Content type · 869 documents in this view · 3,842 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities 3614 Processing 2657 Personal Data 2429 Controllers 2039 Processing Agreement 1116 Security 1025 Supervision 869 Healthcare 624 Public Authority 577 Law Enforcement 576 Monitoring 552 Consent 510
NOK 205,000 Datatilsynet ordered Lab Pharma AS to erase influencer's personal data used after Lab Pharma AS, the controller, is a Norwegian manufacturer of dietary supplements which markets and sells its products online. In 2016, an influencer, the data subject, entered… Norway · ·Art. 6, 17, 21 +1 Aug 12, 2026
€1,282 IP-RS · 0609-41/2026/7 A company (the controller) used a service provider (the processor) to store personal data, manage a database, and provide technical support and maintenance on its behalf. A legal… Slovenia ·Art. 28
Finnish DPA finds 12-year retention of rental applicant data violates minimisation The DPA began investigating the storage periods of the personal data of housing applicants (the data subjects) contained in rental housing applications during a previous… TSV/1319/2025 ·Finland · Aug 7, 2026
€1,000 Leontinoi Società Cooperativa Sociale: Insufficient fulfilment of data subjects rights The Italian Data Protection Authority (Garante) fined Leontinoi Società Cooperativa Sociale €1,000 for insufficient fulfilment of data subjects' rights, citing violations of… Italy · ·Art. 12, 15, 31 Aug 6, 2026
€45,000 AMATO BESTSELLER S.R.L: Non-compliance with general data processing principles The Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) fined AMATO BESTSELLER S.R.L €45,000 for non-compliance with general data processing principles.… Romania · ·Art. 5, 9, 14 +1 Aug 6, 2026
€15,000 HOMELUX S.R.L: Non-compliance with general data processing principles The Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) fined HOMELUX S.R.L €15,000 for non-compliance with general data processing principles,… Romania · ·Art. 32 Jul 31, 2026
€500 SIA K4K: Insufficient cooperation with supervisory authority Latvia · ·Art. 31, 58, 83 Jul 31, 2026
€3,500 A bailiff (the controller) appointed by a district court notified the DPA of a data breach in April 2023 According to the data breach notification, the controller also held the position of data protection officer within the bailiff's office from January 2020 to September 2025.… DKN.5131.24.2025 ·Poland · Jul 29, 2026
RON 523,900 Fine against Orange Romania SA of July 17, 2026 The investigation was initiated after Orange Romania SA (the controller) notified the Romanian DPA (ANSPDCP) of a personal data breach pursuant to Article 33 GDPR, related to its… ·Art. 25, 32 Jul 29, 2026
€200,000 15/2026 The Ministry of Social Cohesion and Family (the controller), and the Hellenic Local Development and Local Government Company (the processor) notified the DPA that information… Greece · ·Art. 5, 28, 32 Jul 28, 2026
HmbBfDI (Hamburg) - Einstellung Gerichtsverfahren in Sachen Videmo 360 Following the 2017 G20 summit in Hamburg, the Hamburg Police used automated facial recognition software to analyze video footage. A template database containing mathematical… Einstellung Gerichtsverfahren in Sachen Videmo 360 ·Germany
RON 30,000 Fine against There's an AI for that S.R.L In October 2025, the Romanian National Supervisory Authority for Personal Data Processing (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal –… Romania · ·Art. 4
€9.5M TIM S.p.A.: Non-compliance with general data processing principles The Italian Data Protection Authority (Garante) fined TIM S.p.A. €9,516,000 for violations of multiple GDPR provisions, including Articles 5, 6, 7, 15, 22, 24, 25, 28, and 32,… Italy · ·Art. 5, 6, 7 +6 Jul 23, 2026
€8,000 Municipality of Terralba: Insufficient legal basis for data processing The Italian Data Protection Authority (Garante) fined the Municipality of Terralba €8,000 for processing personal data without a sufficient legal basis. The Garante found that the… Italy · ·Art. 5, 6, 24 +2 Jul 23, 2026
€6,500 Top Secrert Investigazioni e sicurezza s.r.l.: Non-compliance with general data processing principles The Italian Data Protection Authority (Garante) fined Top Secrert Investigazioni e sicurezza s.r.l. €6,500 for violating the general data processing principles under Article… Italy · ·Art. 5, 13 Jul 23, 2026
€10,000 Monza and Brianza Local Education Authority: Insufficient legal basis for data processing The Italian Data Protection Authority (Garante) fined the Monza and Brianza Local Education Authority €10,000 for failing to establish a sufficient legal basis for data processing… Italy · ·Art. 5, 6 Jul 23, 2026
€30,000 Emiglia-Romagna Regional Employment Agency: Insufficient legal basis for data processing The Italian Data Protection Authority (Garante) fined the Emiglia-Romagna Regional Employment Agency €30,000 for violations of Articles 5, 6, and 9 of the GDPR concerning an… Italy · ·Art. 5, 6, 9 Jul 23, 2026
HUF 2M NAIH-11443-3/2026 The DPA initiated an investigation into the GDPR compliance of an online store (the controller) processing the data of its customers (the data subjects) in April 2025. The… Hungary ·Art. 12, 13 Jul 22, 2026
€90,000 AEPD · PS-00159-2025 On 13 December 2024, the DPA received a complaint against ACVIL Aparcamientos, S.L.U., the controller, concerning a request for video surveillance footage from a car park. The… Spain ·Art. 14, 15
€20,000 Garante · 471/2026 The provincial Health Authority of Enna (the controller) published a resolution that contained the personal data of a data subject (specifically related to their judicial… Italy ·Art. 5, 6, 10 +1 Jul 18, 2026
APDCAT sanctions Madremanya City Council for inadequate redaction of sensitive data in On 8 May 2025, Madremanya City Council, acting as controller, published on its notice board two administrative acts concerning a tender procedure for the award of a social housing… PS-0036/2026 ·Spain ·Art. 5, 31 Jul 17, 2026
€1M CNIL · SAN-2022-011 The controller is a limited liability company whose business is the supply and production of electricity and gas in France. Several data subjects sent complainants to the French… France ·Art. 12, 14, 15 +2
€100,000 Orange Romania SA: Insufficient technical and organisational measures to ensure information security The Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) fined Orange Romania SA €100,000 for failing to implement sufficient technical and… ·Art. 25, 32 ·Insufficient technical and organisational measures to ensure information security Jul 17, 2026
€200,000 Alkora, S.A., the controller, is an insurance broker that was victim of a ransomware attack The controller notified the DPA of a personal data breach after a ransomware attack affected its servers, databases, email systems and employee devices. The controller first… PS-00020-2025 ·Spain · Jul 16, 2026
AEPD · EXP202102529 A student handed in a complaint against the University of Navarra because they asked the students to fill in their vaccination status. The complainant understands this as a breach… EXP202102529 ·Spain ·Art. 4, 5, 6 +3
€2M Garante fines Lusha Systems Inc. over unauthorized B2B contact database Lusha Systems Inc. (the controller) operated a subscription-based platform that provided professional contact information through a business-to-business (B2B) database. It was a… Italy ·Art. 3, 5, 6 +2 Jul 14, 2026
€120,000 NIER Ingeriegna S.p.A. SB: Insufficient technical and organisational measures to ensure information security The Italian Data Protection Authority (Garante) fined NIER Ingegneria S.p.A. SB €120,000 for failing to implement adequate technical and organizational measures to ensure… Italy · ·Art. 5, 32 Jul 14, 2026
€6,000 Municipality of Rieti: Non-compliance with general data processing principles The Italian Data Protection Authority (Garante) fined the Municipality of Rieti €6,000 for violations of general data processing principles under the GDPR. The enforcement action… Italy · ·Art. 5, 12, 24 +3 Jul 14, 2026
€57,839 Fine against Ascendex Technology SRL The Romanian DPA (ANSPDCP) launched an investigation into the cryptocurrency exchange platform Ascendex Technology SRL (the controller). The DPA was notified by the French DPA… Romania · ·Art. 4, 12, 17 +1
€25,000 General Hospital of Thessaloniki: Insufficient technical and organisational measures to ensure information security The Hellenic Data Protection Authority (HDPA) fined the General Hospital of Thessaloniki €25,000 for failing to implement adequate technical and organizational measures to ensure… Greece · ·Art. 5, 12, 13 +4 Jul 7, 2026
€158,000 Garante · 487/2026 Character Technologies, Inc (the controller) is a company established in the US that operates the site Character.AI. Character.AI is a generative AI service that allows users to… Italy ·Art. 3, 5, 12 +7 Jul 3, 2026
€1.4M EstEnergy S.p.A.: Non-compliance with general data processing principles The Italian Data Protection Authority (Garante) fined EstEnergy S.p.A. €1,400,000 for violations of general data processing principles under Article 5(1) of the GDPR, alongside… Italy · ·Art. 5, 12, 13 +3 Jul 3, 2026
€23,750 Società Editoriale Il Fatto S.p.A.: Insufficient legal basis for data processing The Italian Data Protection Authority (Garante) fined Società Editoriale Il Fatto S.p.A. €23,750 for processing personal data without a sufficient legal basis, in violation of… Italy · ·Art. 5 Jul 3, 2026
€10,000 Giuliano Isontina University Health Authority: Insufficient technical and organisational measures to ensure information security The Italian Data Protection Authority (Garante) fined the Giuliano Isontina University Health Authority €10,000 for failing to implement adequate technical and organizational… Italy · ·Art. 5, 9, 25 +1 Jul 3, 2026
€5.8M Hera Comm S.p.A.: Non-compliance with general data processing principles The Italian Data Protection Authority (Garante) fined Hera Comm S.p.A. €5,800,000 for violations of the general data processing principles under Article 5 of the GDPR, alongside… Italy · ·Art. 5, 12, 13 +3 Jul 3, 2026
€2,000 Municipality of Villaputzu: Insufficient legal basis for data processing The Italian Data Protection Authority (Garante) fined the Municipality of Villaputzu €2,000 for processing personal data without a sufficient legal basis. The enforcement action… Italy · ·Art. 5, 6 Jul 3, 2026
RON 26,172 The Romanian DPA (ANSPDCP) launched an investigation into a bank, Banca Transilvania S.A (the controller), following a data subject’s complaint. The data subject claimed that their personal data associated with their bank account had been processed without their… 02/07/2026 ·Romania ·Art. 32
€120,000 Experian Italia S.p.A.: Non-compliance with general data processing principles The Italian Data Protection Authority (Garante) fined Experian Italia S.p.A. €120,000 for violating GDPR Articles 5(1)(a) and (c), 12, 15, and 25, concerning non-compliance with… Italy · ·Art. 5, 12, 15 +1 Jul 3, 2026
IMY-2024-2904 The supervisory authority launched an investigation into the border control unit of the national police authority (the controller) at Arlanda Airport concerning the processing of… IMY-2024-2904 ·Sweden ·Art. 13 Jul 3, 2026
€15,000 University of Pisa: Insufficient technical and organisational measures to ensure information security The Italian Data Protection Authority (Garante) fined the University of Pisa €15,000 for failing to implement adequate technical and organizational measures to ensure information… Italy · ·Art. 5, 6, 25 +1 Jul 3, 2026
€158,000 Character Technologies Inc.: Non-compliance with general data processing principles The Italian Data Protection Authority (Garante) fined Character Technologies Inc. €158,000 for violations of multiple GDPR provisions, including Article 5(2) on general data… Italy · ·Art. 5, 12, 13 +5 Jul 3, 2026
€5,000 Banca Transilvania S.A.: Insufficient technical and organisational measures to ensure information security The Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) fined Banca Transilvania S.A. €5,000 on July 2, 2026, for failing to implement sufficient… Romania · ·Art. 32 Jul 2, 2026
€1,000 SIA 4YOU MEBELES: Insufficient cooperation with supervisory authority The Latvian Data State Inspectorate (DSI) fined SIA 4YOU MEBELES €1,000 for insufficient cooperation with the supervisory authority. The case involved the company's failure to… Latvia · ·Art. 31, 58, 83 Jul 2, 2026
€11,000 Ascendex Technology SRL: Insufficient fulfilment of data subjects rights The Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) fined Ascendex Technology SRL €11,000 for insufficient fulfillment of data subjects' rights. The… Romania · ·Art. 12, 17 Jul 1, 2026
€450,000 VDAI fines medical company €450,000 for inadequate security measures in data breaches Two medical companies (the controllers) had fallen victim to data breaches where a third party had gained access to their internal systems containing both health data and other… Lithuania ·Art. 5, 24 Jun 19, 2026
€500 Estonian DPA: website republishing public authority documents independently liable under The controller was a private individual who operated a website that collected documents from public authorities’ document registers and made them easier to search and access… Estonia · ·Art. 5, 6, 9 +2 Jun 19, 2026
€90,000 Acquirente Unico S.p.A.: Insufficient fulfilment of data subjects rights The Italian Data Protection Authority (Garante) fined Acquirente Unio S.p.A. €90,000 for insufficient fulfilment of data subjects' rights under GDPR Articles 12, 16, and 28. The… Italy · ·Art. 12, 16, 28 Jun 18, 2026
€5,000 Garante · 457/2026 The Municipality of Vasto (the controller) implemented a dedicated photo and video system for the purpose of detecting violations of the national provisions on traffic safety. A… Italy ·Art. 5, 6, 12 +2 Jun 18, 2026
€6,600 Garante · 462/2026 The case involves a worker (the data subject), his former employer (the controller), and the staffing agency that had provided the company with the worker. In late 2023 the data… Italy ·Art. 2, 4, 5 +2 Jun 18, 2026
€460,000 Garante · 476/2026 Two former employees (the data subjects) of Piaggio (the controller) were dismissed for just cause in March 2023. Following the termination of their employment, they asked the… Italy ·Art. 5, 6, 12 +2 Jun 18, 2026