025
€6,000 Company: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 6,000 on a company. The controller used video surveillance at its sites, but did not display adequate signs to inform data subjects about… ITALY · ·Art. 5, 13 Sep 11, 2025
€18,000 Comune di Nichelino: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 18,000 on the Comune di Nichelino. The controller published the sensitive personal data of a former employee, including the decision to… ITALY · ·Art. 5, 6, 12 +1 Sep 11, 2025
€12,000 Ministry of the Interior - Department of Firefighters, Public Rescue, and Civil Defense - Provincial Command of Florence: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 12,000 on the Minstry of the Interior. During the Covid-19 pandemic, the controller published a list of employees' with names and… ITALY · ·Art. 5, 6, 9 Sep 11, 2025
€12,000 Ministry of the Interior - Fire Brigade, Public Rescue and Civil Protection Service - Provincial Command Structure of Florence: Non-compliance with general principles for data processing. ⇄ Een boete van €12.000 - van de Italiaanse Autoriteit voor Gegevensbescherming (Garante). ITALY · ·Art. 5, 6, 9 Sep 11, 2025
€1,000 Giada FM S.r.l.: Insufficient compliance with data subjects' rights. ⇄ Een boete van €1.000 - Italiaanse Autoriteit voor Gegevensbescherming (Garante). ITALY · ·Art. 5, 12, 15 Sep 11, 2025
€8,000 Migliarino San Rossore Massaciuccoli Regional Park Authority: Insufficient legal basis for the processing of data. ⇄ 8.000 euro boete - Italiaanse Autoriteit voor Gegevensbescherming (Garante). ITALY · ·Art. 5, 6, 20 Sep 11, 2025
€8,000 Migliarino San Rossore Massaciuccoli Regional Park Authority: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 8,000 on Migliarino San Rossore Massaciuccoli Regional Park Authority. The controller published personal data of a job applicant on its… ITALY · ·Art. 5, 6, 20 Sep 11, 2025
€12,000 Casa di Cura Città di Roma: Insufficient technical and organisational measures to ensure information security The Italian DPA has imposed a fine of EUR 12,000 on the Casa di Cura Città di Roma. The controller used patient management software that gave users access to excessive amounts of… ITALY · ·Art. 5, 9, 25 +1 Sep 11, 2025
€6,000 Municipality of Buccino: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 6,000 on the Municipality of Buccino. The controller published pictures of minors and people with mental health conditions in multiple… ITALY · ·Art. 5, 6, 9 +2 Sep 11, 2025
€12,000 Casa di Cura Città di Roma: Insufficient technical and organisational measures to ensure information security. ⇄ Een boete van 12.000 euro - van de Italiaanse Autoriteit voor Gegevensbescherming (Garante). ITALY · ·Art. 5, 9, 25 +1 Sep 11, 2025
€1,000 Giada FM S.r.l.: Insufficient fulfilment of data subjects rights The Italian DPA has imposed a fine of EUR 1,000 on Giada FM S.r.l. The controller failed to provide an employee with requested certificates. ITALY · ·Art. 5, 12, 15 Sep 11, 2025
€18,000 Municipality of Nichelino: Insufficient legal basis for data processing. ⇄ Een boete van 18.000 euro - van de Italiaanse Autoriteit voor Gegevensbescherming (Garante). ITALY · ·Art. 5, 6, 12 +1 Sep 11, 2025
€6,000 Company: Insufficient legal basis for the processing of data. ⇄ Een boete van 6.000 euro - van de Italiaanse Autoriteit voor Gegevensbescherming (Garante). ITALY · ·Art. 5, 13 Sep 11, 2025
€6,000 Municipality of Buccino: Insufficient legal basis for data processing. ⇄ Een boete van 6.000 euro - opgelegd door de Italiaanse Autoriteit voor Gegevensbescherming (Garante). ITALY · ·Art. 5, 6, 9 +2 Sep 11, 2025
€5,000 Unita Turism Holding S.A.: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 5,000 on Unita Turism Holding S.A. The controller did not implement adequate technical and organisational measures to ensure… ROMANIA · ·Art. 32 Sep 9, 2025
€5,000 Unita Turism Holding S.A.: Insufficient technical and organizational measures to ensure information security. ⇄ Een boete van 5.000 euro - van de Roemeense nationale toezichthoudende autoriteit voor de verwerking van persoonsgegevens (ANSPDCP). ROMANIA · ·Art. 32 Sep 9, 2025
€1.8M S-Pankki Oyj: Insufficient technical and organizational measures to ensure information security. ⇄ 1.800.000 euro boete - Waarnemend ombudsman gegevensbescherming. FINLAND · ·Art. 5, 25, 32 Sep 8, 2025
€1.8M S-Pankki Oyj: Insufficient technical and organisational measures to ensure information security The Finish DPA has imposed a fine of EUR 1,800,000 on S-Pankki Oyj. Due to a software error, customers of the controller were able to log in to the bank accounts of other… FINLAND · ·Art. 5, 25, 32 Sep 8, 2025
€3M Allium UPI: Insufficient technical and organizational measures to ensure information security. ⇄ Een boete van 3.000.000 euro - De Estische Autoriteit voor Gegevensbescherming (AKI). ESTONIA · ·Insufficient technical and organisational measures to ensure information security Sep 5, 2025
€33,500 Bakery chain: Non-compliance with general principles for data processing. ⇄ Een boete van 33.500 euro - van de Oostenrijkse Autoriteit voor Gegevensbescherming (DSB). AUSTRIA · ·Art. 5, 6 Sep 5, 2025
€33,500 Bakery Chain: Non-compliance with general data processing principles The Austrian DPA has imposed a fine of EUR 33,500 on a bakery chain. The controller used video surveillance which affected both public areas and areas intended solely for… AUSTRIA · ·Art. 5, 6 Sep 5, 2025
€3M Allium UPI: Insufficient technical and organisational measures to ensure information security The Estonian DPA has imposed a fine of EUR 3,000,000 on Allium UPI. The controller failed to implement adequate technical and organisational measures to ensure data security. This… ESTONIA · ·Insufficient technical and organisational measures to ensure information security Sep 5, 2025
€9,700 Landlord: Insufficient legal basis for data processing The Belgian DPA has imposed a fine of EUR 9,700 on a Landlord. The controller installed video surveillance in and around a student residence. However, the surveillance was too… BELGIUM · ·Art. 5, 6 Sep 4, 2025
€180,000 Sociedad de Gestión de Activos Procedentes de la Reestructuración Bancaria S.A.: Insufficient technical and organisational measures to ensure information security The Spanish DPA has imposed a fine of EUR 180,000 on Sociedad de Gestión de Activos Procedentes de la Reestructuración Bancaria S.A. The controller suffered a cyber attack due to… SPAIN · ·Art. 5, 28 Sep 4, 2025
€870 Company: Insufficient fulfilment of data breach notification obligations The Austrian DPA has imposed a fine of EUR 870 on a company. After being informed of a data breach, the controller took adequate measures to close it but failed to inform the DPA. AUSTRIA · ·Art. 33 Sep 4, 2025
€9,700 Landlord: Insufficient legal basis for processing personal data. ⇄ 9.700 euro boete - Belgische Autoriteit voor gegevensbescherming (APD). BELGIUM · ·Art. 5, 6 Sep 4, 2025
€180,000 Sociedad de Gestión de Activos Procedentes de la Reestructuración Bancaria S.A.: Insufficient technical and organizational measures to ensure information security. ⇄ Een boete van 180.000 euro - opgelegd door de Spaanse autoriteit voor gegevensbescherming (AEPD). SPAIN · ·Art. 5, 28 Sep 4, 2025
€870 Company: Insufficient compliance with obligations regarding the notification of data breaches. ⇄ 870 euro boete - Oostenrijkse Autoriteit voor Gegevensbescherming (dsb). AUSTRIA · ·Art. 33 Sep 4, 2025
€200,900 ILVA A/S: Non-compliance with general data processing principles The Danish DPA has imposed a fine of EUR 200,900 on ILVA A/S. The controller failed to implement data deletion deadlines. This led to an infringement of the principle of storage… DENMARK · ·Non-compliance with general data processing principles Sep 2, 2025
€200,900 ILVA A/S: Violation of general principles for data processing. ⇄ Een boete van 200.900 euro - De Deense Autoriteit voor Gegevensbescherming (Datatilsynet). DENMARK · ·Non-compliance with general data processing principles Sep 2, 2025
€125M GOOGLE IRELAND LIMITED: Insufficient legal basis for data processing The French DPA has imposed a fine of EUR 125,000,000 on GOOGLE IRELAND LIMITED. While creating an account for the controller's services, the controller designed the cookie consent… FRANCE · ·Art. 82 Sep 1, 2025
€10,000 La Fântâna S.R.L.: Insufficient technical and organisational measures to ensure information security. ⇄ Een boete van €10.000 - De Roemeense nationale toezichthoudende autoriteit voor de verwerking van persoonsgegevens (ANSPDCP). ROMANIA · ·Art. 32 Sep 1, 2025
€1,200 Company: Insufficient legal basis for the processing of data. ⇄ 1.200 euro boete - Spaanse Autoriteit voor Gegevensbescherming (AEPD). SPAIN · ·Art. 6 Sep 1, 2025
€150M INFINITE STYLES SERVICES CO. LIMITED: Insufficient legal basis for the processing of personal data. ⇄ 150 miljoen euro boete - Franse Autoriteit voor Gegevensbescherming (CNIL). FRANCE · ·Art. 82 Sep 1, 2025
€2,000 Primary School: Insufficient legal basis for data processing Croatian Data Protection Authority (azop) fined Primary School €2,000 on 2025-09-01 for: Insufficient legal basis for data processing. Croatia · ·Art. 5, 6 Sep 1, 2025
€1,200 Company: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 1,200 on a company. The controller used personal data for a purpose, which did not align with the initial purpose. The original fine of… SPAIN · ·Art. 6 Sep 1, 2025
€200M GOOGLE LLC: Insufficient legal basis for the processing of data. ⇄ 200 miljoen euro boete - Frans Nationaal Instituut voor Gegevensbescherming (CNIL). FRANCE · ·Art. 82 Sep 1, 2025
€200M GOOGLE LLC: Insufficient legal basis for data processing The French DPA has imposed a fine of EUR 200,000,000 on GOOGLE LLC. While creating an account for the controller's services, the controller designed the cookie consent process in… FRANCE · ·Art. 82 Sep 1, 2025
€10,000 La Fântâna S.R.L.: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 10,000 on La Fântâna S.R.L. The controller suffered a cyber attack due to insufficient technical and organisational measures to ensure… ROMANIA · ·Art. 32 Sep 1, 2025
€150M INFINITE STYLES SERVICES CO. LIMITED: Insufficient legal basis for data processing The French DPA has imposed a fine of EUR 150,000,000 on INFINITE STYLES SERVICES CO. LIMITED, which operates under the name 'SHEIN'. The controller used cookies unlawfully on its… FRANCE · ·Art. 82 Sep 1, 2025
€125M GOOGLE IRELAND LIMITED: Insufficient legal basis for the processing of data. ⇄ 125.000.000 euro boete - Franse Autoriteit voor Gegevensbescherming (CNIL). FRANCE · ·Art. 82 Sep 1, 2025
€2,000 GESTIÓN DE VENTAS IBERIA S.L.: Insufficient fulfilment of data subjects rights The Spanish DPA has imposed a fine of EUR 2,000 on GESTIÓN DE VENTAS IBERIA S.L. The controller contacted a data subject for direct marketing purposes, thereby violating local… SPAIN · ·Art. 14 Aug 31, 2025
€2,000 GESTIÓN DE VENTAS IBERIA S.L.: Insufficient compliance with data subjects' rights. ⇄ Een boete van 2.000 euro - Spaanse Autoriteit voor Gegevensbescherming (AEPD). SPAIN · ·Art. 14 Aug 31, 2025
€2,400 KVIKU SPAIN, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 2,400 on KVIKU SPAIN, S.L. The controller processed personal data of a data subject without sufficient consent. The original fine of EUR… ·Art. 6 ·Insufficient legal basis for data processing Aug 29, 2025
€2,400 KVIKU SPAIN, S.L.: Insufficient legal basis for the processing of personal data. ⇄ Een boete van 2.400 euro - opgelegd door de Spaanse autoriteit voor gegevensbescherming (AEPD). ·Art. 6 ·Insufficient legal basis for data processing Aug 29, 2025
€1,200 GOHIPOTECA, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR on GOHIPOTECA, S.L. The controller processed data of a data subject without a sufficient legal basis. The contract used as the basis for… SPAIN · ·Art. 6 Aug 29, 2025
€1,200 GOHIPOTECA, S.L.: Insufficient legal basis for the processing of personal data. ⇄ 1.200 euro boete - Spaanse Autoriteit voor Gegevensbescherming (AEPD). SPAIN · ·Art. 6 Aug 29, 2025