Content type · 3,808 documents in this view · 3,813 in total

Enforcement

Regulatory actions, fines, warnings, and enforcement decisions

🇪🇺 EU 🇳🇱 NL
Enforcement dashboard — fines by country, authority and article →
Filter by Topic Supervisory Authorities 3589 Processing 2636 Personal Data 2395 Controllers 2018 Processing Agreement 1114 Security 1013 Supervision 847 Healthcare 621 Law Enforcement 568 Monitoring 547 Public Authority 539 Consent 508
251–300 of 3,808 sort newestlargest fineoldest
€100M Ridetech International B.V.: Insufficient legal basis for data processing Dutch Supervisory Authority for Data Protection (AP) fined Ridetech International B.V. €100,000,000 on 2026-04-01 for: Insufficient legal basis for data processing. The Netherlands ·AP ·Art. 5, 44, 46 Supervision Supervisory Authorities Processing Apr 1, 2026
€13,491 Legal Person: Insufficient technical and organisational measures to ensure information security Slovenian Supervisory Authority (Informacijski pooblaščenec) fined Legal Person €13,491 on 2026-03-27 for: Insufficient technical and organisational measures to ensure information… Slovenia ·IP-RS ·Art. 32 Security Supervision IP Address Mar 27, 2026
€1,000 Euro Bangla Minimarket in Jesi: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Euro Bangla Minimarket in Jesi €1,000 on 2026-03-26 for: Insufficient legal basis for data processing. Italy ·Garante ·Art. 5, 88 Processing Employees Supervisory Authorities Mar 26, 2026
€2,000 Business Owner: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Business Owner €2,000 on 2026-03-26 for: Insufficient legal basis for data processing. Italy ·Garante ·Art. 5, 13, 88 Supervisory Authorities Processing Mar 26, 2026
€2,000 Copacabana s.r.l.: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Copacabana s.r.l. €2,000 on 2026-03-26 for: Insufficient legal basis for data processing. Italy ·Garante ·Art. 5, 13, 88 Supervisory Authorities Processing Healthcare Mar 26, 2026
€5,000 Esselunga S.p.A.: Insufficient fulfilment of data subjects rights Italian Data Protection Authority (Garante) fined Esselunga S.p.A. €5,000 on 2026-03-26 for: Insufficient fulfilment of data subjects rights. Italy ·Garante ·Art. 12, 15 Personal Data Supervisory Authorities Employees Mar 26, 2026
€2,000 Physician: Insufficient fulfilment of data subjects rights Italian Data Protection Authority (Garante) fined Physician €2,000 on 2026-03-26 for: Insufficient fulfilment of data subjects rights. Italy ·Garante ·Art. 13 Personal Data Supervisory Authorities Healthcare Mar 26, 2026
€96,000 Eni S.p.A.: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Eni S.p.A. €96,000 on 2026-03-26 for: Insufficient legal basis for data processing. Italy ·Garante ·Art. 5, 6 Processing Supervisory Authorities Mar 26, 2026
€2,500 Comune di Cassino: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Comune di Cassino €2,500 on 2026-03-26 for: Insufficient legal basis for data processing. Italy ·Garante ·Art. 5, 6 Processing Education Public Authority Mar 26, 2026
€5,000 Municipality: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Municipality €5,000 on 2026-03-26 for: Insufficient legal basis for data processing. Italy ·Garante ·Art. 5, 6, 9 Processing Public Authority Employees Mar 26, 2026
€3,000 Municipality: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Municipality €3,000 on 2026-03-26 for: Insufficient legal basis for data processing. Italy ·Garante ·Art. 5, 6, 9 Processing Public Authority Employees Mar 26, 2026
€3,000 Piacenza Bar Association: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Piacenza Bar Association €3,000 on 2026-03-26 for: Insufficient legal basis for data processing. Italy ·Garante ·Art. 5, 6 Processing Education Public Authority Mar 26, 2026
€32M Intesa Sanpaolo S.p.A.: Insufficient technical and organisational measures to ensure information security Italian Data Protection Authority (Garante) fined Intesa Sanpaolo S.p.A. €31,800,000 on 2026-03-26 for: Insufficient technical and organisational measures to ensure information… Italy ·Garante ·Art. 5, 24, 32 +1 Security Supervisory Authorities Insurance Mar 26, 2026
€125,000 RENAULT COMMERCIAL ROUMANIE S.R.L.: Insufficient technical and organisational measures to ensure information security Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) fined RENAULT COMMERCIAL ROUMANIE S.R.L. €125,000 on 2026-03-25 for: Insufficient technical and… Romania ·ANSPDCP ·Art. 28, 32 Security Supervisory Authorities Supervision Mar 25, 2026
€6,300 Advertising Agency: Insufficient legal basis for data processing Austrian Data Protection Authority (dsb) fined Advertising Agency €6,300 on 2026-03-24 for: Insufficient legal basis for data processing. Austria ·DSB ·Art. 5, 6, 13 Supervisory Authorities Processing Direct Marketing Mar 24, 2026
€4,000 ING Bank NV Amsterdam – Sucursala București S.A.: Insufficient technical and organisational measures to ensure information security Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) fined ING Bank NV Amsterdam – Sucursala București S.A. €4,000 on 2026-03-23 for: Insufficient… Romania ·ANSPDCP ·Art. 32 Security Personal Data Supervisory Authorities Mar 23, 2026
€3,000 Domeniul Public și Privat SA: Insufficient legal basis for data processing Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) fined Domeniul Public și Privat SA €3,000 on 2026-03-20 for: Insufficient legal basis for data… Romania ·ANSPDCP ·Art. 5, 6, 12 +1 Personal Data Supervision Supervisory Authorities Mar 20, 2026
€3,000 Public and Private Domain SA: Insufficient legal basis for data processing Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) fined Public and Private Domain SA €3,000 on 2026-03-20 for: Insufficient legal basis for data… Romania ·ANSPDCP ·Art. 5, 6, 12 +1 Personal Data Supervision Supervisory Authorities Mar 20, 2026
€150,000 ALÍA GESTIÓN INTEGRAL DE SERVICIOS, S.L.: Insufficient technical and organisational measures to ensure information security The Spanish Data Protection Authority (AEPD) fined ALÍA GESTIÓN INTEGRAL DE SERVICIOS, S.L. €150,000 for failing to implement sufficient technical and organizational measures to… Spain ·AEPD ·Art. 5 Integrity and Confidentiality Principle Security Personal Data Mar 20, 2026
The data subject was employed by an Austrian stock corporation (the controller) from August 2018 to June 2025 They worked as a manager in the controller’s finance department, with technical and disciplinary responsibility for up to five employees. The controller operated a 360-degree… 2025-0.960.016 ·Austria ·DSB Legitimate Interest Personal Data Controllers Mar 20, 2026
€600 CENTRO MEDICO REY FERNANDO, S.L.P.: Insufficient fulfilment of data subjects rights Spanish Data Protection Authority (aepd) fined CENTRO MEDICO REY FERNANDO, S.L.P. €600 on 2026-03-13 for: Insufficient fulfilment of data subjects rights. Spain ·AEPD ·Art. 12 Personal Data Supervisory Authorities Healthcare Mar 13, 2026
€18,000 RAMÓN GRAU, S.L.: Insufficient legal basis for data processing Spanish Data Protection Authority (aepd) fined RAMÓN GRAU, S.L. €18,000 on 2026-03-13 for: Insufficient legal basis for data processing. Spain ·AEPD ·Art. 6, 13 Supervisory Authorities Employees Processing Mar 13, 2026
€450 Housing Association: Insufficient cooperation with supervisory authority Spanish Data Protection Authority (aepd) fined Housing Association €450 on 2026-03-13 for: Insufficient cooperation with supervisory authority. Spain ·AEPD ·Art. 58 Supervision Supervisory Authorities Mar 13, 2026
€600 SERVICIOS INMOBILIARIOS Y GESTIÓN RCL MADRID, S.L.: Insufficient cooperation with supervisory authority Spanish Data Protection Authority (aepd) fined SERVICIOS INMOBILIARIOS Y GESTIÓN RCL MADRID, S.L. €600 on 2026-03-13 for: Insufficient cooperation with supervisory authority. Spain ·AEPD ·Art. 58 Supervision Supervisory Authorities Mar 13, 2026
€2,000 Liceo Scientifico Morgagni di Roma: Insufficient technical and organisational measures to ensure information security Italian Data Protection Authority (Garante) fined Liceo Scientifico Morgagni di Roma €2,000 on 2026-03-12 for: Insufficient technical and organisational measures to ensure… Italy ·Garante ·Art. 5, 6, 9 +1 Security Education Public Authority Mar 12, 2026
€2,000 Comune di Sutri: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Comune di Sutri €2,000 on 2026-03-12 for: Insufficient legal basis for data processing. Italy ·Garante ·Art. 5, 6 Processing Education Public Authority Mar 12, 2026
€2,000 Hanako s.r.l.: Insufficient technical and organisational measures to ensure information security Italian Data Protection Authority (Garante) fined Hanako s.r.l. €2,000 on 2026-03-12 for: Insufficient technical and organisational measures to ensure information security. Italy ·Garante ·Art. 5, 13, 32 Security Supervisory Authorities Healthcare Mar 12, 2026
€800 Barber Shop: Insufficient fulfilment of information obligations Italian Data Protection Authority (Garante) fined Barber Shop €800 on 2026-03-12 for: Insufficient fulfilment of information obligations. Italy ·Garante ·Art. 5, 13 Supervisory Authorities Mar 12, 2026
€40,000 La7 S.p.A.: Non-compliance with general data processing principles Italian Data Protection Authority (Garante) fined La7 S.p.A. €40,000 on 2026-03-12 for: Non-compliance with general data processing principles. Italy ·Garante ·Art. 5 Processing IP Address Telecommunications Mar 12, 2026
€50,000 ITAS Mutua: Insufficient fulfilment of data subjects rights Italian Data Protection Authority (Garante) fined ITAS Mutua €50,000 on 2026-03-12 for: Insufficient fulfilment of data subjects rights. Italy ·Garante ·Art. 5, 12, 13 +2 Personal Data Supervisory Authorities Employees Mar 12, 2026
€563,052 Enel Energia S.p.A.: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Enel Energia S.p.A. €563,052 on 2026-03-12 for: Insufficient legal basis for data processing. Italy ·Garante ·Art. 5, 6, 7 +2 Supervisory Authorities Processing Mar 12, 2026
€40,000 INPS – Istituto nazionale previdenza sociale: Insufficient technical and organisational measures to ensure information security Italian Data Protection Authority (Garante) fined INPS – Istituto nazionale previdenza sociale €40,000 on 2026-03-12 for: Insufficient technical and organisational measures to… Italy ·Garante ·Art. 5, 6, 9 +2 Security Education Public Authority Mar 12, 2026
€650,000 IBERIA LÍNEAS AÉREAS DE ESPAÑA, S.A. OPERADORA: Insufficient technical and organisational measures to ensure information security Spanish Data Protection Authority (aepd) fined IBERIA LÍNEAS AÉREAS DE ESPAÑA, S.A. OPERADORA €650,000 on 2026-03-11 for: Insufficient technical and organisational measures to… Spain ·AEPD ·Art. 5 Security Supervisory Authorities Mar 11, 2026
€6,000 CUMACA MOTOR, S.L.: Insufficient legal basis for data processing Spanish Data Protection Authority (aepd) fined CUMACA MOTOR, S.L. €6,000 on 2026-03-10 for: Insufficient legal basis for data processing. Spain ·AEPD ·Art. 5 Processing Supervisory Authorities Mar 10, 2026
€60,000 AEPD: Ramona Films failed to comply with Article 58(2) order to provide processor RAMONA FILMS, S.L., the controller, operated websites offering audiovisual content through subscriptions. In November 2023, the DPA fined the controller in proceedings… Spain ·Art. 28, 58 Controllers Processors Processing Agreement Mar 9, 2026
€400,000 Italian DPA finds Cerved Group failed to disclose creditworthiness scores in Art. 15 The DPA received several complaints from data subjects concerning Cerved Group S.p.A. (the controller) an Italian credit rating agency. The controller was processing the personal… Italy ·Garante ·Art. 5, 12, 15 +3 Supervisory Authorities Personal Data Right of Access Mar 7, 2026
€8,000 Altex Romania S.R.L.: Insufficient cooperation with supervisory authority Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) fined Altex Romania S.R.L. €8,000 on 2026-03-05 for: Insufficient cooperation with supervisory… ANSPDCP ·Art. 58 ·Insufficient cooperation with supervisory authority Supervision Supervisory Authorities Personal Data Mar 5, 2026
€200,000 ARES CAPITAL, S.A.: Insufficient legal basis for data processing Spanish Data Protection Authority (aepd) fined ARES CAPITAL, S.A. €200,000 on 2026-03-04 for: Insufficient legal basis for data processing. Spain ·AEPD ·Art. 5, 6, 13 Supervisory Authorities Processing Employees Mar 4, 2026
Slovenian DPA: Controller breached Art. 32, 15 and 34 GDPR over data breach and access A controller, not named in the original decision but presumed to be a public institution, notified the Slovenian DPA after experiencing a data breach in relation to its website.… 0612-91/2025/40 ·Slovenia ·IP-RS Data Breaches Controllers Supervisory Authorities Mar 4, 2026
€8,500 HIGHCLIFFE ESTATES MARBELLA, S.L.: Insufficient legal basis for data processing Spanish Data Protection Authority (aepd) fined HIGHCLIFFE ESTATES MARBELLA, S.L. €8,500 on 2026-03-02 for: Insufficient legal basis for data processing. Spain ·AEPD ·Art. 6 Supervisory Authorities Processing Mar 2, 2026
€900 ORNITOLÓGICA DE ANDALUCÍA FOA: Non-compliance with general data processing principles Spanish Data Protection Authority (aepd) fined ORNITOLÓGICA DE ANDALUCÍA FOA €900 on 2026-03-02 for: Non-compliance with general data processing principles. Spain ·AEPD ·Art. 5 Processing IP Address Supervisory Authorities Mar 2, 2026
€2,000 MALAGASUITE SHOWROOM, S.L.: Insufficient fulfilment of data subjects rights Spanish Data Protection Authority (aepd) fined MALAGASUITE SHOWROOM, S.L. €2,000 on 2026-03-02 for: Insufficient fulfilment of data subjects rights. Spain ·AEPD ·Art. 13 Personal Data Supervisory Authorities Healthcare Mar 2, 2026
Woo decision: Fine decision and decision on objection ⇄ Enforcement Supervision Mar 2, 2026
Ten municipalities each fined EUR 25,000 for violating GDPR Articles 5, 6 and 9 ⇄ The municipalities concerned are Delft, Ede, Eindhoven, Gooise Meren, Haarlemmermeer, Hilversum, Huizen, Tilburg, Veenendaal and Zoetermeer. Each is fined EUR 25,000 for violating… Enforcement Supervision Mar 2, 2026
€5,000 Suomen Numerokeskus Oy: Insufficient fulfilment of data subjects rights Deputy Data Protection Ombudsman fined Suomen Numerokeskus Oy €5,000 on 2026-03-02 for: Insufficient fulfilment of data subjects rights. Finland ·Deputy Data Protection Ombudsman ·Art. 15 Personal Data Mar 2, 2026
€12,000 HOLY MARY CATHOLIC SCHOOL, S.L.: Insufficient legal basis for data processing Spanish Data Protection Authority (aepd) fined HOLY MARY CATHOLIC SCHOOL, S.L. €12,000 on 2026-03-01 for: Insufficient legal basis for data processing. Spain ·AEPD ·Art. 5, 6, 35 Supervisory Authorities Processing Education Mar 1, 2026
€1,000 Spain DPA: Non-compliance with general data processing principles Spanish Data Protection Authority (aepd) fined an unnamed party €1,000 on 2026-03-01 for: Non-compliance with general data processing principles. AEPD ·Art. 5 ·Non-compliance with general data processing principles Processing Supervisory Authorities IP Address Mar 1, 2026
€2,000 Istituto Tecnico Statale “Luigi Einaudi” di Correggio: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Istituto Tecnico Statale “Luigi Einaudi” di Correggio €2,000 on 2026-02-26 for: Insufficient legal basis for data processing. Italy ·Garante ·Art. 5, 6 Processing Employees Cookies Feb 26, 2026
€10,000 Radio Immagine Uno S.r.l.: Insufficient fulfilment of data subjects rights Italian Data Protection Authority (Garante) fined Radio Immagine Uno S.r.l. €10,000 on 2026-02-26 for: Insufficient fulfilment of data subjects rights. Italy ·Garante ·Art. 12 Personal Data Supervisory Authorities Cookies Feb 26, 2026
€32,000 Dedalus Italia S.p.A.: Insufficient technical and organisational measures to ensure information security Italian Data Protection Authority (Garante) fined Dedalus Italia S.p.A. €32,000 on 2026-02-26 for: Insufficient technical and organisational measures to ensure information… Italy ·Garante ·Art. 32 Security Telecommunications Cookies Feb 26, 2026