Content type · 1,025 documents in this view · 3,842 in total

Enforcement

Regulatory actions, fines, warnings, and enforcement decisions

Enforcement dashboard — fines by country, authority and article →

Filtering by Topic Clear filter Supervisory Authorities 3614 Processing 2657 Personal Data 2429 Controllers 2039 Processing Agreement 1116 Security 1025 Supervision 869 Healthcare 624 Public Authority 577 Law Enforcement 576 Monitoring 552 Consent 510

51–100 of 1,025 sort newest largest fine oldest

€100,000 Orange Romania SA: Insufficient technical and organisational measures to ensure information security The Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) fined Orange Romania SA €100,000 for failing to implement sufficient technical and… ANSPDCP ·Art. 25, 32 ·Insufficient technical and organisational measures to ensure information security Privacy by Design Security Privacy by Default Jul 17, 2026

AEPD · EXP202102529 A student handed in a complaint against the University of Navarra because they asked the students to fill in their vaccination status. The complainant understands this as a breach… EXP202102529 ·Spain ·Art. 4, 5, 6 +3 Consent Personal Data Healthcare

€200,000 Alkora, S.A., the controller, is an insurance broker that was victim of a ransomware attack The controller notified the DPA of a personal data breach after a ransomware attack affected its servers, databases, email systems and employee devices. The controller first… PS-00020-2025 ·Spain ·AEPD Integrity and Confidentiality Principle Data Breaches Notification Obligation Jul 16, 2026

€120,000 NIER Ingeriegna S.p.A. SB: Insufficient technical and organisational measures to ensure information security The Italian Data Protection Authority (Garante) fined NIER Ingegneria S.p.A. SB €120,000 for failing to implement adequate technical and organizational measures to ensure… Italy ·Garante ·Art. 5, 32 Security Supervision Insurance Jul 14, 2026

€1,198 A company (the controller) operates an online store An employee of the controller used a pirated and unlicensed software when creating the website. This software contained malicious code, which allowed a third person to access the… 0609-36/2026/7 ·Slovenia ·IP-RS Controllers Personal Data Data Breaches Jul 8, 2026

€25,000 General Hospital of Thessaloniki: Insufficient technical and organisational measures to ensure information security The Hellenic Data Protection Authority (HDPA) fined the General Hospital of Thessaloniki €25,000 for failing to implement adequate technical and organizational measures to ensure… Greece ·HDPA ·Art. 5, 12, 13 +4 Notification Obligation Data Breaches Supervisory Authorities Jul 7, 2026

IMY-2024-2904 The supervisory authority launched an investigation into the border control unit of the national police authority (the controller) at Arlanda Airport concerning the processing of… IMY-2024-2904 ·Sweden ·Art. 13 Personal Data Supervision Information Provision Modalities and Communication Methods Jul 3, 2026

€15,000 University of Pisa: Insufficient technical and organisational measures to ensure information security The Italian Data Protection Authority (Garante) fined the University of Pisa €15,000 for failing to implement adequate technical and organizational measures to ensure information… Italy ·Garante ·Art. 5, 6, 25 +1 Security Personal Data Public Authority Jul 3, 2026

€158,000 Garante · 487/2026 Character Technologies, Inc (the controller) is a company established in the US that operates the site Character.AI. Character.AI is a generative AI service that allows users to… Italy ·Art. 3, 5, 12 +7 Personal Data Integrity and Confidentiality Principle Controllers Jul 3, 2026

€10,000 Giuliano Isontina University Health Authority: Insufficient technical and organisational measures to ensure information security The Italian Data Protection Authority (Garante) fined the Giuliano Isontina University Health Authority €10,000 for failing to implement adequate technical and organizational… Italy ·Garante ·Art. 5, 9, 25 +1 Security Healthcare Types of Special Categories of Personal Data Jul 3, 2026

RON 26,172 The Romanian DPA (ANSPDCP) launched an investigation into a bank, Banca Transilvania S.A (the controller), following a data subject’s complaint. The data subject claimed that their personal data associated with their bank account had been processed without their… 02/07/2026 ·Romania ·Art. 32 Data Breaches Personal Data Security

€5,000 Banca Transilvania S.A.: Insufficient technical and organisational measures to ensure information security The Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) fined Banca Transilvania S.A. €5,000 on July 2, 2026, for failing to implement sufficient… Romania ·ANSPDCP ·Art. 32 Security Personal Data Supervision Jul 2, 2026

Persónuvernd (Island) - 2025010358 The data subject was an employee of the enterprise BL ehf (the controller). When she started working there, she was provided with a computer set up by the controller’s IT… 2025010358 ·Iceland ·Art. 5, 32 Integrity and Confidentiality Principle Personal Data Monitoring Jul 1, 2026

€450,000 InMedica UAB: Insufficient technical and organisational measures to ensure information security The Lithuanian Data Protection Authority (VDAI) fined InMedica UAB €450,000 for failing to implement sufficient technical and organizational measures to ensure information… Lithuania ·VDAI ·Art. 5, 24, 32 Integrity and Confidentiality Principle Security Personal Data Jun 19, 2026

€450,000 VDAI fines medical company €450,000 for inadequate security measures in data breaches Two medical companies (the controllers) had fallen victim to data breaches where a third party had gained access to their internal systems containing both health data and other… Lithuania ·Art. 5, 24 Data Breaches Security Integrity and Confidentiality Principle Jun 19, 2026

€500 Estonian DPA: website republishing public authority documents independently liable under The controller was a private individual who operated a website that collected documents from public authorities’ document registers and made them easier to search and access… Estonia ·AKI ·Art. 5, 6, 9 +2 Legitimate Interest Personal Data Supervisory Authorities Jun 19, 2026

€10,000 Altex Romania S.R.L: Insufficient technical and organisational measures to ensure information security The Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) fined Altex Romania S.R.L. €10,000 for failing to implement sufficient technical and… ANSPDCP ·Art. 32, 33, 34 ·Insufficient technical and organisational measures to ensure information security Notification Obligation Data Breaches Supervision Jun 18, 2026

€10,000 Docplanner Italy S.r.l.: Insufficient technical and organisational measures to ensure information security The Italian Data Protection Authority (Garante) fined Docplanner Italy S.r.l. €10,000 for failing to implement sufficient technical and organizational measures to ensure… Garante ·Art. 5, 32 ·Insufficient technical and organisational measures to ensure information security Security Personal Data Telecommunications Jun 18, 2026

€2,075 Edizioni Grandangolo di Giuseppe Castaldo: Non-compliance with general data processing principles The Italian Data Protection Authority (Garante) fined Edizioni Grandangolo di Giuseppe Castaldo €2,075 for failing to comply with general data processing principles under Articles… Italy ·Garante ·Art. 5, 12, 13 +4 Notification Obligation Data Breaches Controllers Jun 18, 2026

€2,000 SSG SELECT SOLUTIONS S.R.L: Insufficient technical and organisational measures to ensure information security The Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) fined SSG Select Solutions S.R.L. €2,000 for failing to implement adequate technical and… Romania ·ANSPDCP ·Art. 29, 32 Security Personal Data Supervision Jun 15, 2026

€2,760 UODO fines accounting firm €2,760 for email breach security failures An unauthorised entity gained access to an email account belonging to an employee at an accounting, bookkeeping and tax consulting company (the controller). The account contained… Poland ·Art. 5, 24, 25 +1 Data Breaches Notification Obligation Integrity and Confidentiality Principle Jun 13, 2026

€2,760 Sole trader providing accounting and tax advisory services: Insufficient technical and organisational measures to ensure information security The Polish National Personal Data Protection Office (UODO) fined a sole trader providing accounting and tax advisory services €2,760 for failing to implement sufficient technical… Poland ·UODO ·Art. 5, 25, 32 Integrity and Confidentiality Principle Privacy by Design Security Jun 13, 2026

€5,000 Națională Poșta Română: Insufficient technical and organisational measures to ensure information security Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) fined Națională Poșta Română €5,000 on 2026-06-12 for: Insufficient technical and organisational… Romania ·ANSPDCP ·Art. 32 Security Personal Data Supervision Jun 12, 2026

€300,000 Midlands Regional Hospital Tullamore, County Offaly: Insufficient technical and organisational measures to ensure information security The Data Protection Authority of Ireland fined Midlands Regional Hospital Tullamore €300,000 for failing to implement sufficient technical and organizational measures to ensure… Ireland ·DPC ·Art. 5, 28, 30 +2 Notification Obligation Data Breaches Integrity and Confidentiality Principle Jun 11, 2026

UODO reprimands hospital for inadequate processor oversight and email security failures The email account of an employee at a provincial specialist hospital (the controller) was hacked in December 2021. The compromised email account contained e.g. names, addresses,… DKN.5131.12.2022 ·Poland ·Art. 5, 24, 25 +3 Controllers Processors Security Jun 11, 2026

€4,500 Lecce Local Health Authority: Insufficient technical and organisational measures to ensure information security The Italian Data Protection Authority (Garante) fined the Lecce Local Health Authority €4,500 for failing to implement adequate technical and organizational measures to ensure… Italy ·Garante ·Art. 5, 29, 32 Security Supervision Supervisory Authorities Jun 11, 2026

€1,200 DSB · 2026-0.483.002 The employee, acting as a controller, was working for a rescue and aid organisation that operated a care facility for people with special needs. Between 1 December and 19 December… Austria ·Art. 4, 5, 6 +2 Personal Data IP Address Health Data Jun 9, 2026

€880,000 Greek HDPA sanctions DEI for unsolicited promotional calls via processors The Greek DPA (HDPA) received twelve complaints filed against DEI, the Greek Public Power Corporation, (the controller) from telephone subscribers (data subjects) regarding the… Greece ·Art. 5, 28, 29 +1 Controllers Processors Direct Marketing Jun 2, 2026

€23,540 Minister of Justice: Insufficient technical and organisational measures to ensure information security Polish National Personal Data Protection Office (UODO) fined Minister of Justice €23,540 on 2026-06-02 for: Insufficient technical and organisational measures to ensure… Poland ·UODO ·Art. 32 Security Personal Data Education Jun 2, 2026

€45,000 MEDIATEL Telephone Information Services S.A.: Insufficient technical and organisational measures to ensure information security The Hellenic Data Protection Authority (HDPA) fined MEDIATEL Telephone Information Services S.A. €45,000 for failing to implement sufficient technical and organizational measures… Greece ·HDPA ·Art. 32 Security Supervisory Authorities Jun 2, 2026

€80,000 PRELUDE GROUP E.E.: Insufficient technical and organisational measures to ensure information security The Hellenic Data Protection Authority (HDPA) fined PRELUDE GROUP E.E. €80,000 for failing to implement sufficient technical and organizational measures to ensure information… Greece ·HDPA ·Art. 28, 29, 32 Security Controllers Processors Jun 2, 2026

€90,000 Ypiresia 800 Teleperformance Single Member S.A.: Insufficient technical and organisational measures to ensure information security The Hellenic Data Protection Authority fined Ypiresia 800 Teleperformance Single Member S.A. €90,000 for failing to implement sufficient technical and organizational measures to… Greece ·HDPA ·Art. 5, 32 Security Supervisory Authorities Jun 2, 2026

€20,000 CQS S.A. Customer-Centric Services: Insufficient technical and organisational measures to ensure information security The Hellenic Data Protection Authority (HDPA) fined CQS S.A. Customer-Centric Services €20,000 for failing to implement sufficient technical and organizational measures to ensure… Greece ·HDPA ·Art. 32 Security Supervisory Authorities Jun 2, 2026

€12,000 Unicredit Bank SA: Insufficient technical and organisational measures to ensure information security Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) fined Unicredit Bank SA €12,000 on 2026-05-29 for: Insufficient technical and organisational… Romania ·ANSPDCP ·Art. 32, 33 Supervision Security Personal Data May 29, 2026

€700 Garante · 385/2026 A data subject brought a complaint to the DPA through a non-profit organisation (LILA) against the Italian Red Cross (the controller). While the data subject was hospitalised,… Italy ·Art. 5, 9 Personal Data Retention Period Integrity and Confidentiality Principle May 28, 2026

€2,951 Land-surveying office: Insufficient technical and organisational measures to ensure information security The Polish National Personal Data Protection Office (UODO) fined a land-surveying office €2,951 for failing to implement sufficient technical and organizational measures to ensure… Poland ·UODO ·Art. 28, 32 Controllers Security Processors May 25, 2026

PLN 21,000 DKN.5131.5.2025 A provincial government unit carrying out land consolidation and exchange work (the controller) had entrusted tasks involving the processing of landowners’ (the data subjects’)… Poland ·UODO ·Art. 24, 25, 28 +1 Security Integrity and Confidentiality Principle Controllers May 25, 2026

€4,958 District Governor of Lubartów: Insufficient technical and organisational measures to ensure information security The Polish DPA (UODO) fined the District Governor of Lubartów €4,958 for failing to implement adequate technical and organizational measures to ensure information security, citing… Poland ·UODO ·Art. 5, 25, 28 +1 Privacy by Design Processors Controllers May 25, 2026

€1,400 Elektronikus Egészségügyi Szolgáltatási Tér: Insufficient technical and organisational measures to ensure information security Hungarian National Authority for Data Protection and the Freedom of Information (NAIH) fined Elektronikus Egészségügyi Szolgáltatási Tér €1,400 on 2026-05-20 for: Insufficient… Hungary ·NAIH ·Art. 5, 6, 9 Healthcare Security May 20, 2026

PLN 33,700 DKN.5131.27.2023 A municipal social welfare unit (the controller) processed the personal data of the residents of the municipality (the data subjects), including names, addresses, and information… Poland ·UODO ·Art. 5, 24, 25 +3 Data Breaches Personal Data Integrity and Confidentiality Principle May 19, 2026

€7,950 Social welfare centre: Insufficient technical and organisational measures to ensure information security The Polish National Personal Data Protection Office (UODO) fined a Social welfare centre €7,950 for failing to implement sufficient technical and organizational measures to ensure… Poland ·UODO ·Art. 5, 25, 32 +3 Notification Obligation Privacy by Design Data Breaches May 19, 2026

UODO reprimands mayor for disclosing data subject's data to company without legal basis The data subject requested the mayor of their place of residence (the controller) to provide them scans of contracts the city had concluded with certain companies and invoices… DS.523.2582.2024 ·Poland ·Art. 5, 6 Personal Data Integrity and Confidentiality Principle Right to Restriction May 18, 2026

€15,000 Monaldi-Cotugno-CTO: Non-compliance with general data processing principles The Italian Data Protection Authority (Garante) fined the Monaldi-Cotugno-CTO hospital entity €15,000 for violating general data processing principles under the GDPR. The… Italy ·Garante ·Art. 5, 9, 13 +2 Healthcare Security Types of Special Categories of Personal Data May 14, 2026

HDPA · 12/2026 The complainant, a foreign national, submitted a complaint to the Hellenic DPA through his authorized attorney, seeking his deletion from the Hellenic the National Registry of… 12/2026 ·Greece ·Art. 23 Personal Data Criminal Data Right of Access May 13, 2026

HUF 15M NAIH-450-7-2026 The DPA initiated an investigation into the processing of personal data of customers (the data subjects) by the operator of an online store (the controller) in April 2025. The… Hungary ·Art. 5, 12, 13 Personal Data Fairness & Transparency Storage Limitation May 12, 2026

€277,500 Permanent TSB: Insufficient technical and organisational measures to ensure information security Data Protection Authority of Ireland fined Permanent TSB €277,500 on 2026-05-08 for: Insufficient technical and organisational measures to ensure information security. Ireland ·DPC ·Art. 5, 32, 33 Integrity and Confidentiality Principle Notification Obligation Data Breaches May 8, 2026

€1.1M South Staffordshire Plc: Insufficient technical and organisational measures to ensure information security Information Commissioner (ICO) fined South Staffordshire Plc €1,112,100 on 2026-05-07 for: Insufficient technical and organisational measures to ensure information security. United Kingdom ·ICO ·Art. 5, 32 Security May 7, 2026

The data subject was a technician employed by the controller The controller used weekly handwritten service sheets as a system for recording working time. These sheets contained the technician’s working hours, journeys, services performed… 97/2026 ·Belgium ·APD/GBA Personal Data Right of Access Controllers May 6, 2026

€2,802 IP-RS · 0609-42/2026/7 A processor was contracted by a company (the controller) to maintain an online store, fix errors, and provide support. This included ensuring that the controller had installed the… Slovenia ·Art. 32 Controllers Encryption Processors May 1, 2026

€2,500 BLUE PROJECTS INDUSTRIES S.R.L.: Insufficient technical and organisational measures to ensure information security Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) fined BLUE PROJECTS INDUSTRIES S.R.L. €2,500 on 2026-04-30 for: Insufficient technical and… Romania ·ANSPDCP ·Art. 32 Security Personal Data Supervision Apr 30, 2026