Content type · 2,657 documents in this view · 3,843 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities 3615 Processing 2657 Personal Data 2430 Controllers 2040 Processing Agreement 1116 Security 1025 Supervision 869 Healthcare 624 Public Authority 577 Law Enforcement 576 Monitoring 552 Consent 511
€8,000 PREMIER RESTAURANTS ROMANIA SRL: Insufficient technical and organizational measures to ensure information security. ⇄ 8.000 euro boete - De Roemeense nationale toezichthoudende autoriteit voor de verwerking van persoonsgegevens (ANSPDCP). ·Art. 28, 32 ·Insufficient technical and organisational measures to ensure information security Jan 13, 2026
€1M CNIL fines data processor €1,000,000 for unlawful retention, purpose conflict, and no ROPA The data protection authority (DPA) has imposed a fine of 1 million euros on a data processor for failing to delete user personal data, processing that data for purposes that… France Jan 13, 2026
€200 A medical student (the controller) worked as a ward attendant at a hospital Her duties were to remain in the immediate vicinity of patients, ensure their safety and notify the nursing staff immediately when necessary. While assigned to a patient with… 2026-0.016.479 ·Austria · Jan 12, 2026
€200 Medical Student: Insufficient legal basis for data processing The Austrian Data Protection Authority (dsb) fined a medical student €200 for processing personal data without a sufficient legal basis under GDPR Article 6(1)(f) and Article… Austria · ·Art. 6, 9 Jan 12, 2026
€1.7M CNIL fines data processor €1.7M for misconfigured disability-records software causing The data protection authority (DPA) has imposed a fine of €1,700,000 on a data processor that had incorrectly configured a software program. This program processed files related… France Jan 12, 2026
€500 VOX ESPAÑA: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 500 on VOX ESPAÑA. The controller, a political party, posted a picture of of a receipt on its Facebook page. The picture of the recipt… SPAIN · ·Art. 6 Jan 10, 2026
€8,000 KVIKU SPAIN, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 8,000 on KVIKU SPAIN, S.L.The controller requires customers to send a photo of themselves holding their ID card when verifying their… ·Art. 5 ·Non-compliance with general data processing principles Jan 10, 2026
€18,500 Komendanta Miejskiego Policji w Krakowie: Non-compliance with general data processing principles The Polish DPA has imposd a fine of EUR 18,500 on the Komendanta Miejskiego Policji w Krakowie. The controller published personal data, including health data, of a data subject… POLAND · ·Non-compliance with general data processing principles Jan 9, 2026
The controller, an Austrian registered association, operates a therapy centre for psychosomatic illnesses The data subject was a patient of the controller. On 28 July 2025, the data subject sent an access request by email under Article 15 GDPR, asking for full information on all… DSB-D124.2437/25 ·Austria · Jan 9, 2026
€18,500 Commander of the Municipal Police of Krakow: Failure to Comply with General Data Protection Principles ⇄ 18.500 euro boete - Poolse nationale autoriteit voor de bescherming van persoonlijke gegevens (UODO). POLAND · ·Non-compliance with general data processing principles Jan 9, 2026
€10,000 Headquarter of a Fire Brigade: Insufficient legal basis for data processing The Greek DPA has imposed a fine of EUR 10,000 on a Fire Brigade Head Quarter. The controller had stored health data of an employee which had been in relation with her sick leave.… GREECE · ·Art. 5 Jan 8, 2026
€2,000 Money Seeds S.R.L.: Insufficient fulfilment of data subjects rights The Romanian DPA has imposed a fine of EUR 2,000 on Money Seeds S.R.L. The controller failed to fulfil a data subject's request to exercise their rights. ROMANIA · ·Art. 12, 13, 14 Jan 8, 2026
VDAI (Lithuania) - Decision no. 3R-1700. ⇄ Facts: The Data Protection Authority (DPA) ruled that a gambling provider had lawfully transferred data to a processor for the purpose of sending invitations to sporting events,… 3R-1700 ·Litouwen Jan 7, 2026
€5,000 Sole Trader: Non-compliance with general data processing principles Slovenian Supervisory Authority (Informacijski pooblaščenec) fined Sole Trader €5,000 on 2026-01-06 for: Non-compliance with general data processing principles. Slovenia · ·Art. 5 Jan 6, 2026
€5,500 Online retailer: Insufficient fulfilment of information obligations The Hungarian National Authority for Data Protection and the Freedom of Information (NAIH) fined an online retailer €5,500 for failing to adequately fulfill its information… Hungary · ·Art. 12, 13 Jan 1, 2026
€80,000 ONE WAY PRIVATE COMPANY: Non-compliance with general data processing principles The Greek DPA has imposed a fine of EUR 80,000 on ONE WAY PRIVATE COMPANY. The fined entity is the processor of Thessaloniki–Thessaly Gas Supply Company S.A. (ETid-3016). The… GREECE · ·Art. 5, 6, 7 +2 Dec 31, 2025
€10,000 Thessaloniki–Thessaly Gas Supply Company S.A.: Insufficient data processing agreement The Greek DPA has imposed a fine of EUR 10,000 on Thessaloniki–Thessaly Gas Supply Company S.A. The controller, an energy provider, used external processors for direct marketing… GREECE · ·Art. 28, 32 Dec 31, 2025
€5,000 Vodafone España, S.A.U.: Non-compliance with general data processing principles The spanish telecommunications and informations agancy (SETSI) decided Vodafone had to reimburse a customer for costs he was wrongfully charged for. Nevertheless, Vodafone… SPAIN · ·Art. 5
€600 GERMANY DPA: Insufficient legal basis for data processing Unlawful use of a dashcam Art. 6 ·Insufficient legal basis for data processing
€118 GERMANY, DPA: Insufficient legal basis for data processing. ⇄ 118 euro boete - Autoriteit voor gegevensbescherming van Saarland. Art. 6 ·Insufficient legal basis for data processing Dec 30, 2025
€10,000 Roumasport S.R.L: Insufficient technical and organizational measures to ensure information security. ⇄ Een boete van €10.000 - De Roemeense nationale toezichthouder op de verwerking van persoonsgegevens (ANSPDCP). ROMANIA · ·Art. 32 Dec 30, 2025
SLOVAKIA, Data Protection Authority: Insufficient legal basis for the processing of personal data. ⇄ Slovaakse Autoriteit voor de Bescherming van Persoonsgegevens. ·Art. 5, 6 ·Insufficient legal basis for data processing Dec 30, 2025
€3,140 UniCredit Bank Czech Republic and Slovakia, a.s.: Insufficient legal basis for data processing The bank established a personal bank account for a data subject without his consent or knowledge. The bank supposedly had his personal data available because the subject had… ·Art. 6 ·Insufficient legal basis for data processing
€20,000 Telecommunications company: Insufficient legal basis for data processing The Croatian DPA (azop) has imposed a fine of EUR 20,000 on a telecommunications company. A data subject had filed a complaint with the DPA claiming that the company was still… CROATIA · ·Art. 5, 6
€40,000 Slovak Telekom: Insufficient technical and organizational measures to ensure information security. ⇄ Een boete van 40.000 euro - van het Slowaakse databeschermingskantoor. SLOVAKIA · ·Art. 32 Dec 30, 2025
€60,000 Debt collection agency (GESTIÓN DE COBROS, YO COBRO SL): Insufficient legal basis for the processing of personal data. ⇄ Boete van 60.000 euro - Spaanse Autoriteit voor Gegevensbescherming (AEPD). SPAIN · ·Art. 5 Dec 30, 2025
SLOVAKIA DPA: Insufficient legal basis for data processing Personal data have been unlawfully published on the website of a city within the framework of fulfilling its disclosure obligation under the Freedom of Information Act. However,… ·Art. 5, 6 ·Insufficient legal basis for data processing
€60,000 ENDESA (energy supplier): Insufficient legal basis for data processing. ⇄ Een boete van 60.000 euro - opgelegd door de Spaanse autoriteit voor gegevensbescherming (AEPD). SPAIN · ·Art. 5 Dec 30, 2025
€20,000 Telecommunications company: Insufficient legal basis for data processing. ⇄ The Croatian data protection authority (DPA) has imposed a fine of 20,000 euros on a telecommunications company. A data subject had filed a complaint with the DPA, claiming that… CROATIA · ·Art. 5, 6 Dec 30, 2025
€960 POLAND DPA: Insufficient cooperation with supervisory authority The Polish DPA (UODO) has fined a data controller EUR 1,450 for failing to provide information requested by the DPA during an investigation. ·Art. 58 ·Insufficient cooperation with supervisory authority
SLOVAKIA: Insufficient technical and organisational measures to ensure information security. ⇄ Slovaakse Autoriteit voor de Bescherming van Persoonsgegevens. ·Art. 5, 32 ·Insufficient technical and organisational measures to ensure information security Dec 30, 2025
€300 GERMANY DPA: Insufficient legal basis for data processing Unlawful use of a dashcam Art. 6 ·Insufficient legal basis for data processing
SLOVAKIA DPA: Insufficient fulfilment of data subjects rights A Data Controller failed to comply with data subject´s request to access his/her personal data processed by audio recordings. ·Art. 15 ·Insufficient fulfilment of data subjects rights
€3.5M Company: Non-compliance with general data processing principles The French DPA has imposed a fine of EUR 3,500,000 on a company. The controller operated a loyalty program in France and 16 other EU countries, using customer data obtained… FRANCE · ·Art. 6, 13, 32 +1 Dec 30, 2025
€27,000 Vodafone España, S.A.U.: Inadequate compliance with data subjects' rights in the processing of personal data. ⇄ Een boete van 27.000 euro - opgelegd door de Spaanse autoriteit voor gegevensbescherming (AEPD). SPAIN · ·Art. 5 Dec 30, 2025
€50 GERMANY DPA: Insufficient legal basis for data processing Unlawful use of a dashcam Art. 6 ·Insufficient legal basis for data processing
€60,000 Debt collecting agancy (GESTIÓN DE COBROS, YO COBRO SL): Insufficient legal basis for data processing After the claimant did alledgedly not pay back a microcredit to an online credit agany, the claim was assigned to the debt collecting agancy. Subsequently, the latter startet… SPAIN · ·Art. 5
€588 Alza.cz a.s.: Insufficient legal basis for data processing The company obtained a copy of photographic ID of the personal data subject with his consent, however did not react to his consent withdrawal and continued in processing of his… CZECH REPUBLIC · ·Art. 6, 7
€10,000 Ikea Ibérica: Insufficient legal basis for data processing The company installed cookies on an end users terminal device without prior consent of the data subject. SPAIN · ·Art. 6
€60,000 ENDESA (energy supplyer): Insufficient legal basis for data processing The complainant's bank account was charged by ENDESA, the beneficiary of which was a third party, who had been convicted under criminal law and imposed with a two-year restraining… SPAIN · ·Art. 5
€588 Alza.cz a.s.: Insufficient legal basis for the processing of data. ⇄ Een boete van 588 euro - opgelegd door de Tsjechische Autoriteit voor Gegevensbescherming (UOOU). CZECH REPUBLIC · ·Art. 6, 7 Dec 30, 2025
SLOVAKIA, DPA: Insufficient compliance with data subjects' rights. ⇄ Slovaakse Autoriteit voor Gegevensbescherming. ·Art. 15 ·Insufficient fulfilment of data subjects rights Dec 30, 2025
€40,000 Slovak Telekom: Insufficient technical and organisational measures to ensure information security The controller did not take adequate security measures when processing personal data, thereby breaching the obligation to protect the processed personal data. SLOVAKIA · ·Art. 32
€10,000 Ikea Ibérica: Insufficient legal basis for the processing of personal data. ⇄ Boete van €10.000 - Spaanse Autoriteit voor Gegevensbescherming (AEPD). SPAIN · ·Art. 6 Dec 30, 2025
€9,600 Restaurant (SANTI 3000, S.L.): Insufficient legal basis for the processing of personal data. ⇄ Boete van €9.600 - Spaanse Autoriteit voor Gegevensbescherming (AEPD). SPAIN · ·Art. 5, 6 Dec 30, 2025
€960 POLAND, Personal Data Protection Authority: Insufficient cooperation with the supervisory authority. ⇄ Een boete van 960 euro - van het Poolse nationale bureau voor de bescherming van persoonlijke gegevens (UODO). ·Art. 58 ·Insufficient cooperation with supervisory authority Dec 30, 2025
€5,000 Vodafone España, S.A.U.: Violation of the general principles for data processing. ⇄ Een boete van 5.000 euro - opgelegd door de Spaanse Autoriteit voor Gegevensbescherming (AEPD). SPAIN · ·Art. 5 Dec 30, 2025
€9,600 Restaurant (SANTI 3000, S.L.): Insufficient legal basis for data processing A restaurant wanted to impose disciplinary sanctions on an employee using images from a mobile phone video which was recorded by another employee in the restaurant for evidence… SPAIN · ·Art. 5, 6
€3,140 UniCredit Bank Czech Republic and Slovakia, a.s.: Insufficient legal basis for data processing. ⇄ Boete van €3.140 - Tsjechische Autoriteit voor Gegevensbescherming (UOOU). ·Art. 6 ·Insufficient legal basis for data processing Dec 30, 2025
€10,000 Roumasport S.R.L: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 10,000 on Roumasport S.R.L The controller failed to implement adequate technical and organisational measures, resulting in multiple… ROMANIA · ·Art. 32 Dec 30, 2025