Content type · 3,634 documents

Enforcement

Regulatory actions, fines, warnings, and enforcement decisions

🇪🇺 EU 🇳🇱 NL
Enforcement dashboard — fines by country, authority and article →
Filter by Topic Supervisory Authorities3564 Processing Agreement2800 Processing2632 Personal Data2596 Controllers2211 Data Controller1862 Law Enforcement1540 IP Address1282 Security1024 Supervision879 Monitoring545 Consent518
101–150 of 3,634 sort newestlargest fineoldest
€2,000 Copacabana s.r.l.: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Copacabana s.r.l. €2,000 on 2026-03-26 for: Insufficient legal basis for data processing. Italy ·Garante ·Art. 5, 13, 88 Processing Supervisory Authorities Healthcare Mar 26, 2026
€2,000 Physician: Insufficient fulfilment of data subjects rights Italian Data Protection Authority (Garante) fined Physician €2,000 on 2026-03-26 for: Insufficient fulfilment of data subjects rights. Italy ·Garante ·Art. 13 Healthcare Personal Data Supervisory Authorities Mar 26, 2026
€1,000 Euro Bangla Minimarket in Jesi: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Euro Bangla Minimarket in Jesi €1,000 on 2026-03-26 for: Insufficient legal basis for data processing. Italy ·Garante ·Art. 5, 88 Employees Processing Supervisory Authorities Mar 26, 2026
€3,000 Piacenza Bar Association: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Piacenza Bar Association €3,000 on 2026-03-26 for: Insufficient legal basis for data processing. Italy ·Garante ·Art. 5, 6 Education Public Authority DPIA Mar 26, 2026
€3,000 Municipality: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Municipality €3,000 on 2026-03-26 for: Insufficient legal basis for data processing. Italy ·Garante ·Art. 5, 6, 9 Employees IP Address Processing Mar 26, 2026
€2,000 Business Owner: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Business Owner €2,000 on 2026-03-26 for: Insufficient legal basis for data processing. Italy ·Garante ·Art. 5, 13, 88 Processing Supervisory Authorities Mar 26, 2026
€5,000 Esselunga S.p.A.: Insufficient fulfilment of data subjects rights Italian Data Protection Authority (Garante) fined Esselunga S.p.A. €5,000 on 2026-03-26 for: Insufficient fulfilment of data subjects rights. Italy ·Garante ·Art. 12, 15 Personal Data Employees Supervisory Authorities Mar 26, 2026
€32M Intesa Sanpaolo S.p.A.: Insufficient technical and organisational measures to ensure information security Italian Data Protection Authority (Garante) fined Intesa Sanpaolo S.p.A. €31,800,000 on 2026-03-26 for: Insufficient technical and organisational measures to ensure information… Italy ·Garante ·Art. 5, 24, 32 +1 Security Insurance Supervisory Authorities Mar 26, 2026
€2,500 Comune di Cassino: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Comune di Cassino €2,500 on 2026-03-26 for: Insufficient legal basis for data processing. Italy ·Garante ·Art. 5, 6 Education Public Authority Processing Mar 26, 2026
€5,000 Municipality: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Municipality €5,000 on 2026-03-26 for: Insufficient legal basis for data processing. Italy ·Garante ·Art. 5, 6, 9 IP Address Employees Processing Mar 26, 2026
€96,000 Eni S.p.A.: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Eni S.p.A. €96,000 on 2026-03-26 for: Insufficient legal basis for data processing. Italy ·Garante ·Art. 5, 6 Processing Supervisory Authorities Mar 26, 2026
€125,000 RENAULT COMMERCIAL ROUMANIE S.R.L.: Insufficient technical and organisational measures to ensure information security Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) fined RENAULT COMMERCIAL ROUMANIE S.R.L. €125,000 on 2026-03-25 for: Insufficient technical and… Romania ·ANSPDCP ·Art. 28, 32 Security Personal Data Supervisory Authorities Mar 25, 2026
€6,300 Advertising Agency: Insufficient legal basis for data processing Austrian Data Protection Authority (dsb) fined Advertising Agency €6,300 on 2026-03-24 for: Insufficient legal basis for data processing. Austria ·dsb ·Art. 5, 6, 13 Direct Marketing Processing Supervisory Authorities Mar 24, 2026
€4,000 ING Bank NV Amsterdam – Sucursala București S.A.: Insufficient technical and organisational measures to ensure information security Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) fined ING Bank NV Amsterdam – Sucursala București S.A. €4,000 on 2026-03-23 for: Insufficient… Romania ·ANSPDCP ·Art. 32 Security Supervisory Authorities Insurance Mar 23, 2026
€150,000 ALÍA GESTIÓN INTEGRAL DE SERVICIOS, S.L.: Insufficient technical and organisational measures to ensure information security The Spanish Data Protection Authority (AEPD) fined ALÍA GESTIÓN INTEGRAL DE SERVICIOS, S.L. €150,000 for failing to implement sufficient technical and organizational measures to… Spain ·aepd ·Art. 5 Integrity and Confidentiality Principle Security Supervisory Authorities Mar 20, 2026
€3,000 Public and Private Domain SA: Insufficient legal basis for data processing Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) fined Public and Private Domain SA €3,000 on 2026-03-20 for: Insufficient legal basis for data… Romania ·ANSPDCP ·Art. 5, 6, 12 +1 Personal Data Employees Processing Mar 20, 2026
€3,000 Domeniul Public și Privat SA: Insufficient legal basis for data processing Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) fined Domeniul Public și Privat SA €3,000 on 2026-03-20 for: Insufficient legal basis for data… Romania ·ANSPDCP ·Art. 5, 6, 12 +1 Education Personal Data Public Authority Mar 20, 2026
Austrian DSB rules 360-degree feedback unlawful without specific works agreement The data subject was employed by an Austrian stock corporation (the controller) from August 2018 to June 2025. They worked as a manager in the controller’s finance department,… 2025-0.960.016 ·Austria ·Art. 6, 88 Legitimate Interest Personal Data Human Resources Mar 20, 2026
€600 SERVICIOS INMOBILIARIOS Y GESTIÓN RCL MADRID, S.L.: Insufficient cooperation with supervisory authority Spanish Data Protection Authority (aepd) fined SERVICIOS INMOBILIARIOS Y GESTIÓN RCL MADRID, S.L. €600 on 2026-03-13 for: Insufficient cooperation with supervisory authority. Spain ·aepd ·Art. 58 Supervisory Authorities Supervision Mar 13, 2026
€18,000 RAMÓN GRAU, S.L.: Insufficient legal basis for data processing Spanish Data Protection Authority (aepd) fined RAMÓN GRAU, S.L. €18,000 on 2026-03-13 for: Insufficient legal basis for data processing. Spain ·aepd ·Art. 6, 13 Employees Processing Supervisory Authorities Mar 13, 2026
€600 CENTRO MEDICO REY FERNANDO, S.L.P.: Insufficient fulfilment of data subjects rights Spanish Data Protection Authority (aepd) fined CENTRO MEDICO REY FERNANDO, S.L.P. €600 on 2026-03-13 for: Insufficient fulfilment of data subjects rights. Spain ·aepd ·Art. 12 Healthcare Personal Data Supervisory Authorities Mar 13, 2026
€450 Housing Association: Insufficient cooperation with supervisory authority Spanish Data Protection Authority (aepd) fined Housing Association €450 on 2026-03-13 for: Insufficient cooperation with supervisory authority. Spain ·aepd ·Art. 58 Supervision Supervisory Authorities Mar 13, 2026
€563,052 Enel Energia S.p.A.: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Enel Energia S.p.A. €563,052 on 2026-03-12 for: Insufficient legal basis for data processing. Italy ·Garante ·Art. 5, 6, 7 +2 Processing Supervisory Authorities Mar 12, 2026
€2,000 Comune di Sutri: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Comune di Sutri €2,000 on 2026-03-12 for: Insufficient legal basis for data processing. Italy ·Garante ·Art. 5, 6 Education Public Authority Supervisory Authorities Mar 12, 2026
€2,000 Liceo Scientifico Morgagni di Roma: Insufficient technical and organisational measures to ensure information security Italian Data Protection Authority (Garante) fined Liceo Scientifico Morgagni di Roma €2,000 on 2026-03-12 for: Insufficient technical and organisational measures to ensure… Italy ·Garante ·Art. 5, 6, 9 +1 Education Security Public Authority Mar 12, 2026
€2,000 Hanako s.r.l.: Insufficient technical and organisational measures to ensure information security Italian Data Protection Authority (Garante) fined Hanako s.r.l. €2,000 on 2026-03-12 for: Insufficient technical and organisational measures to ensure information security. Italy ·Garante ·Art. 5, 13, 32 Security Healthcare Supervisory Authorities Mar 12, 2026
€50,000 ITAS Mutua: Insufficient fulfilment of data subjects rights Italian Data Protection Authority (Garante) fined ITAS Mutua €50,000 on 2026-03-12 for: Insufficient fulfilment of data subjects rights. Italy ·Garante ·Art. 5, 12, 13 +2 Personal Data Supervisory Authorities Employees Mar 12, 2026
€40,000 INPS – Istituto nazionale previdenza sociale: Insufficient technical and organisational measures to ensure information security Italian Data Protection Authority (Garante) fined INPS – Istituto nazionale previdenza sociale €40,000 on 2026-03-12 for: Insufficient technical and organisational measures to… Italy ·Garante ·Art. 5, 6, 9 +2 Security Education Public Sector Mar 12, 2026
€800 Barber Shop: Insufficient fulfilment of information obligations Italian Data Protection Authority (Garante) fined Barber Shop €800 on 2026-03-12 for: Insufficient fulfilment of information obligations. Italy ·Garante ·Art. 5, 13 Supervisory Authorities Mar 12, 2026
€40,000 La7 S.p.A.: Non-compliance with general data processing principles Italian Data Protection Authority (Garante) fined La7 S.p.A. €40,000 on 2026-03-12 for: Non-compliance with general data processing principles. Italy ·Garante ·Art. 5 IP Address Processing Telecommunications Mar 12, 2026
€650,000 IBERIA LÍNEAS AÉREAS DE ESPAÑA, S.A. OPERADORA: Insufficient technical and organisational measures to ensure information security Spanish Data Protection Authority (aepd) fined IBERIA LÍNEAS AÉREAS DE ESPAÑA, S.A. OPERADORA €650,000 on 2026-03-11 for: Insufficient technical and organisational measures to… Spain ·aepd ·Art. 5 Security Supervisory Authorities Mar 11, 2026
€6,000 CUMACA MOTOR, S.L.: Insufficient legal basis for data processing Spanish Data Protection Authority (aepd) fined CUMACA MOTOR, S.L. €6,000 on 2026-03-10 for: Insufficient legal basis for data processing. Spain ·aepd ·Art. 5 Processing Supervisory Authorities Mar 10, 2026
€8,000 Altex Romania S.R.L.: Insufficient cooperation with supervisory authority Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) fined Altex Romania S.R.L. €8,000 on 2026-03-05 for: Insufficient cooperation with supervisory… ANSPDCP ·Art. 58 ·Insufficient cooperation with supervisory authority Supervisory Authorities Supervision Personal Data Mar 5, 2026
€200,000 ARES CAPITAL, S.A.: Insufficient legal basis for data processing Spanish Data Protection Authority (aepd) fined ARES CAPITAL, S.A. €200,000 on 2026-03-04 for: Insufficient legal basis for data processing. Spain ·aepd ·Art. 5, 6, 13 Employees Supervisory Authorities Processing Mar 4, 2026
Woo-besluit: Boetebesluit en besluit op bezwaar Enforcement Supervision NL Mar 2, 2026
€2,000 MALAGASUITE SHOWROOM, S.L.: Insufficient fulfilment of data subjects rights Spanish Data Protection Authority (aepd) fined MALAGASUITE SHOWROOM, S.L. €2,000 on 2026-03-02 for: Insufficient fulfilment of data subjects rights. Spain ·aepd ·Art. 13 Personal Data Supervisory Authorities Healthcare Mar 2, 2026
€900 ORNITOLÓGICA DE ANDALUCÍA FOA: Non-compliance with general data processing principles Spanish Data Protection Authority (aepd) fined ORNITOLÓGICA DE ANDALUCÍA FOA €900 on 2026-03-02 for: Non-compliance with general data processing principles. Spain ·aepd ·Art. 5 IP Address Processing Supervisory Authorities Mar 2, 2026
Tien gemeenten elk EUR 25.000 boete voor overtreding AVG-artikelen 5, 6 en 9 Het gaat om de gemeenten Delft, Ede, Eindhoven, Gooise Meren, Haarlemmermeer, Hilversum, Huizen, Tilburg, Veenendaal en Zoetermeer. Ze krijgen elk een boete van EUR 25.000,- voor… Enforcement Supervision NL Mar 2, 2026
€8,500 HIGHCLIFFE ESTATES MARBELLA, S.L.: Insufficient legal basis for data processing Spanish Data Protection Authority (aepd) fined HIGHCLIFFE ESTATES MARBELLA, S.L. €8,500 on 2026-03-02 for: Insufficient legal basis for data processing. Spain ·aepd ·Art. 6 Processing Supervisory Authorities Mar 2, 2026
€5,000 Suomen Numerokeskus Oy: Insufficient fulfilment of data subjects rights Deputy Data Protection Ombudsman fined Suomen Numerokeskus Oy €5,000 on 2026-03-02 for: Insufficient fulfilment of data subjects rights. Finland ·Deputy Data Protection Ombudsman ·Art. 15 Personal Data Mar 2, 2026
€1,000 Spain DPA: Non-compliance with general data processing principles Spanish Data Protection Authority (aepd) fined an unnamed party €1,000 on 2026-03-01 for: Non-compliance with general data processing principles. aepd ·Art. 5 ·Non-compliance with general data processing principles Processing Agreement IP Address Supervisory Authorities Mar 1, 2026
€12,000 HOLY MARY CATHOLIC SCHOOL, S.L.: Insufficient legal basis for data processing Spanish Data Protection Authority (aepd) fined HOLY MARY CATHOLIC SCHOOL, S.L. €12,000 on 2026-03-01 for: Insufficient legal basis for data processing. Spain ·aepd ·Art. 5, 6, 35 Education Public Authority Processing Mar 1, 2026
€15,000 Ministero delle Imprese e del Made in Italy: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Ministero delle Imprese e del Made in Italy €15,000 on 2026-02-26 for: Insufficient legal basis for data processing. Garante ·Art. 5, 6, 9 +1 ·Insufficient legal basis for data processing Education Public Authority Telecommunications Feb 26, 2026
€15,000 Ministero delle Imprese e del Made in Italy: Insufficient data processing agreement Italian Data Protection Authority (Garante) fined Ministero delle Imprese e del Made in Italy €15,000 on 2026-02-26 for: Insufficient data processing agreement. Garante ·Art. 28 ·Insufficient data processing agreement Processing Agreement Education Public Authority Feb 26, 2026
€12,000 Ministero dell’Economia e delle Finanze: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Ministero dell’Economia e delle Finanze €12,000 on 2026-02-26 for: Insufficient legal basis for data processing. Italy ·Garante ·Art. 5, 6, 28 Public Authority Education Public Sector Feb 26, 2026
€1,000 Ciemme S.r.l.s.: Insufficient cooperation with supervisory authority Italian Data Protection Authority (Garante) fined Ciemme S.r.l.s. €1,000 on 2026-02-26 for: Insufficient cooperation with supervisory authority. Italy ·Garante ·Art. 58 Supervision Supervisory Authorities Telecommunications Feb 26, 2026
€5,000 Conservatory: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Conservatory €5,000 on 2026-02-26 for: Insufficient legal basis for data processing. Italy ·Garante ·Art. 5, 6, 10 Education Processing Public Authority Feb 26, 2026
€15,000 Flamel S.r.l.: Non-compliance with general data processing principles Italian Data Protection Authority (Garante) fined Flamel S.r.l. €15,000 on 2026-02-26 for: Non-compliance with general data processing principles. Italy ·Garante ·Art. 8, 11, 25 +3 IP Address Processing Telecommunications Feb 26, 2026
€32,000 Dedalus Italia S.p.A.: Insufficient technical and organisational measures to ensure information security Italian Data Protection Authority (Garante) fined Dedalus Italia S.p.A. €32,000 on 2026-02-26 for: Insufficient technical and organisational measures to ensure information… Italy ·Garante ·Art. 32 Security Telecommunications Supervisory Authorities Feb 26, 2026
€10,000 Radio Immagine Uno S.r.l.: Insufficient fulfilment of data subjects rights Italian Data Protection Authority (Garante) fined Radio Immagine Uno S.r.l. €10,000 on 2026-02-26 for: Insufficient fulfilment of data subjects rights. Italy ·Garante ·Art. 12 Personal Data Telecommunications Supervisory Authorities Feb 26, 2026