Content type · 547 documents in this view · 3,813 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities 3589 Processing 2636 Personal Data 2395 Controllers 2018 Processing Agreement 1114 Security 1013 Supervision 847 Healthcare 621 Law Enforcement 568 Monitoring 547 Public Authority 539 Consent 508
HUF 15M NAIH-450-7-2026 The DPA initiated an investigation into the processing of personal data of customers (the data subjects) by the operator of an online store (the controller) in April 2025. The… Hungary ·Art. 5, 12, 13 May 12, 2026
€277,500 Permanent TSB: Insufficient technical and organisational measures to ensure information security Data Protection Authority of Ireland fined Permanent TSB €277,500 on 2026-05-08 for: Insufficient technical and organisational measures to ensure information security. Ireland · ·Art. 5, 32, 33 May 8, 2026
HUF 10M NAIH-4462-5-2026 The DPA initiated an investigation into the processing of the personal data of customers (the data subjects) by the operator of an online store (the controller) in April 2025. The… Hungary ·Art. 5, 12, 13 Apr 30, 2026
The data subject was employed by an Austrian stock corporation (the controller) from August 2018 to June 2025 They worked as a manager in the controller’s finance department, with technical and disciplinary responsibility for up to five employees. The controller operated a 360-degree… 2025-0.960.016 ·Austria · Mar 20, 2026
€400,000 Italian DPA finds Cerved Group failed to disclose creditworthiness scores in Art. 15 The DPA received several complaints from data subjects concerning Cerved Group S.p.A. (the controller) an Italian credit rating agency. The controller was processing the personal… Italy · ·Art. 5, 12, 15 +3 Mar 7, 2026
€150,000 The Spanish Data Protection Agency (AEPD) investigated Vodafone España, S.A.U as controller after a SIM swapping incident. On 21 September 2021, an unknown third party requested a duplicate SIM card for the mobile line of a data subject. The request was… EXP202306354 (PS/00312/2024) ·Spain ·Art. 5, 6 Feb 11, 2026
€1,800 Landlord: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 1,800 on a Landlord. The landlord used video surveillance in rental apartments without having a sufficient legal basis. The original fine… SPAIN · ·Art. 6 Feb 6, 2026
€1,200 Dental Clinic: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 1,200 on a dental clinic. The controller used video surveillance in its clinic for security purposes, including a camera in the doctor's… SPAIN · ·Art. 5 Jan 19, 2026
€25,500 DSB · 2025-1.049.138 The controller was a digital marketing agency whose employees pre-screened potential applicants for its clients. As part of this process, applicants (data subjects) were contacted… Austria ·Art. 5, 6, 12 +1 Jan 19, 2026
€21,650 Timegrip AS: Insufficient fulfilment of data subjects rights The Norwegian DPA has imposed a fine of EUR 21,650 on Timegrip AS. The controller had been tracking the working hours of employees at a company that went bankrupt. A former… NORWAY · ·Art. 15 Jan 16, 2026
€1,500 10214411 The Local Territorial Agency for Residential Housing (Azienda territoriale per l’edilizia residenziale) submitted a complaint to the DPA regarding the installation of security… Italy · ·Art. 5, 6, 13 +2 Jan 16, 2026
AEPD: fines of €400,000 and €300,000 for telecom providers in SIM card fraud ⇄ Facts: The Data Protection Authority has imposed a fine of 400,000 euros on a telephone company for unlawfully changing the ownership of a mobile phone subscription and issuing a… EXP202306073 ·Spanje Jan 7, 2026
€20,000 Telecommunications company: Insufficient legal basis for data processing. ⇄ The Croatian data protection authority (DPA) has imposed a fine of 20,000 euros on a telecommunications company. A data subject had filed a complaint with the DPA, claiming that… CROATIA · ·Art. 5, 6 Dec 30, 2025
€2,000 Order of General Nurses, Midwives and Medical Assistants of Romania – Neamt Branch: Non-compliance with general data processing principles The Romanian DPA has imposed a fine of EUR 2,000 on the Order of General Nurses, Midwives and Medical Assistants of Romania – Neamt Branch. The controller used video surveillance… ·Art. 5, 6, 12 +1 ·Non-compliance with general data processing principles Dec 29, 2025
€32,000 EXCEL HOTELS & RESORTS, S.A.: Insufficient technical and organizational measures to ensure information security. ⇄ Een boete van 32.000 euro - opgelegd door de Spaanse autoriteit voor gegevensbescherming (AEPD). SPAIN · ·Art. 5 Dec 20, 2025
€120,000 Pioneer Hi-Bred Italia Sementi s.r.l.: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 120,000 on Pioneer Hi-Bred Italia Sementi s.r.l. The controller installed satellite telematics tracking devices to monitor driving… ITALY · ·Art. 5, 6, 28 Dec 18, 2025
€2,000 Elba Catering Distribuzioni s.r.I.s.: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 2,000 on Elba Catering Distribuzioni s.r.I.s. The controller installed video surveillance, which affected the public road. Furthermore,… ITALY · ·Art. 5, 13 Dec 18, 2025
€12,000 Comune di Tuscania: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 12,000 on the Commune di Tuscania. The controller had been using video surveillance and licence plate recognition within its territory… ITALY · ·Art. 5, 6, 12 +5 Dec 4, 2025
€3,600 DELAFRUIT, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 3,600 on DELAFRUIT, S.L. The controller installed video surveillance in the staff break area and dining room, but did not put up the… SPAIN · ·Art. 5 Dec 1, 2025
€3,600 RISING SUN CAR RENTAL S..L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 3,600 on RISING SUN CAR RENTAL S..L. The controller used video surveillance to ensure security at its facility, affecting more areas than… SPAIN · ·Art. 5, 13 Dec 1, 2025
€4.5M Telecommunications Company (Operator of Electronic Communications Networks and Services): Violation of the General Principles of Data Processing. ⇄ Een boete van 4.500.000 euro - opgelegd door de Kroatische Autoriteit voor Gegevensbescherming (AZOP). CROATIA · ·Art. 5, 6, 12 +4 Nov 24, 2025
€800 SOBLADA RESTAURACIÓN, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 800 on SOBLADA RESTAURACIÓN, S.L. The controller installed video surveillance without providing the necessary information signs or… SPAIN · ·Art. 5, 13 Nov 19, 2025
€2,400 AXARQUIA VELEZ DENTAL, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 2,400 on AXARQUIA VELEZ DENTAL, S.L. The controller used video surveillance to ensure security at its facility, affecting more areas than… SPAIN · ·Art. 5 Nov 14, 2025
€6,000 Comune di Orte: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 6,000 on the Comuni di Orte. The controller implemented video surveillance on its territory in a manner that did not comply with the… ITALY · ·Art. 5, 6, 12 +2 Nov 13, 2025
€15,000 Comune di Curtarolo: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 15,000 on the Comune di Curtarolo. The controller used surveillance footage in disciplinary proceedings against an employee, and also… ITALY · ·Art. 5, 6, 12 +3 Oct 23, 2025
AEPD · PS-00140-2025 23ANDME, INC., the controller, is a personal genomics and biotechnology company established in the United States which offered genetic testing services to individuals in Spain. In… PS-00140-2025 ·Spain ·Art. 5, 9, 24 +2 Oct 10, 2025
€10,000 Municipality of Moschato–Tavros: Insufficient legal basis for data processing The Hellenic DPA has imposed a fine of EUR 10,000 on the Municipality of Moschato–Tavros. The controller installed a video surveillance system in a depot to protect municipal… GREECE · ·Art. 5, 12, 13 +1 Oct 9, 2025
€32,000 Provincia Autonoma di Bolzano: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 32,000 on the Provincia Autonoma di Bolzan. The controller implemented video surveillance with automated licence plate recognition… ITALY · ·Art. 5, 6, 12 +4 Sep 25, 2025
€100,000 SAMARITAINE SAS: Non-compliance with general data processing principles The French DPA has imposed a fine of EUR 100,000 on SAMARITAINE SAS. After multiple theft incidents, the controller installed security cameras disguised as smoke detectors to… FRANCE · ·Art. 5, 33, 38 Sep 18, 2025
€100,000 SAMARITAINE SAS: Non-compliance with the general principles of data processing. ⇄ Een boete van 100.000 euro - van de Franse Autoriteit voor Gegevensbescherming (CNIL). FRANCE · ·Art. 5, 33, 38 Sep 18, 2025
€6,000 Company: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 6,000 on a company. The controller used video surveillance at its sites, but did not display adequate signs to inform data subjects about… ITALY · ·Art. 5, 13 Sep 11, 2025
€33,500 Bakery Chain: Non-compliance with general data processing principles The Austrian DPA has imposed a fine of EUR 33,500 on a bakery chain. The controller used video surveillance which affected both public areas and areas intended solely for… AUSTRIA · ·Art. 5, 6 Sep 5, 2025
€9,700 Landlord: Insufficient legal basis for data processing The Belgian DPA has imposed a fine of EUR 9,700 on a Landlord. The controller installed video surveillance in and around a student residence. However, the surveillance was too… BELGIUM · ·Art. 5, 6 Sep 4, 2025
€300 Driving School: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine of EUR 300 on a driving school. The controller has installed video surveillance, but failed to adequatly inform data subjects. The original fine… SPAIN · ·Art. 13 Aug 26, 2025
€4M McDonald’s Polska Sp. z o.o.: Non-compliance with general principles for data processing. ⇄ Een boete van 3.955.000 euro - van het Poolse nationale bureau voor de bescherming van persoonlijke gegevens (UODO). POLAND · ·Art. 5, 25, 28 +1 Jul 21, 2025
€10,000 Shield of David - K.I.D.A.F.: Non-compliance with general data processing principles The Hellenic DPA has imposed a fine of EUR 10,000 on Shield of David - K.I.D.A.F. The controller, a day care centre for people with autism, has legally installed video… GREECE · ·Art. 5, 12, 13 +3 Jun 24, 2025
€22,000 Kristiansand municipality: Insufficient legal basis for data processing The Norwegian DPA imposed a fine of EUR 22,000 on Kristiansand municipality. The controller offers a helpline for childreen, which had become victims of violence, abuse or… NORWAY · ·Art. 6, 12, 13 Jun 10, 2025
€1.1M University Pharmacy: Non-compliance with general principles of data processing. ⇄ 1.100.000 euro boete - Waarnemend ombudsman gegevensbescherming. FINLAND · ·Art. 5, 32 May 27, 2025
€1.1M Yliopiston Apteekin: Non-compliance with general data processing principles The Finish DPA has imposed a fine of EUR 1,100,000 on Yliopiston Apteekin. The controller, who runs an online pharmacy, used various web analytics and monitoring tools. These… FINLAND · ·Art. 5, 32 May 27, 2025
€200,000 ASNEF-EQUIFAX, a company providing creditworthiness information, lacks a sufficient legal basis for data processing. ⇄ Een boete van 200.000 euro - opgelegd door de Spaanse Autoriteit voor Gegevensbescherming (AEPD). SPAIN · ·Art. 6, 17 May 19, 2025
€16,000 Sole Trader: Insufficient legal basis for data processing The Slovenian DPA has imposed a fine of EUR 16,000 on a sole trader. The controller rented out apartments to tenants and installed video surveillance inside them. SLOVENIA · ·Art. 5, 6 May 14, 2025
€5,000 ROUMASPORT SRL: Insufficient legal basis for the processing of personal data. ⇄ Een boete van 5.000 euro - van de Roemeense nationale toezichthoudende autoriteit voor de verwerking van persoonsgegevens (ANSPDCP). ROMANIA · ·Art. 5, 6 May 9, 2025
€5,000 ROUMASPORT SRL: Insufficient legal basis for data processing The Romanian DPA has imposed a fine of EUR 5,000 on ROUMASPORT SRL. The controller accessed surveillance cameras to monitor its employees without a sufficient legal basis. The… ROMANIA · ·Art. 5, 6 May 9, 2025
€2,000 Versilmagra Immobiliare, based at Robertelli Davide & C. S.a.s.: Non-compliance with the general principles of data processing. ⇄ Een boete van 2.000 euro - opgelegd door de Italiaanse Autoriteit voor Gegevensbescherming (Garante). ITALY · ·Art. 5, 6, 7 +7 Apr 29, 2025
€40,000 MA Immobiliare S.r.l.s.: Non-compliance with the general principles for data processing. ⇄ Een boete van 40.000 euro - van de Italiaanse Autoriteit voor Gegevensbescherming (Garante). ITALY · ·Art. 5, 6, 7 +6 Apr 29, 2025
€12,000 NOVATES ALIMENTACIÓN MADRID, S.L.: Insufficient technical and organisational measures to ensure information security The Spanish DPA imposed a fine on NOVATES ALIMENTACIÓN MADRID, S.L. The controller used surveillance cameras without implementing the necessary technical and organizational… SPAIN · ·Art. 32 Apr 22, 2025
€4,000 AEPD: Continuous workplace audio recording violates GDPR data minimisation principle On 22 April 2025, a data subject lodged a complaint with the DPA against BODENSE ESTRUCTURAS Y CALDELERÍA, S.L., the controller. The data subject claimed that the controller had… Spain ·Art. 5 Apr 22, 2025
€6,000 LÃSER METALPRINT 3D, S.L.: Insufficient data processing agreement The Spanish DPA imposed a fine on LÃSER METALPRINT 3D, S.L. The controller hired a third company to install and maintain a surveillance system. The controller and the hired… SPAIN · ·Art. 28 Apr 14, 2025
€70,300 DPP Law Ltd.: Insufficient technical and organizational measures to ensure information security. ⇄ Boete van €70.300 - Informatiecommissaris (ICO). UNITED KINGDOM · ·Art. 5, 32, 33 Apr 14, 2025
€8,000 Eastern Parma Apennine Mountain Community: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 8,000 on the Eastern Parma Apennine Mountain Community. The controller had set up video surveillance in front of a police station, that… ITALY · ·Art. 5, 6, 12 +2 Apr 10, 2025