Content type · 2,549 documents in this view · 3,634 in total

Enforcement

Regulatory actions, fines, warnings, and enforcement decisions

🇪🇺 EU 🇳🇱 NL
Enforcement dashboard — fines by country, authority and article →
Filtering by Topic Clear filter Supervisory Authorities3564 Processing Agreement2800 Processing2632 Personal Data2596 Controllers2211 Data Controller1862 Law Enforcement1540 IP Address1282 Security1024 Supervision879 Monitoring545 Consent518
51–100 of 2,549 sort newestlargest fineoldest
APD/GBA: Controller failed to provide copies of service sheets for GDPR access request The data subject was a technician employed by the controller. The controller used weekly handwritten service sheets as a system for recording working time. These sheets contained… 97/2026 ·Belgium ·Art. 12, 15 Right of Access Procedures Accuracy Right of Access May 6, 2026
€2,802 Slovenian DPA fines processor €2,802 for failing to patch known vulnerability (Art. 32) A processor was contracted by a company (the controller) to maintain an online store, fix errors, and provide support. This included ensuring that the controller had installed the… Slovenia ·IP ·Art. 32 Security Encryption Controllers May 1, 2026
HUF 10M NAIH fines online store HUF 10M for missing and inadequate privacy notice The DPA initiated an investigation into the processing of the personal data of customers (the data subjects) by the operator of an online store (the controller) in April 2025. The… Hungary ·Art. 5, 12, 13 Personal Data Accountability Controllers Apr 30, 2026
€2,500 BLUE PROJECTS INDUSTRIES S.R.L.: Insufficient technical and organisational measures to ensure information security Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) fined BLUE PROJECTS INDUSTRIES S.R.L. €2,500 on 2026-04-30 for: Insufficient technical and… Romania ·ANSPDCP ·Art. 32 Security Personal Data Supervisory Authorities Apr 30, 2026
€35,000 Crowd Entertainment Ltd: Insufficient legal basis for data processing Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) fined Crowd Entertainment Ltd €35,000 on 2026-04-28 for: Insufficient legal basis for data… Romania ·ANSPDCP ·Art. 5 Personal Data Supervisory Authorities Telecommunications Apr 28, 2026
€240 Posada del León de Oro: Non-compliance with general data processing principles Spanish Data Protection Authority (aepd) fined Posada del León de Oro €240 on 2026-04-28 for: Non-compliance with general data processing principles. Spain ·aepd ·Art. 5, 13 IP Address Employees Processing Apr 28, 2026
€4,000 SIPHONE 2020, S.L.: Insufficient legal basis for data processing Spanish Data Protection Authority (aepd) fined SIPHONE 2020, S.L. €4,000 on 2026-04-28 for: Insufficient legal basis for data processing. Spain ·aepd ·Art. 6, 13 IP Address Employees Processing Apr 28, 2026
€8,500 Accountancy Firm: Insufficient legal basis for data processing Belgian Data Protection Authority (APD) fined Accountancy Firm €8,500 on 2026-04-23 for: Insufficient legal basis for data processing. Belgium ·APD ·Art. 5, 6, 12 +1 Employees Processing Supervisory Authorities Apr 23, 2026
€6.6M Poste Italiane S.p.a.: Non-compliance with general data processing principles Italian Data Protection Authority (Garante) fined Poste Italiane S.p.a. €6,624,000 on 2026-04-17 for: Non-compliance with general data processing principles. Italy ·Garante ·Art. 5, 6, 13 +4 IP Address Insurance Processing Apr 17, 2026
€6,000 Comune di Campo Calabro: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Comune di Campo Calabro €6,000 on 2026-04-17 for: Insufficient legal basis for data processing. Italy ·Garante ·Art. 5, 6 Employees Processing Supervisory Authorities Apr 17, 2026
€2,000 Business Owner: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Business Owner €2,000 on 2026-04-17 for: Insufficient legal basis for data processing. Italy ·Garante ·Art. 5, 13, 32 Processing Supervisory Authorities Apr 17, 2026
€5,000 Framos Italia s.r.l.: Non-compliance with general data processing principles Italian Data Protection Authority (Garante) fined Framos Italia s.r.l. €5,000 on 2026-04-17 for: Non-compliance with general data processing principles. Italy ·Garante ·Art. 5, 6, 12 +3 IP Address Employees Processing Apr 17, 2026
€2,000 Io e te s.r.l.s.: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Io e te s.r.l.s. €2,000 on 2026-04-17 for: Insufficient legal basis for data processing. Italy ·Garante ·Art. 5, 13, 88 Processing Supervisory Authorities Apr 17, 2026
€5.9M Postepay S.p.a.: Non-compliance with general data processing principles Italian Data Protection Authority (Garante) fined Postepay S.p.a. €5,877,000 on 2026-04-17 for: Non-compliance with general data processing principles. Italy ·Garante ·Art. 5, 6, 13 +4 IP Address Insurance Processing Apr 17, 2026
AKI (Estonia) - No. 2.1-1/24/397-890-38 OÜ Dr Mõttus Hambaravi, the controller, is a Dental Clinic. On March 2024, the DPA received a complaint from a data subject regarding the fact that the controller had failed to… No. 2.1-1/24/397-890-38 ·Art. 4, 5, 6 +8 Controllers Processors Data Controller Apr 16, 2026
€6,600 Utility Company: Insufficient legal basis for data processing Slovenian Supervisory Authority (Informacijski pooblaščenec) fined Utility Company €6,600 on 2026-04-15 for: Insufficient legal basis for data processing. Slovenia ·Art. 5 ·Insufficient legal basis for data processing IP Address Supervisory Authorities Processing Apr 15, 2026
€2,415 UODO (Poland) - DKN.5131.7.2022 An electricity sales company (the controller) had outsourced some of its operations to two processors and one sub-processor. Employees of the sub-processor had used a smartphone… Art. 5, 24, 25 +2 Processors Data Breaches Notification Obligation Apr 13, 2026
€2,500 BLUE PROJECTS S.R.L.: Insufficient technical and organisational measures to ensure information security Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) fined BLUE PROJECTS S.R.L. €2,500 on 2026-04-03 for: Insufficient technical and organisational… Romania ·ANSPDCP ·Art. 32 Security Personal Data Supervisory Authorities Apr 3, 2026
€100M Ridetech International B.V.: Insufficient legal basis for data processing Dutch Supervisory Authority for Data Protection (AP) fined Ridetech International B.V. €100,000,000 on 2026-04-01 for: Insufficient legal basis for data processing. The Netherlands ·AP ·Art. 5, 44, 46 Processing Personal Data Supervisory Authorities Apr 1, 2026
€2,000 Business Owner: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Business Owner €2,000 on 2026-03-26 for: Insufficient legal basis for data processing. Italy ·Garante ·Art. 5, 13, 88 Processing Supervisory Authorities Mar 26, 2026
€2,500 Comune di Cassino: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Comune di Cassino €2,500 on 2026-03-26 for: Insufficient legal basis for data processing. Italy ·Garante ·Art. 5, 6 Education Processing Public Authority Mar 26, 2026
€3,000 Piacenza Bar Association: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Piacenza Bar Association €3,000 on 2026-03-26 for: Insufficient legal basis for data processing. Italy ·Garante ·Art. 5, 6 Education Public Authority Processing Mar 26, 2026
€1,000 Euro Bangla Minimarket in Jesi: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Euro Bangla Minimarket in Jesi €1,000 on 2026-03-26 for: Insufficient legal basis for data processing. Italy ·Garante ·Art. 5, 88 Employees Processing Supervisory Authorities Mar 26, 2026
€5,000 Municipality: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Municipality €5,000 on 2026-03-26 for: Insufficient legal basis for data processing. Italy ·Garante ·Art. 5, 6, 9 IP Address Employees Processing Mar 26, 2026
€96,000 Eni S.p.A.: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Eni S.p.A. €96,000 on 2026-03-26 for: Insufficient legal basis for data processing. Italy ·Garante ·Art. 5, 6 Processing Supervisory Authorities Mar 26, 2026
€2,000 Copacabana s.r.l.: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Copacabana s.r.l. €2,000 on 2026-03-26 for: Insufficient legal basis for data processing. Italy ·Garante ·Art. 5, 13, 88 Processing Supervisory Authorities Healthcare Mar 26, 2026
€3,000 Municipality: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Municipality €3,000 on 2026-03-26 for: Insufficient legal basis for data processing. Italy ·Garante ·Art. 5, 6, 9 IP Address Employees Processing Mar 26, 2026
€125,000 RENAULT COMMERCIAL ROUMANIE S.R.L.: Insufficient technical and organisational measures to ensure information security Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) fined RENAULT COMMERCIAL ROUMANIE S.R.L. €125,000 on 2026-03-25 for: Insufficient technical and… Romania ·ANSPDCP ·Art. 28, 32 Security Personal Data Supervisory Authorities Mar 25, 2026
€6,300 Advertising Agency: Insufficient legal basis for data processing Austrian Data Protection Authority (dsb) fined Advertising Agency €6,300 on 2026-03-24 for: Insufficient legal basis for data processing. Austria ·dsb ·Art. 5, 6, 13 Direct Marketing Processing Supervisory Authorities Mar 24, 2026
€4,000 ING Bank NV Amsterdam – Sucursala București S.A.: Insufficient technical and organisational measures to ensure information security Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) fined ING Bank NV Amsterdam – Sucursala București S.A. €4,000 on 2026-03-23 for: Insufficient… Romania ·ANSPDCP ·Art. 32 Security Supervisory Authorities Insurance Mar 23, 2026
€3,000 Public and Private Domain SA: Insufficient legal basis for data processing Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) fined Public and Private Domain SA €3,000 on 2026-03-20 for: Insufficient legal basis for data… Romania ·ANSPDCP ·Art. 5, 6, 12 +1 Personal Data Employees Processing Mar 20, 2026
Austrian DSB rules 360-degree feedback unlawful without specific works agreement The data subject was employed by an Austrian stock corporation (the controller) from August 2018 to June 2025. They worked as a manager in the controller’s finance department,… 2025-0.960.016 ·Austria ·Art. 6, 88 Legitimate Interest Personal Data Employees Mar 20, 2026
€3,000 Domeniul Public și Privat SA: Insufficient legal basis for data processing Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) fined Domeniul Public și Privat SA €3,000 on 2026-03-20 for: Insufficient legal basis for data… Romania ·ANSPDCP ·Art. 5, 6, 12 +1 Education Personal Data Public Authority Mar 20, 2026
€18,000 RAMÓN GRAU, S.L.: Insufficient legal basis for data processing Spanish Data Protection Authority (aepd) fined RAMÓN GRAU, S.L. €18,000 on 2026-03-13 for: Insufficient legal basis for data processing. Spain ·aepd ·Art. 6, 13 Employees Processing Supervisory Authorities Mar 13, 2026
€40,000 La7 S.p.A.: Non-compliance with general data processing principles Italian Data Protection Authority (Garante) fined La7 S.p.A. €40,000 on 2026-03-12 for: Non-compliance with general data processing principles. Italy ·Garante ·Art. 5 IP Address Telecommunications Processing Mar 12, 2026
€2,000 Comune di Sutri: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Comune di Sutri €2,000 on 2026-03-12 for: Insufficient legal basis for data processing. Italy ·Garante ·Art. 5, 6 Education Public Authority Supervisory Authorities Mar 12, 2026
€563,052 Enel Energia S.p.A.: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Enel Energia S.p.A. €563,052 on 2026-03-12 for: Insufficient legal basis for data processing. Italy ·Garante ·Art. 5, 6, 7 +2 Processing Supervisory Authorities Mar 12, 2026
€6,000 CUMACA MOTOR, S.L.: Insufficient legal basis for data processing Spanish Data Protection Authority (aepd) fined CUMACA MOTOR, S.L. €6,000 on 2026-03-10 for: Insufficient legal basis for data processing. Spain ·aepd ·Art. 5 Processing Supervisory Authorities Mar 10, 2026
€8,000 Altex Romania S.R.L.: Insufficient cooperation with supervisory authority Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) fined Altex Romania S.R.L. €8,000 on 2026-03-05 for: Insufficient cooperation with supervisory… ANSPDCP ·Art. 58 ·Insufficient cooperation with supervisory authority Supervisory Authorities Supervision Personal Data Mar 5, 2026
€200,000 ARES CAPITAL, S.A.: Insufficient legal basis for data processing Spanish Data Protection Authority (aepd) fined ARES CAPITAL, S.A. €200,000 on 2026-03-04 for: Insufficient legal basis for data processing. Spain ·aepd ·Art. 5, 6, 13 Employees Processing Supervisory Authorities Mar 4, 2026
€8,500 HIGHCLIFFE ESTATES MARBELLA, S.L.: Insufficient legal basis for data processing Spanish Data Protection Authority (aepd) fined HIGHCLIFFE ESTATES MARBELLA, S.L. €8,500 on 2026-03-02 for: Insufficient legal basis for data processing. Spain ·aepd ·Art. 6 Processing Supervisory Authorities Mar 2, 2026
€900 ORNITOLÓGICA DE ANDALUCÍA FOA: Non-compliance with general data processing principles Spanish Data Protection Authority (aepd) fined ORNITOLÓGICA DE ANDALUCÍA FOA €900 on 2026-03-02 for: Non-compliance with general data processing principles. Spain ·aepd ·Art. 5 IP Address Processing Supervisory Authorities Mar 2, 2026
€12,000 HOLY MARY CATHOLIC SCHOOL, S.L.: Insufficient legal basis for data processing Spanish Data Protection Authority (aepd) fined HOLY MARY CATHOLIC SCHOOL, S.L. €12,000 on 2026-03-01 for: Insufficient legal basis for data processing. Spain ·aepd ·Art. 5, 6, 35 Education Processing Public Authority Mar 1, 2026
€1,000 Spain DPA: Non-compliance with general data processing principles Spanish Data Protection Authority (aepd) fined an unnamed party €1,000 on 2026-03-01 for: Non-compliance with general data processing principles. aepd ·Art. 5 ·Non-compliance with general data processing principles IP Address Processing Agreement Supervisory Authorities Mar 1, 2026
€15,000 Ministero delle Imprese e del Made in Italy: Insufficient data processing agreement Italian Data Protection Authority (Garante) fined Ministero delle Imprese e del Made in Italy €15,000 on 2026-02-26 for: Insufficient data processing agreement. Garante ·Art. 28 ·Insufficient data processing agreement Processing Agreement Public Authority Education Feb 26, 2026
€30,000 S.M. Trattamento Acqua di XX: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined S.M. Trattamento Acqua di XX €30,000 on 2026-02-26 for: Insufficient legal basis for data processing. Italy ·Garante ·Art. 4, 5, 6 +6 Processing Telecommunications Supervisory Authorities Feb 26, 2026
€5,000 Conservatory: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Conservatory €5,000 on 2026-02-26 for: Insufficient legal basis for data processing. Italy ·Garante ·Art. 5, 6, 10 Education Processing Public Authority Feb 26, 2026
€15,000 Flamel S.r.l.: Non-compliance with general data processing principles Italian Data Protection Authority (Garante) fined Flamel S.r.l. €15,000 on 2026-02-26 for: Non-compliance with general data processing principles. Italy ·Garante ·Art. 8, 11, 25 +3 IP Address Processing Telecommunications Feb 26, 2026
€15,000 Ministero delle Imprese e del Made in Italy: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Ministero delle Imprese e del Made in Italy €15,000 on 2026-02-26 for: Insufficient legal basis for data processing. Garante ·Art. 5, 6, 9 +1 ·Insufficient legal basis for data processing Education Public Authority Public Sector Feb 26, 2026
€12,000 Ministero dell’Economia e delle Finanze: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Ministero dell’Economia e delle Finanze €12,000 on 2026-02-26 for: Insufficient legal basis for data processing. Italy ·Garante ·Art. 5, 6, 28 Public Authority Education Processing Feb 26, 2026