Content type · 1,025 documents in this view · 3,842 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities 3614 Processing 2657 Personal Data 2429 Controllers 2039 Processing Agreement 1116 Security 1025 Supervision 869 Healthcare 624 Public Authority 577 Law Enforcement 576 Monitoring 552 Consent 510
€15M FREE: Insufficient technical and organisational measures to ensure information security The French DPA has imposed a fine of EUR 15,000,000 on FREE. The controller suffered a data breach due to insufficient technical and organisational measures. This was caused by… FRANCE · ·Art. 32, 34 Jan 8, 2026
€27M FREE MOBILE: Insufficient technical and organizational measures to ensure information security. ⇄ 27 miljoen euro boete - Frans Nationaal Instituut voor Gegevensbescherming (CNIL). FRANCE · ·Art. 5, 32 Jan 8, 2026
€27M FREE MOBILE: Insufficient technical and organisational measures to ensure information security The French DPA has imposed a fine of EUR 27,000,000 on FREE MOBILE. The controller suffered a data breach due to insufficient technical and organisational measures. This was… FRANCE · ·Art. 5, 32 Jan 8, 2026
€232,379 Polish Postal Service: Lack of appointment of data protection officer The Polish DPA has imposed a fine of EUR 232,379 on the Polish Postal Service. The controller appointed a person as DPO who also held a managerial position with authority over… POLAND · ·Art. 38 Jan 2, 2026
€10,000 SIGMA & KAPPA IMPORTING SOCIÉTÉ ANONYME: Insufficient technical and organisational measures to ensure information security The Greek DPA has imposed a fine of EUR 10,000 on SIGMA & KAPPA IMPORTING SOCIÉTÉ ANONYME. The fined entity is the processor of Thessaloniki–Thessaly Gas Supply Company S.A.… GREECE · ·Art. 32 Dec 31, 2025
€5,000 REVMA PLUS Retail S.A.: Insufficient technical and organisational measures to ensure information security The Greek DPA has imposed a fine of EUR 5,000 on REVMA PLUS Retail S.A.. The fined entity is the processor of Thessaloniki–Thessaly Gas Supply Company S.A. (ETid-3016). The… GREECE · ·Art. 32 Dec 31, 2025
€12,000 Madrileña Red de Gas: Insufficient technical and organisational measures to ensure information security The gas company did not have appropriate measures in place to verify the identity of the data subject. The person who filed the complaint alleges that the company e-mailed his… SPAIN · ·Art. 32
€50,000 Social Insurance Agency: Insufficient technical and organisational measures to ensure information security Applications for social benefits from Slovak citizens were sent by post to foreign authorities. These were lost by post, with the result that the whereabouts of these personal… SLOVAKIA · ·Art. 32
€980 Self-employed entrepreneur - no further details published: Insufficient technical and organizational measures to ensure information security. ⇄ Boete van €980 - Tsjechische Autoriteit voor Gegevensbescherming (UOOU). CZECH REPUBLIC · ·Art. 32 Dec 30, 2025
SLOVAKIA DPA: Insufficient technical and organisational measures to ensure information security Violation of information security measures (no further information available at the moment) ·Art. 5, 32 ·Insufficient technical and organisational measures to ensure information security
€50,000 Social security institution: Insufficient technical and organizational measures to ensure information security. ⇄ Een boete van 50.000 euro - van het Slowaakse databeschermingskantoor. SLOVAKIA · ·Art. 32 Dec 30, 2025
€12,000 Madrileña Red de Gas: Insufficient technical and organizational measures to ensure information security. ⇄ 12.000 euro boete - Spaanse Autoriteit voor Gegevensbescherming (AEPD). SPAIN · ·Art. 32 Dec 30, 2025
€10,000 Roumasport S.R.L: Insufficient technical and organizational measures to ensure information security. ⇄ Een boete van €10.000 - De Roemeense nationale toezichthouder op de verwerking van persoonsgegevens (ANSPDCP). ROMANIA · ·Art. 32 Dec 30, 2025
SLOVAKIA DPA: Insufficient technical and organisational measures to ensure information security Documents containing personal data were disposed of in the area of the municipal garbage dump. ·Art. 5, 32 ·Insufficient technical and organisational measures to ensure information security
SLOVAKIA: Insufficient technical and organisational measures to ensure information security. ⇄ Slovaakse Autoriteit voor de Bescherming van Persoonsgegevens. ·Art. 5, 32 ·Insufficient technical and organisational measures to ensure information security Dec 30, 2025
€10,000 Roumasport S.R.L: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 10,000 on Roumasport S.R.L The controller failed to implement adequate technical and organisational measures, resulting in multiple… ROMANIA · ·Art. 32 Dec 30, 2025
€980 Individual entrepreneur - no further details published: Insufficient technical and organisational measures to ensure information security The operator of an online game was exposed to several DDoS attacks which caused the malfunctioning of the servers. The attacker blackmailed the operator stating that the attacks… CZECH REPUBLIC · ·Art. 32
€40,000 Slovak Telekom: Insufficient technical and organizational measures to ensure information security. ⇄ Een boete van 40.000 euro - van het Slowaakse databeschermingskantoor. SLOVAKIA · ·Art. 32 Dec 30, 2025
€40,000 Slovak Telekom: Insufficient technical and organisational measures to ensure information security The controller did not take adequate security measures when processing personal data, thereby breaching the obligation to protect the processed personal data. SLOVAKIA · ·Art. 32
SLOVENIA: Insufficient technical and organizational measures to ensure information security. ⇄ Slovaakse Autoriteit voor Gegevensbescherming. SLOVAKIA · ·Art. 5, 32 Dec 30, 2025
€2,000 Order of General Nurses, Midwives and Medical Assistants of Romania – Neamt Branch: Non-compliance with the general principles of data processing. ⇄ Een boete van 2.000 euro - van de Roemeense nationale toezichthoudende autoriteit voor de verwerking van persoonsgegevens (ANSPDCP). ·Art. 5, 6, 12 +1 ·Non-compliance with general data processing principles Dec 29, 2025
€1.7M NEXPUBLICA FRANCE: Insufficient technical and organisational measures to ensure information security. ⇄ 1.700.000 euro boete - Frans Nationaal Instituut voor Gegevensbescherming (CNIL). ·Art. 32 ·Insufficient technical and organisational measures to ensure information security Dec 22, 2025
€500,000 CURENERGÍA COMERCIALIZADOR DE ÚLTIMO RECURSO S.A.U.: Insufficient technical and organizational measures to ensure information security. ⇄ Een boete van 500.000 euro - opgelegd door de Spaanse autoriteit voor gegevensbescherming (AEPD). SPAIN · ·Art. 25 Dec 22, 2025
€500,000 CURENERGÍA COMERCIALIZADOR DE ÚLTIMO RECURSO S.A.U.: Insufficient technical and organisational measures to ensure information security The Spanish DPA has imposed a fine of EUR 500,000 on CURENERGÍA COMERCIALIZADOR DE ÚLTIMO RECURSO S.A.U. The controller used a communication tool that was not designed in… SPAIN · ·Art. 25 Dec 22, 2025
€1.7M NEXPUBLICA FRANCE: Insufficient technical and organisational measures to ensure information security The French DPA has imposed a fine of EUR 1,700,000 on NEXPUBLICA FRANCE. The controller, who was a software developer, created and offered a software package designed to manage… ·Art. 32 ·Insufficient technical and organisational measures to ensure information security Dec 22, 2025
€32,000 EXCEL HOTELS & RESORTS, S.A.: Insufficient technical and organisational measures to ensure information security The Spanish DPA has imposed a fine of EUR 32,000 on EXCEL HOTELS & RESORTS, S.A. The controller used guards to control access to its facility. The guards regularly left documents… SPAIN · ·Art. 5 Dec 20, 2025
€32,000 EXCEL HOTELS & RESORTS, S.A.: Insufficient technical and organizational measures to ensure information security. ⇄ Een boete van 32.000 euro - opgelegd door de Spaanse autoriteit voor gegevensbescherming (AEPD). SPAIN · ·Art. 5 Dec 20, 2025
€175,000 HAN University of Applied Sciences: Insufficient technical and organizational measures to ensure information security. ⇄ 175.000 euro boete - Nederlandse Autoriteit Persoonsgegevens (AP). THE NETHERLANDS · ·Art. 32 Dec 15, 2025
€175,000 Arnhem and Nijmegen University of Applied Sciences: Insufficient technical and organisational measures to ensure information security The Dutch DPA has imposed a fine of EUR 175,000 on Arnhem and Nijmegen University of Applied Sciences. The controller suffered a data breach due to insufficient technical and… THE NETHERLANDS · ·Art. 32 Dec 15, 2025
€75,700 Chief Constable of the Police Service of Scotland: Insufficient technical and organisational measures to ensure information security Information Commissioner (ICO) fined Chief Constable of the Police Service of Scotland €75,700 on 2025-12-12 for: Insufficient technical and organisational measures to ensure… United Kingdom · ·Art. 5, 25, 32 +1 Dec 12, 2025
€98,000 University of Limerick: Insufficient technical and organisational measures to ensure information security Data Protection Authority of Ireland fined University of Limerick €98,000 on 2025-12-10 for: Insufficient technical and organisational measures to ensure information security. Ireland · ·Art. 5, 30, 32 +2 Dec 10, 2025
€1,000 Compania de Apa Oltenia S.A.: Insufficient technical and organizational measures to ensure information security. ⇄ Een boete van €1.000 - De Roemeense nationale toezichthoudende autoriteit voor de verwerking van persoonsgegevens (ANSPDCP). ROMANIA · ·Art. 29, 32 Dec 8, 2025
€1,000 Compania de Apa Oltenia S.A.: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 1,000 on Compania de Apa Oltenia S.A. The controller failed to implement adequate technical and organisational measures to ensure data… ROMANIA · ·Art. 29, 32 Dec 8, 2025
€1,300 Legal Entity: Insufficient technical and organisational measures to ensure information security The Slovenian DPA has imposed a fine of EUR 1,300 on a legal entity. An employee of the controller stored personal data on her work laptop without securing it, for example by… SLOVENIA · ·Art. 32 Dec 4, 2025
€12,000 Comune di Tuscania: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 12,000 on the Commune di Tuscania. The controller had been using video surveillance and licence plate recognition within its territory… ITALY · ·Art. 5, 6, 12 +5 Dec 4, 2025
DSB · 2025-0.968.031 A data subject published a post concerning their ADHD diagnosis on a publicly accessible online forum under a pseudonym. A person (the controller) who was a follower of the data… 2025-0.968.031 ·Austria ·Art. 9 Dec 3, 2025
€3,600 RISING SUN CAR RENTAL S..L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 3,600 on RISING SUN CAR RENTAL S..L. The controller used video surveillance to ensure security at its facility, affecting more areas than… SPAIN · ·Art. 5, 13 Dec 1, 2025
€1.6M SPRINTER MEGACENTROS DEL DEPORTE, S.L.: Insufficient technical and organizational measures to ensure information security. ⇄ 1.560.000 euro boete - Spaanse Autoriteit voor Gegevensbescherming (AEPD). SPAIN · ·Art. 5, 34 Nov 28, 2025
€1.6M SPRINTER MEGACENTROS DEL DEPORTE, S.L.: Insufficient technical and organisational measures to ensure information security The Spanish DPA has imposed a fine of EUR 1,560,000 on SPRINTER MEGACENTROS DEL DEPORTE, S.L. The controller suffered a cyber attack due to insufficient technical and… SPAIN · ·Art. 5, 34 Nov 28, 2025
€2,000 Nițu A. Cleopatra – Expert Accountant: Insufficient technical and organisational measures to ensure information security Thr Romanian DPA has imposed a fine of EUR 2,000 on Nițu A. Cleopatra – Expert Accountant. The controller was the target of a successful cyber attack due to the inadequate… ROMANIA · ·Art. 32 Nov 27, 2025
€2,000 Nițu A. Cleopatra – Expert Accountant: Insufficient technical and organisational measures to ensure information security. ⇄ Een boete van 2.000 euro - van de Roemeense nationale toezichthoudende autoriteit voor de verwerking van persoonsgegevens (ANSPDCP). ROMANIA · ·Art. 32 Nov 27, 2025
DSB · 2025-0.950.759 On 18 September 2023, a data subject created a customer account with a public limited company operating an online shop (the controller). It allowed customers to place orders… 2025-0.950.759 ·Austria ·Art. 5, 6, 16 +2 Nov 24, 2025
€4.5M Telecommunications Company (Operator of Electronic Communications Networks and Services): Violation of the General Principles of Data Processing. ⇄ Een boete van 4.500.000 euro - opgelegd door de Kroatische Autoriteit voor Gegevensbescherming (AZOP). CROATIA · ·Art. 5, 6, 12 +4 Nov 24, 2025
€4.5M Telecommunications operator (operator of electronic communications networks and services): Non-compliance with general data processing principles Following an ex officio investigation, AZOP imposed a EUR 4.5 million fine on a telecommunications operator for multiple GDPR infringements. The controller transferred customer… CROATIA · ·Art. 5, 6, 12 +4 Nov 24, 2025
DSB: No processor access violation under Art. 15 GDPR when controller deleted data On 07. August 2023, the data subject made a request to the processor to provide the report and the questionnaire completed by the data subject at an information event. The… 2025-0.566.415 ·Austria ·Art. 4, 5, 12 +3 Nov 21, 2025
€16,650 Legal Entity: Insufficient technical and organisational measures to ensure information security The Slovenian DPA has imposed a fine of EUR 16,650 on a legal entity. The controller stored personal data on a publicly accessible web server without taking sufficient technical… SLOVENIA · ·Art. 32 Nov 21, 2025
€1.4M LastPass UK Ltd: Insufficient technical and organisational measures to ensure information security The UK DPA has imposed a fine of £ 1,228,283 (EUR 1,400,000) on LastPass UK Ltd. The controller suffered a succesfull cyber attack due to insufficient technical and organisational… UNITED KINGDOM · ·Art. 5, 32 Nov 20, 2025
€1.4M LastPass UK Ltd: Insufficient technical and organizational measures to ensure information security. ⇄ 1.400.000 euro boete - Informatiecommissaris (ICO) UNITED KINGDOM · ·Art. 5, 32 Nov 20, 2025
€3,000 Greencorp S.R.L.: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 3,000 on Greencorp S.R.L. The controller failed to implement adequate technical and organisational measures to ensure data security,… ROMANIA · ·Art. 32 Nov 19, 2025
€3,000 Greencorp S.R.L.: Insufficient technical and organizational measures to ensure information security. ⇄ Een boete van 3.000 euro - van de Roemeense nationale toezichthoudende autoriteit voor de verwerking van persoonsgegevens (ANSPDCP). ROMANIA · ·Art. 32 Nov 19, 2025