Content type · 3,634 documents

Enforcement

Regulatory actions, fines, warnings, and enforcement decisions

🇪🇺 EU 🇳🇱 NL
Enforcement dashboard — fines by country, authority and article →
Filter by Topic Supervisory Authorities3564 Processing Agreement2800 Processing2632 Personal Data2596 Controllers2211 Data Controller1862 Law Enforcement1540 IP Address1282 Security1024 Supervision879 Monitoring545 Consent518
151–200 of 3,634 sort newestlargest fineoldest
€1,000 Ciemme S.r.l.s.: Insufficient cooperation with supervisory authority Italian Data Protection Authority (Garante) fined Ciemme S.r.l.s. €1,000 on 2026-02-26 for: Insufficient cooperation with supervisory authority. Italy ·Garante ·Art. 58 Supervision Supervisory Authorities Telecommunications Feb 26, 2026
€15,000 Flamel S.r.l.: Non-compliance with general data processing principles Italian Data Protection Authority (Garante) fined Flamel S.r.l. €15,000 on 2026-02-26 for: Non-compliance with general data processing principles. Italy ·Garante ·Art. 8, 11, 25 +3 IP Address Processing Telecommunications Feb 26, 2026
€15,000 Ministero delle Imprese e del Made in Italy: Insufficient data processing agreement Italian Data Protection Authority (Garante) fined Ministero delle Imprese e del Made in Italy €15,000 on 2026-02-26 for: Insufficient data processing agreement. Garante ·Art. 28 ·Insufficient data processing agreement Processing Agreement Education Public Authority Feb 26, 2026
€30,000 S.M. Trattamento Acqua di XX: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined S.M. Trattamento Acqua di XX €30,000 on 2026-02-26 for: Insufficient legal basis for data processing. Italy ·Garante ·Art. 4, 5, 6 +6 Processing Telecommunications Cookies Feb 26, 2026
€17M Reddit, Inc.: Non-compliance with general data processing principles Information Commissioner (ICO) fined Reddit, Inc. €16,610,000 on 2026-02-23 for: Non-compliance with general data processing principles. United Kingdom ·ICO ·Art. 5, 6, 8 +1 IP Address Telecommunications Processing Feb 23, 2026
€5,570 University of Szeged: Insufficient legal basis for data processing Hungarian National Authority for Data Protection and the Freedom of Information (NAIH) fined University of Szeged €5,570 on 2026-02-20 for: Insufficient legal basis for data… Hungary ·NAIH ·Art. 5, 6, 9 +1 Education Processing Public Authority Feb 20, 2026
€2,000 SC Hayat Dent SRL: Insufficient cooperation with supervisory authority Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) fined SC Hayat Dent SRL €2,000 on 2026-02-20 for: Insufficient cooperation with supervisory… Romania ·ANSPDCP ·Art. 83 Supervisory Authorities Supervision Personal Data Feb 20, 2026
€5,000 KEAT - Centre for Education & Rehabilitation of the Blind: Insufficient fulfilment of data subjects rights Hellenic Data Protection Authority (HDPA) fined KEAT - Centre for Education & Rehabilitation of the Blind €5,000 on 2026-02-20 for: Insufficient fulfilment of data subjects rights. Greece ·HDPA ·Art. 12, 15 Personal Data Education Supervisory Authorities Feb 20, 2026
€1.4M Restaurant Partner Polska: Insufficient legal basis for data processing Polish National Personal Data Protection Office (UODO) fined Restaurant Partner Polska €1,393,300 on 2026-02-19 for: Insufficient legal basis for data processing. Poland ·UODO ·Art. 5, 6 Personal Data Processing Feb 19, 2026
€3,000 Your Consulting SRL: Insufficient technical and organisational measures to ensure information security Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) fined Your Consulting SRL €3,000 on 2026-02-19 for: Insufficient technical and organisational… Romania ·ANSPDCP ·Art. 25, 32 Security Supervisory Authorities Personal Data Feb 19, 2026
€5,500 Slovenia DPA: Insufficient technical and organisational measures to ensure information security Slovenian Supervisory Authority (Informacijski pooblaščenec) fined an unnamed party €5,500 on 2026-02-16 for: Insufficient technical and organisational measures to ensure… Art. 32 ·Insufficient technical and organisational measures to ensure information security Security Supervisory Authorities IP Address Feb 16, 2026
€8,470 Election Committee of Karol Nawrocki: Insufficient legal basis for data processing Polish National Personal Data Protection Office (UODO) fined Election Committee of Karol Nawrocki €8,470 on 2026-02-13 for: Insufficient legal basis for data processing. Poland ·UODO ·Art. 5, 6 Personal Data Processing Feb 13, 2026
€4,000 Comune di Mazara del Vallo: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Comune di Mazara del Vallo €4,000 on 2026-02-12 for: Insufficient legal basis for data processing. Italy ·Garante ·Art. 5, 6, 12 +2 Education Public Authority Processing Feb 12, 2026
€6,000 Comune di Coccaglio: Non-compliance with general data processing principles Italian Data Protection Authority (Garante) fined Comune di Coccaglio €6,000 on 2026-02-12 for: Non-compliance with general data processing principles. Italy ·Garante ·Art. 5, 6, 12 +3 Employees IP Address Processing Feb 12, 2026
€15,000 Depurazione Acqua S.r.l.: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Depurazione Acqua S.r.l. €15,000 on 2026-02-12 for: Insufficient legal basis for data processing. Italy ·Garante ·Art. 4, 5, 6 +3 Processing Telecommunications Supervisory Authorities Feb 12, 2026
€2,000 Comune di Velletri: Non-compliance with general data processing principles Italian Data Protection Authority (Garante) fined Comune di Velletri €2,000 on 2026-02-12 for: Non-compliance with general data processing principles. Italy ·Garante ·Art. 5, 6, 12 +2 Education IP Address Processing Feb 12, 2026
€15,000 Bressanelli Galli Gelpi Porta & C. S.r.l.: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Bressanelli Galli Gelpi Porta & C. S.r.l. €15,000 on 2026-02-12 for: Insufficient legal basis for data processing. Italy ·Garante ·Art. 5, 6, 7 +3 Insurance Processing Telecommunications Feb 12, 2026
€2,000 Sole Trader: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Sole Trader €2,000 on 2026-02-12 for: Insufficient legal basis for data processing. Italy ·Garante ·Art. 5, 6, 13 +1 Processing Telecommunications Supervisory Authorities Feb 12, 2026
€2,000 Comune di Monterotondo: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Comune di Monterotondo €2,000 on 2026-02-12 for: Insufficient legal basis for data processing. Italy ·Garante ·Art. 5, 13, 88 Education Processing Public Authority Feb 12, 2026
€4,000 Order of Physicians, Surgeons and Dentists of the Province of Macerata: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Order of Physicians, Surgeons and Dentists of the Province of Macerata €4,000 on 2026-02-12 for: Insufficient legal basis for… Italy ·Garante ·Art. 5, 6 Public Authority Processing Education Feb 12, 2026
€1,000 Sole Trader: Insufficient fulfilment of information obligations Italian Data Protection Authority (Garante) fined Sole Trader €1,000 on 2026-02-12 for: Insufficient fulfilment of information obligations. Italy ·Garante ·Art. 5, 13 Telecommunications Supervisory Authorities Cookies Feb 12, 2026
€5,000 Unleadmited S.r.l.: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Unleadmited S.r.l. €5,000 on 2026-02-12 for: Insufficient legal basis for data processing. Italy ·Garante ·Art. 5, 6, 7 +1 Processing Telecommunications Cookies Feb 12, 2026
€30,000 Sportitalia Società Sportiva Dilettantistica a.r.l.: Insufficient fulfilment of data subjects rights Italian Data Protection Authority (Garante) fined Sportitalia Società Sportiva Dilettantistica a.r.l. €30,000 on 2026-02-12 for: Insufficient fulfilment of data subjects rights. Italy ·Garante ·Art. 12, 17 Personal Data Telecommunications Supervisory Authorities Feb 12, 2026
€15,000 Lex Iuris S.r.l.: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Lex Iuris S.r.l. €15,000 on 2026-02-12 for: Insufficient legal basis for data processing. Italy ·Garante ·Art. 6, 15 Education Public Authority Processing Feb 12, 2026
€12,000 Based s.r.l.: Insufficient fulfilment of data subjects rights Italian Data Protection Authority (Garante) fined Based s.r.l. €12,000 on 2026-02-12 for: Insufficient fulfilment of data subjects rights. Italy ·Garante ·Art. 5, 12, 13 +2 Personal Data Supervisory Authorities Employees Feb 12, 2026
€1,500 Sole Trader: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Sole Trader €1,500 on 2026-02-12 for: Insufficient legal basis for data processing. Italy ·Garante ·Art. 5, 13, 25 Processing Telecommunications Supervisory Authorities Feb 12, 2026
€150,000 AEPD (Spain) - EXP202306354 (PS/00312/2024) The Spanish Data Protection Agency (AEPD) investigated Vodafone España, S.A.U. as controller after a SIM swapping incident. On 21 September 2021, an unknown third party requested… Art. 5, 6 Personal Data Integrity and Confidentiality Principle Social Media Feb 11, 2026
€30,000 Vodafone – PANAFON A.E.E.T.: Insufficient fulfilment of data subjects rights Hellenic Data Protection Authority (HDPA) fined Vodafone – PANAFON A.E.E.T. €30,000 on 2026-02-11 for: Insufficient fulfilment of data subjects rights. Greece ·HDPA ·Art. 12, 15, 18 Personal Data Telecommunications Supervisory Authorities Feb 11, 2026
€5,220 Fundację Lumus: Non-compliance with general data processing principles Polish National Personal Data Protection Office (UODO) fined Fundację Lumus €5,220 on 2026-02-10 for: Non-compliance with general data processing principles. Poland ·UODO ·Art. 33, 34, 37 +1 Personal Data IP Address Processing Feb 10, 2026
€1,800 Landlord: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 1,800 on a Landlord. The landlord used video surveillance in rental apartments without having a sufficient legal basis. The original fine… SPAIN ·aepd ·Art. 6 Video Surveillance Controllers Monitoring Feb 6, 2026
€284,450 MediaLab.AI, Inc.: Insufficient legal basis for data processing The UK DPA has imposed a fine of GBP 247,590 (EUR 284,450) on MediaLab.AI, Inc.The controller of the image-sharing and hosting platform Imgur failed to implement age verification.… UNITED KINGDOM ·ICO ·Insufficient legal basis for data processing Minors Controllers Consent Feb 5, 2026
€20,000 Tensa Art Design S.A: Insufficient cooperation with supervisory authority The Romanian DPA has imposed a fine of EUR 20,000 onTensa Art Design S.A.The DPA began investigating the controller's data processing activities, but the controller failed to… ROMANIA ·ANSPDCP ·Art. 58, 83 Supervisory Authorities Supervision Controllers Feb 5, 2026
€2.7M DPD Polska sp. z o.o.: Insufficient data processing agreement Polish National Personal Data Protection Office (UODO) fined DPD Polska sp. z o.o. €2,682,000 on 2026-02-05 for: Insufficient data processing agreement. Poland ·UODO ·Art. 5, 24, 29 +1 Processing Agreement Personal Data Processing Feb 5, 2026
€4,200 Obuda University: Insufficient legal basis for data processing Hungarian National Authority for Data Protection and the Freedom of Information (NAIH) fined Obuda University €4,200 on 2026-02-05 for: Insufficient legal basis for data… Hungary ·NAIH ·Art. 5, 6, 9 Education Processing Public Authority Feb 5, 2026
€10,000 GENPACT ROMANIA SRL: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 10,000 on GENPACT ROMANIA SRL. The controller suffered a successful cyber attack due to insufficient technical and organisational… ANSPDCP ·Art. 32 ·Insufficient technical and organisational measures to ensure information security Access Controls Security Controllers Feb 4, 2026
€10,000 FREE TECHNOLOGIES EXCOM, S.L.: Insufficient technical and organisational measures to ensure information security The Spanish DPA has imposed a fine of EUR 10,000 on FREE TECHNOLOGIES EXCOM, S.L. The controller had reset user passwords and communicated the new passwords to the clients via… SPAIN ·aepd ·Art. 32 Encryption Integrity and Confidentiality Principle Security Feb 3, 2026
€1,000 Alliance for the Union of Romanians (AUR) Party: Insufficient fulfilment of data subjects rights The Romanian DPA has imposed a fine of EUR 1,000 on the Alliance for the Union of Romanians (AUR) Party. The controller failed to react adequately to a data subject's request to… ROMANIA ·ANSPDCP ·Art. 12, 15, 17 +1 Personal Data Controllers Processing Agreement Feb 3, 2026
€25,000 Municipality of Delft: Insufficient legal basis for data processing The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Delft. The controller, one of ten municipalities that were fined, processed data regarding the Islamic… THE NETHERLANDS ·AP ·Art. 6, 9 Political Opinions Health Data Public Authority Feb 3, 2026
€25,000 Municipality of Eindhoven: Insufficient legal basis for data processing The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Eindhoven. The controller, one of ten municipalities that were fined, processed data regarding the Islamic… THE NETHERLANDS ·AP ·Art. 6, 9 Political Opinions Health Data Public Authority Feb 3, 2026
€25,000 Municipality of Ede: Insufficient legal basis for data processing The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Ede. The controller, one of ten municipalities that were fined, processed data regarding the Islamic… THE NETHERLANDS ·AP ·Art. 6, 9 Political Opinions Health Data Controllers Feb 3, 2026
€25,000 Municipality of Zoetermeer: Insufficient legal basis for data processing The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Zoetermeer. The controller, one of ten municipalities that were fined, processed data regarding the Islamic… THE NETHERLANDS ·AP ·Art. 6, 9 Political Opinions Health Data Public Authority Feb 3, 2026
€25,000 Municipality of Veenendaal: Insufficient legal basis for data processing The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Veenendaal. The controller, one of ten municipalities that were fined, processed data regarding the Islamic… THE NETHERLANDS ·AP ·Art. 6, 9 Political Opinions Health Data Public Authority Feb 3, 2026
€25,000 Municipality of Hilversum: Insufficient legal basis for data processing The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Hilversum. The controller, one of ten municipalities that were fined, processed data regarding the Islamic… THE NETHERLANDS ·AP ·Art. 6, 9 Political Opinions Health Data Public Authority Feb 3, 2026
€25,000 Municipality of Gooise Meren: Insufficient legal basis for data processing The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Gooise Meren. The controller, one of ten municipalities that were fined, processed data regarding the Islamic… THE NETHERLANDS ·AP ·Art. 6, 9 Political Opinions Health Data Public Authority Feb 3, 2026
€25,000 Municipality of Haarlemmermeer: Insufficient legal basis for data processing The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Haarlemmermeer. The controller, one of ten municipalities that were fined, processed data regarding the… THE NETHERLANDS ·AP ·Art. 6, 9 Political Opinions Health Data Public Authority Feb 3, 2026
€25,000 Municipality of Huizen: Insufficient legal basis for data processing The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Huizen. The controller, one of ten municipalities that were fined, processed data regarding the Islamic… THE NETHERLANDS ·AP ·Art. 6, 9 Political Opinions Health Data Public Authority Feb 3, 2026
€25,000 Municipality of Tilburg: Insufficient legal basis for data processing The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Tilburg. The controller, one of ten municipalities that were fined, processed data regarding the Islamic… THE NETHERLANDS ·AP ·Art. 6, 9 Political Opinions Health Data Public Authority Feb 3, 2026
€4,200 Hungarian University of Agriculture and Life Sciences: Insufficient legal basis for data processing Hungarian National Authority for Data Protection and the Freedom of Information (NAIH) fined Hungarian University of Agriculture and Life Sciences €4,200 on 2026-01-30 for:… Hungary ·NAIH ·Art. 5, 6, 13 Education Processing Public Authority Jan 30, 2026
€10,000 Natural Person: Non-compliance with general data processing principles The Romanian DPA has imposed a fine of EUR 10,000 on a natural person. The controller operated a website on which identity cards containing personal data, including special… ROMANIA ·ANSPDCP ·Art. 5, 6, 9 +6 Criminal Data Personal Data Health Data Jan 30, 2026
€12,000 Ministero della Cultura: Non-compliance with general data processing principles Italian Data Protection Authority (Garante) fined Ministero della Cultura €12,000 on 2026-01-29 for: Non-compliance with general data processing principles. Italy ·Garante ·Art. 5, 6, 12 +3 Employees Processing IP Address Jan 29, 2026