Content type · 3,429 documents in this view · 3,634 in total

Enforcement

Regulatory actions, fines, warnings, and enforcement decisions

🇪🇺 EU 🇳🇱 NL
Enforcement dashboard — fines by country, authority and article →
Filtering by Topic Clear filter Supervisory Authorities3564 Processing Agreement2800 Processing2632 Personal Data2596 Controllers2211 Data Controller1862 Law Enforcement1540 IP Address1282 Security1024 Supervision879 Monitoring545 Consent518
301–350 of 3,429 sort newestlargest fineoldest
€16,650 Legal Entity: Insufficient technical and organisational measures to ensure information security The Slovenian DPA has imposed a fine of EUR 16,650 on a legal entity. The controller stored personal data on a publicly accessible web server without taking sufficient technical… SLOVENIA ·Art. 32 ·Insufficient technical and organisational measures to ensure information security Security Controllers Processing Agreement Nov 21, 2025
€750,000 LES PUBLICATIONS CONDE NAST: Non-compliance with general data processing principles The French DPA has imposed a fine of EUR 750,000 on LES PUBLICATIONS CONDE NAST. The controller used multiple cookies on its website but failed to adequately implement them. FRANCE ·CNIL ·Art. 82 Cookies IP Address Controllers Nov 20, 2025
€1.4M LastPass UK Ltd: Insufficient technical and organisational measures to ensure information security The UK DPA has imposed a fine of £ 1,228,283 (EUR 1,400,000) on LastPass UK Ltd. The controller suffered a succesfull cyber attack due to insufficient technical and organisational… UNITED KINGDOM ·ICO ·Art. 5, 32 Security Processing Agreement Controllers Nov 20, 2025
€1.4M LastPass UK Ltd: Onvoldoende technische en organisatorische maatregelen om de informatiebeveiliging te waarborgen. 1.400.000 euro boete - Informatiecommissaris (ICO) UNITED KINGDOM ·ICO ·Art. 5, 32 Security Accountability Controllers NL Nov 20, 2025
€800 SOBLADA RESTAURACIÓN, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 800 on SOBLADA RESTAURACIÓN, S.L. The controller installed video surveillance without providing the necessary information signs or… SPAIN ·aepd ·Art. 5, 13 Video Surveillance Monitoring Controllers Nov 19, 2025
€2,000 ASOCIACIÓN NACIONAL DE TASADORES Y PERITOS JUDICIALES INFORMÁTICOS: Insufficient fulfilment of data subjects rights The Spanish DPA has imposed a fine of EUR 2,000 on the ASOCIACIÓN NACIONAL DE TASADORES Y PERITOS JUDICIALES INFORMÁTICOS. The controller published a court ruling which included… SPAIN ·aepd ·Art. 13, 17 Personal Data Controllers Processing Agreement Nov 19, 2025
€3,000 Greencorp S.R.L.: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 3,000 on Greencorp S.R.L. The controller failed to implement adequate technical and organisational measures to ensure data security,… ROMANIA ·ANSPDCP ·Art. 32 Security Controllers Processing Agreement Nov 19, 2025
€800 SOBLADA RESTAURACIÓN, S.L.: Overtreding van de algemene principes voor gegevensverwerking. 800 euro boete - Spaanse Autoriteit voor Gegevensbescherming (AEPD). SPAIN ·aepd ·Art. 5, 13 Video Surveillance Processing Data Controller NL Nov 19, 2025
€60,000 STRATESYS TECHNOLOGY SOLUTIONS, S.L.: Insufficient technical and organisational measures to ensure information security The Spanish DPA has imposed a fine of EUR 60,000 on STRATESYS TECHNOLOGY SOLUTIONS, S.L. The controller failed to implement adequate technical and organisational measures,… SPAIN ·aepd ·Art. 5 Data Breaches Security Controllers Nov 19, 2025
€60,000 STRATESYS TECHNOLOGY SOLUTIONS, S.L.: Onvoldoende technische en organisatorische maatregelen om de informatiebeveiliging te waarborgen. Een boete van 60.000 euro - opgelegd door de Spaanse autoriteit voor gegevensbescherming (AEPD). SPAIN ·aepd ·Art. 5 Security Data Breaches Accountability NL Nov 19, 2025
€3,000 Greencorp S.R.L.: Onvoldoende technische en organisatorische maatregelen om de informatiebeveiliging te waarborgen. Een boete van 3.000 euro - van de Roemeense nationale toezichthoudende autoriteit voor de verwerking van persoonsgegevens (ANSPDCP). ROMANIA ·ANSPDCP ·Art. 32 Security Controllers Processing NL Nov 19, 2025
€80 Journalist: Insufficient legal basis for data processing The Austrian DPA has imposed a fine of EUR 80 on a Journalist. The controller published unnecessary private data about a data subject on social media, including their address. AUSTRIA ·dsb ·Art. 5, 6 Personal Data Social Media Controllers Nov 18, 2025
€8,000 PGS SOFA & CO SRL: Onvoldoende technische en organisatorische maatregelen om de informatiebeveiliging te waarborgen. 8.000 euro boete - De Roemeense nationale toezichthoudende autoriteit voor de verwerking van persoonsgegevens (ANSPDCP). ROMANIA ·ANSPDCP ·Art. 32 Security Processing Controllers NL Nov 17, 2025
€8,000 PGS SOFA & CO SRL: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 8,000 on PGS SOFA & CO SRL. The controller suffered a successful cyber attack due to insufficient technical and organisational measures. ROMANIA ·ANSPDCP ·Art. 32 Security Processing Agreement Controllers Nov 17, 2025
€4,750 Powiatowego Inspektora Sanitarnego w Policach: Insufficient technical and organisational measures to ensure information security The Polish DPA has imposed a fine of EUR 4750 on the Powiatowego Inspektora Sanitarnego w Policach. The controller failed to implement adequate technical and organisational… POLAND ·UODO ·Art. 5, 24, 25 +1 Encryption Data Breaches Security Nov 15, 2025
€2,400 AXARQUIA VELEZ DENTAL, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 2,400 on AXARQUIA VELEZ DENTAL, S.L. The controller used video surveillance to ensure security at its facility, affecting more areas than… SPAIN ·aepd ·Art. 5 Video Surveillance Healthcare Controllers Nov 14, 2025
€72,000 AEPD sanctions Tiger Media Inc. for installing advertising cookies without user consent Tiger Media Inc., the controller, operated an advertising platform for publishers and advertisers of adult products and services. The platform acted as an ad network, connecting… Spain ·Art. 6, 27 Legitimate Interest Cookies Telecommunications Nov 14, 2025
€2,400 AXARQUIA VELEZ DENTAL, S.L.: Niet-naleving van de algemene principes voor gegevensverwerking. Een boete van 2.400 euro - opgelegd door de Spaanse autoriteit voor gegevensbescherming (AEPD). SPAIN ·aepd ·Art. 5 Health Data Video Surveillance Processing NL Nov 14, 2025
€6,000 Comune di Orte: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 6,000 on the Comuni di Orte. The controller implemented video surveillance on its territory in a manner that did not comply with the… ITALY ·Garante ·Art. 5, 6, 12 +2 Video Surveillance IP Address Controllers Nov 13, 2025
€6,000 Gemeente Orte: Niet-naleving van de algemene principes voor gegevensverwerking. Een boete van 6.000 euro - van de Italiaanse Autoriteit voor Gegevensbescherming (Garante). ITALY ·Garante ·Art. 5, 6, 12 +2 Video Surveillance Processing Education NL Nov 13, 2025
€40,000 Quarantadue S.r.l.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 40,000 on Quarantadue S.r.l. The controller produced a television series about a criminal case which included real audio recordings that… ITALY ·Garante ·Art. 5 Controllers IP Address Processing Nov 13, 2025
€4,000 Fan Courier Express S.R.L.: Onvoldoende naleving van de rechten van betrokkenen. Een boete van 4.000 euro - van de Roemeense nationale toezichthoudende autoriteit voor de verwerking van persoonsgegevens (ANSPDCP). ROMANIA ·ANSPDCP ·Art. 5, 6, 12 +2 Personal Data Data Controller Controllers NL Nov 12, 2025
€4,000 Fan Courier Express S.R.L.: Insufficient fulfilment of data subjects rights The Romanian DPA has imposed a fine of EUR 4,000 on Fan Courier Express S.R.L. The controller failed to adequately react to a data subject's request to exercise their rights, and… ROMANIA ·ANSPDCP ·Art. 5, 6, 12 +2 Personal Data Controllers Processing Nov 12, 2025
€2,000 Whitedecor SRL: Onvoldoende juridische basis voor de verwerking van persoonsgegevens. Een boete van 2.000 euro - van de Roemeense nationale toezichthoudende autoriteit voor de verwerking van persoonsgegevens (ANSPDCP). ROMANIA ·ANSPDCP ·Art. 6, 7, 12 +3 Processing Personal Data Data Controller NL Nov 10, 2025
€2,000 Whitedecor SRL: Insufficient legal basis for data processing The Romanian DPA has imposed a fine of EUR 2,000 on Whitedecor SRL. The controller had sent marketing messages to customers without a sufficient legal basis. ROMANIA ·ANSPDCP ·Art. 6, 7, 12 +3 Controllers Direct Marketing Processing Agreement Nov 10, 2025
€1,000 Bedrijf: Onvoldoende naleving van de rechten van betrokkenen (betreffende hun persoonsgegevens). Boete van €1.000 - Griekse Autoriteit voor Gegevensbescherming (HDPA). GREECE ·HDPA ·Art. 12, 15 Personal Data Right of Access Data Controller NL Nov 7, 2025
€7,000 Klass Wagen S.R.L.: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 7,000 on Klass Wagen S.R.L. The controller suffered a cyber incident due to a former employee exposing the login credentials of… ROMANIA ·ANSPDCP ·Art. 32 Security Controllers Law Enforcement Nov 7, 2025
€7,000 Klass Wagen S.R.L.: Onvoldoende technische en organisatorische maatregelen om de informatiebeveiliging te waarborgen. Boete van €7.000 - Roemeense nationale toezichthoudende autoriteit voor de verwerking van persoonsgegevens (ANSPDCP). ROMANIA ·ANSPDCP ·Art. 32 Security Controllers Processing NL Nov 7, 2025
€1,000 Company: Insufficient fulfilment of data subjects rights The Greek DPA has imposed a fine of EUR 1,000 on a Company. The controller failed to react adequately to a data subject's request to exercise their rights. GREECE ·HDPA ·Art. 12, 15 Personal Data Controllers Supervisory Authorities Nov 7, 2025
€10M Aena, een klein en middelgroot bedrijf (KMO), S.A.: Niet-naleving van de algemene principes voor gegevensverwerking. 10.043.002 euro boete - Spaanse Autoriteit voor Gegevensbescherming (AEPD). SPAIN ·aepd ·Art. 35 Privacy Impact Assessment Processing Controllers NL Nov 6, 2025
€10M Aena, S.M.E., S.A.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 10,043,002 on Aena, S.M.E., S.A. The controller conducted a pilot project involving multiple airports, including the use of facial… SPAIN ·aepd ·Art. 35 DPIA Privacy Impact Assessment IP Address Nov 6, 2025
€750 ASOCIACIÓN ESCUELA NACIONAL DE EQUITACIÓN: Onvoldoende samenwerking met de toezichthoudende instantie. Een boete van €750 - Spaanse Autoriteit voor Gegevensbescherming (AEPD). SPAIN ·aepd ·Art. 58 Education Authority Powers for Fundamental Rights Protection Supervisory Authorities NL Nov 5, 2025
€750 ASOCIACIÓN ESCUELA NACIONAL DE EQUITACIÓN: Insufficient cooperation with supervisory authority The Spanish DPA has imposed a fine of EUR 750 on the ASOCIACIÓN ESCUELA NACIONAL DE EQUITACIÓN. The controller failed to certify compliance with the corrective measures imposed by… SPAIN ·aepd ·Art. 58 Supervisory Authorities Supervision Public Authority Nov 5, 2025
€300,000 SIA 'ZZ Dats': Insufficient technical and organisational measures to ensure information security The Latvian DPA has imposed a fine of EUR 300,000 on SIA 'ZZ Dats'. The entity that was fined was the data processor for almost all local governments in Latvia. It failed to… LATVIA ·DSI ·Art. 32 Data Breaches Processors Security Oct 28, 2025
€6,000 APARELLS ORTOPEDICS CURTO, S.L: Onvoldoende naleving van de rechten van betrokkenen. Een boete van 6.000 euro - opgelegd door de Spaanse autoriteit voor gegevensbescherming (AEPD). SPAIN ·aepd ·Art. 5 Health Data Healthcare Personal Data NL Oct 28, 2025
€6,000 APARELLS ORTOPEDICS CURTO, S.L: Insufficient fulfilment of data subjects rights The Spanish DPA has imposed a fine of EUR 6,000 on APARELLS ORTOPEDICS CURTO, S.L. The controller was unable to retain the data it was required to ensure the availability of,… SPAIN ·aepd ·Art. 5 Controllers Personal Data Healthcare Oct 28, 2025
€300,000 SIA 'ZZ Dats': Onvoldoende technische en organisatorische maatregelen om de informatiebeveiliging te waarborgen. Een boete van 300.000 euro - Inspectie gegevensbescherming (DSI). LATVIA ·DSI ·Art. 32 Security Data Processor Data Breaches NL Oct 28, 2025
€9,450 Gynaecologisch centrum: Onvoldoende naleving van de verplichtingen om datalekken te melden. Boete van €9.450 - Pools Nationaal Bureau voor de Bescherming van Persoonsgegevens (UODO). POLAND ·UODO ·Insufficient fulfilment of data breach notification obligations Data Breaches Health Data Healthcare NL Oct 27, 2025
€9,450 Gynecological Center: Insufficient fulfilment of data breach notification obligations The Polish DPA has imposed a fine of EUR 9,450 on a Gynecological Center. The controller sufferd a data breach and failed to report this to the DPO. POLAND ·UODO ·Insufficient fulfilment of data breach notification obligations Notification Obligation Data Breaches Notified Body Reporting and Notification Obligations Oct 27, 2025
€1,500 Shop Owner: Insufficient legal basis for data processing Austrian Data Protection Authority (dsb) fined Shop Owner €1,500 on 2025-10-27 for: Insufficient legal basis for data processing. Austria ·dsb ·Art. 5, 6 IP Address Processing Human Resources Oct 27, 2025
€865,000 Aktia Pankki Oyj: Insufficient technical and organisational measures to ensure information security The Finish DPA has imposed a fine of EUR 865,000 on Aktia Pankki Oyj. The controller changed its strong authentication process in such a way that it no longer guaranteed adequate… FINLAND ·Deputy Data Protection Ombudsman ·Art. 5, 25, 32 Data Breaches Security Access Controls Oct 23, 2025
€1,000 Burgemeester van de gemeente Calvi Risorta: Er is onvoldoende juridische basis voor de verwerking van gegevens. Een boete van €1.000 - Italiaanse Autoriteit voor Gegevensbescherming (Garante). ITALY ·Garante ·Art. 5, 6, 9 Health Data Education Data Controller NL Oct 23, 2025
€20,000 Multimedia News Società Cooperativa: Insufficient fulfilment of data subjects rights The Italian DPA has imposed a fine of EUR 20,000 on Multimedia News Società Cooperativa. The controller failed to adequatly react to a request by a data subject to exercise their… ITALY ·Garante ·Art. 12 Personal Data Controllers Telecommunications Oct 23, 2025
€15,000 Ordine degli Avvocati di Latina: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 15,000 on the Ordine degli Avvocati di Latina. The controller published a document relating to criminal proceedings that included… ITALY ·Garante ·Art. 5, 6, 10 Personal Data Education Controllers Oct 23, 2025
€15,000 Comune di Curtarolo: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 15,000 on the Comune di Curtarolo. The controller used surveillance footage in disciplinary proceedings against an employee, and also… ITALY ·Garante ·Art. 5, 6, 12 +3 Monitoring Controllers Employees Oct 23, 2025
€15,000 Gemeente Curtarolo: Onvoldoende wettelijke basis voor de verwerking van gegevens. Een boete van 15.000 euro - van de Italiaanse Autoriteit voor Gegevensbescherming (Garante). ITALY ·Garante ·Art. 5, 6, 12 +3 Video Surveillance Processing Controllers NL Oct 23, 2025
€20,000 Multimedia News Società Cooperativa: Onvoldoende naleving van de rechten van betrokkenen. Een boete van 20.000 euro - van de Italiaanse Autoriteit voor Gegevensbescherming (Garante). ITALY ·Garante ·Art. 12 Personal Data Data Controller Controllers NL Oct 23, 2025
€1,000 Mayor of the Municipality of Calvi Risorta: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 1,000 on the Mayor of the Municipality of Calvi Risorta. The controller published citizens' health data during the Covid-19 pandemic… ITALY ·Garante ·Art. 5, 6, 9 Healthcare Health Data IP Address Oct 23, 2025
€5,000 Court Bailiff: Insufficient fulfilment of data breach notification obligations The Polish DPA has imposed a fine of EUR 5,000 on a court bailiff. The controller forwarded a letter containing personal data to the wrong person, failing to inform either the… POLAND ·UODO ·Art. 33, 34 Data Breaches Notification Obligation Article 19 GDPR - Notification of Rectification, Erasure or Restriction Oct 23, 2025
€2,000 Comune di Avola: Lack of appointment of data protection officer The Italian DPA has imposed a fine of EUR 2,000 on the Comune di Avola. The controller failed to communicate the DPO's contact details to the DPA. ITALY ·Garante ·Art. 37 Supervisory Authorities Public Authority Education Oct 23, 2025