Content type · 2,018 documents in this view · 3,813 in total

Enforcement

Regulatory actions, fines, warnings, and enforcement decisions

🇪🇺 EU 🇳🇱 NL
Enforcement dashboard — fines by country, authority and article →
Filtering by Topic Clear filter Supervisory Authorities 3589 Processing 2636 Personal Data 2395 Controllers 2018 Processing Agreement 1114 Security 1013 Supervision 847 Healthcare 621 Law Enforcement 568 Monitoring 547 Public Authority 539 Consent 508
401–450 of 2,018 sort newestlargest fineoldest
€3M Allium UPI: Insufficient technical and organizational measures to ensure information security. ⇄ Een boete van 3.000.000 euro - De Estische Autoriteit voor Gegevensbescherming (AKI). ESTONIA ·AKI ·Insufficient technical and organisational measures to ensure information security Security Data Breaches Minors Sep 5, 2025
€9,700 Landlord: Insufficient legal basis for data processing The Belgian DPA has imposed a fine of EUR 9,700 on a Landlord. The controller installed video surveillance in and around a student residence. However, the surveillance was too… BELGIUM ·APD/GBA ·Art. 5, 6 Controllers Processing Video Surveillance Sep 4, 2025
€870 Company: Insufficient compliance with obligations regarding the notification of data breaches. ⇄ 870 euro boete - Oostenrijkse Autoriteit voor Gegevensbescherming (dsb). AUSTRIA ·DSB ·Art. 33 Data Breaches Supervisory Authorities Controllers Sep 4, 2025
€870 Company: Insufficient fulfilment of data breach notification obligations The Austrian DPA has imposed a fine of EUR 870 on a company. After being informed of a data breach, the controller took adequate measures to close it but failed to inform the DPA. AUSTRIA ·DSB ·Art. 33 Notification Obligation Data Breaches Notified Body Reporting and Notification Obligations Sep 4, 2025
€9,700 Landlord: Insufficient legal basis for processing personal data. ⇄ 9.700 euro boete - Belgische Autoriteit voor gegevensbescherming (APD). BELGIUM ·APD/GBA ·Art. 5, 6 Processing Personal Data Controllers Sep 4, 2025
€180,000 Sociedad de Gestión de Activos Procedentes de la Reestructuración Bancaria S.A.: Insufficient technical and organisational measures to ensure information security The Spanish DPA has imposed a fine of EUR 180,000 on Sociedad de Gestión de Activos Procedentes de la Reestructuración Bancaria S.A. The controller suffered a cyber attack due to… SPAIN ·AEPD ·Art. 5, 28 Controllers Processors Security Sep 4, 2025
€200,900 ILVA A/S: Non-compliance with general data processing principles The Danish DPA has imposed a fine of EUR 200,900 on ILVA A/S. The controller failed to implement data deletion deadlines. This led to an infringement of the principle of storage… DENMARK ·Datatilsynet (DK) ·Non-compliance with general data processing principles Storage Limitation Retention Period Controllers Sep 2, 2025
€200,900 ILVA A/S: Violation of general principles for data processing. ⇄ Een boete van 200.900 euro - De Deense Autoriteit voor Gegevensbescherming (Datatilsynet). DENMARK ·Datatilsynet (DK) ·Non-compliance with general data processing principles Retention Period Storage Limitation Controllers Sep 2, 2025
€1,200 Company: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 1,200 on a company. The controller used personal data for a purpose, which did not align with the initial purpose. The original fine of… SPAIN ·AEPD ·Art. 6 Controllers Personal Data Processing Agreement Sep 1, 2025
€150M INFINITE STYLES SERVICES CO. LIMITED: Insufficient legal basis for data processing The French DPA has imposed a fine of EUR 150,000,000 on INFINITE STYLES SERVICES CO. LIMITED, which operates under the name 'SHEIN'. The controller used cookies unlawfully on its… FRANCE ·CNIL ·Art. 82 Controllers Personal Data Cookies Sep 1, 2025
€200M GOOGLE LLC: Insufficient legal basis for the processing of data. ⇄ 200 miljoen euro boete - Frans Nationaal Instituut voor Gegevensbescherming (CNIL). FRANCE ·CNIL ·Art. 82 Controllers Personal Data Processing Sep 1, 2025
€150M INFINITE STYLES SERVICES CO. LIMITED: Insufficient legal basis for the processing of personal data. ⇄ 150 miljoen euro boete - Franse Autoriteit voor Gegevensbescherming (CNIL). FRANCE ·CNIL ·Art. 82 Personal Data Processing Controllers Sep 1, 2025
€200M GOOGLE LLC: Insufficient legal basis for data processing The French DPA has imposed a fine of EUR 200,000,000 on GOOGLE LLC. While creating an account for the controller's services, the controller designed the cookie consent process in… FRANCE ·CNIL ·Art. 82 Controllers Personal Data Cookies Sep 1, 2025
€125M GOOGLE IRELAND LIMITED: Insufficient legal basis for data processing The French DPA has imposed a fine of EUR 125,000,000 on GOOGLE IRELAND LIMITED. While creating an account for the controller's services, the controller designed the cookie consent… FRANCE ·CNIL ·Art. 82 Controllers Personal Data Cookies Sep 1, 2025
€10,000 La Fântâna S.R.L.: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 10,000 on La Fântâna S.R.L. The controller suffered a cyber attack due to insufficient technical and organisational measures to ensure… ROMANIA ·ANSPDCP ·Art. 32 Security Controllers Personal Data Sep 1, 2025
€10,000 La Fântâna S.R.L.: Insufficient technical and organisational measures to ensure information security. ⇄ Een boete van €10.000 - De Roemeense nationale toezichthoudende autoriteit voor de verwerking van persoonsgegevens (ANSPDCP). ROMANIA ·ANSPDCP ·Art. 32 Security Processing Personal Data Sep 1, 2025
€1,200 Company: Insufficient legal basis for the processing of data. ⇄ 1.200 euro boete - Spaanse Autoriteit voor Gegevensbescherming (AEPD). SPAIN ·AEPD ·Art. 6 Controllers Personal Data Processing Sep 1, 2025
€125M GOOGLE IRELAND LIMITED: Insufficient legal basis for the processing of data. ⇄ 125.000.000 euro boete - Franse Autoriteit voor Gegevensbescherming (CNIL). FRANCE ·CNIL ·Art. 82 Controllers Personal Data Processing Sep 1, 2025
€2,000 GESTIÓN DE VENTAS IBERIA S.L.: Insufficient fulfilment of data subjects rights The Spanish DPA has imposed a fine of EUR 2,000 on GESTIÓN DE VENTAS IBERIA S.L. The controller contacted a data subject for direct marketing purposes, thereby violating local… SPAIN ·AEPD ·Art. 14 Personal Data Controllers Marketing Aug 31, 2025
€2,000 GESTIÓN DE VENTAS IBERIA S.L.: Insufficient compliance with data subjects' rights. ⇄ Een boete van 2.000 euro - Spaanse Autoriteit voor Gegevensbescherming (AEPD). SPAIN ·AEPD ·Art. 14 Personal Data Marketing Controllers Aug 31, 2025
€2,400 KVIKU SPAIN, S.L.: Insufficient legal basis for the processing of personal data. ⇄ Een boete van 2.400 euro - opgelegd door de Spaanse autoriteit voor gegevensbescherming (AEPD). AEPD ·Art. 6 ·Insufficient legal basis for data processing Personal Data Processing Consent Aug 29, 2025
€1,200 GOHIPOTECA, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR on GOHIPOTECA, S.L. The controller processed data of a data subject without a sufficient legal basis. The contract used as the basis for… SPAIN ·AEPD ·Art. 6 Controllers Personal Data Insurance Aug 29, 2025
€1,200 GOHIPOTECA, S.L.: Insufficient legal basis for the processing of personal data. ⇄ 1.200 euro boete - Spaanse Autoriteit voor Gegevensbescherming (AEPD). SPAIN ·AEPD ·Art. 6 Personal Data Processing Controllers Aug 29, 2025
€2,400 KVIKU SPAIN, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 2,400 on KVIKU SPAIN, S.L. The controller processed personal data of a data subject without sufficient consent. The original fine of EUR… AEPD ·Art. 6 ·Insufficient legal basis for data processing Personal Data Consent Controllers Aug 29, 2025
€300 Driving School: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine of EUR 300 on a driving school. The controller has installed video surveillance, but failed to adequatly inform data subjects. The original fine… SPAIN ·AEPD ·Art. 13 Personal Data Controllers Supervisory Authorities Aug 26, 2025
€4.3M ING Bank Śląski: Insufficient legal basis for data processing The Polish DPA has imposed a fine of EUR 4,323,250 on ING Bank Śląski. The controller scanned the identity documents of every customer and potential customer without a sufficient… POLAND ·UODO ·Art. 5, 6 Controllers Personal Data Processing Aug 26, 2025
€300 Driving School: Insufficient Compliance with Information Obligations. ⇄ Een boete van 300 euro - Spaanse Autoriteit voor Gegevensbescherming (AEPD). SPAIN ·AEPD ·Art. 13 Controllers Personal Data Processing Aug 26, 2025
€1,800 LEIVA BUS, S.L.: Insufficient technical and organisational measures to ensure information security The Spanish DPA has imposed a fine of EUR 1,800 on LEIVA BUS, S.L. The controller leaked personal data due to insufficient technical and organisational measures to ensure data… SPAIN ·AEPD ·Art. 5 Security Controllers Personal Data Aug 25, 2025
€5,400 YUNEXPRESS SPAIN, S.L.: Insufficient agreement regarding data processing. ⇄ Boete van €5.400 - Spaanse Autoriteit voor Gegevensbescherming (AEPD). AEPD ·Art. 5, 28 ·Insufficient data processing agreement Controllers Processors Processing Aug 25, 2025
€5,400 YUNEXPRESS SPAIN, S.L.: Insufficient data processing agreement The Spanish DPA has imposed a fine of EUR 5,400 on YUNEXPRESS SPAIN, S.L. The controller used a data processor and failed to sign a sufficient data processing agreement. The… AEPD ·Art. 5, 28 ·Insufficient data processing agreement Processors Controllers Processing Aug 25, 2025
€1,800 LEIVA BUS, S.L.: Insufficient technical and organizational measures to ensure information security. ⇄ 1.800 euro boete - Spaanse Autoriteit voor Gegevensbescherming (AEPD). SPAIN ·AEPD ·Art. 5 Security Controllers Accountability Aug 25, 2025
€18,000 GRUPO BONATEL SL: Insufficient technical and organizational measures to ensure information security. ⇄ Een boete van €18.000 - van de Spaanse Autoriteit voor Gegevensbescherming (AEPD). SPAIN ·AEPD ·Art. 5 Security Controllers Accountability Aug 22, 2025
€6,000 BANCO INVERSIS, S.A.: Insufficient technical and organisational measures to ensure information security The Spanish DPA has imposed a fine of EUR 6,000 on BANCO INVERSIS, S.A. The controller suffered a data leak due to insufficient technical and organisational measures to ensure… SPAIN ·AEPD ·Art. 5 Security Controllers Processing Agreement Aug 22, 2025
€18,000 GRUPO BONATEL SL: Insufficient technical and organisational measures to ensure information security The Spanish DPA has imposed a fine of EUR 18,000 on the GRUPO BONATEL SL. The controller suffered a data leak due to insufficient technical and organisational measures to ensure… SPAIN ·AEPD ·Art. 5 Security Controllers Telecommunications Aug 22, 2025
€6,000 BANCO INVERSIS, S.A.: Insufficient technical and organisational measures to ensure information security. ⇄ Boete van 6.000 euro - Spaanse Autoriteit voor Gegevensbescherming (AEPD). SPAIN ·AEPD ·Art. 5 Security Controllers Accountability Aug 22, 2025
€3,000 SC Elite Conta SRL: Insufficient technical and organisational measures to ensure information security. ⇄ Een boete van 3.000 euro - van de Roemeense nationale toezichthoudende autoriteit voor de verwerking van persoonsgegevens (ANSPDCP). ROMANIA ·ANSPDCP ·Art. 32 Security Processing Personal Data Aug 18, 2025
€3,000 SC Elite Conta SRL: Insufficient technical and organisational measures to ensure information security The Romainian DPA has imposed a fine of EUR 3,000 on SC Elite Conta SRL. The controller failed to implement adequate technical and organisational measures to ensure data security,… ROMANIA ·ANSPDCP ·Art. 32 Security Controllers Personal Data Aug 18, 2025
€42,000 WORLD 2 MEET, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 42,000 on WORLD 2 MEET, S.L. The controller requires its guests to provide a copy of their identity card or passport for registration… SPAIN ·AEPD ·Art. 5 Controllers Processing IP Address Aug 14, 2025
€500 Sole Trader: Insufficient cooperation with supervisory authority The Slovenian DPA has imposed a fine of EUR 500 on a sole trader. The controller failed to react to a request by the DPA within the set 10-day period. SLOVENIA ·IP-RS ·Art. 31 Supervision Supervisory Authorities Controllers Aug 13, 2025
€1,600 REAL FEDERACIÓN ESPAÑOLA DE TENIS DE MESA: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 1,600 on the REAL FEDERACIÓN ESPAÑOLA DE TENIS DE MESA. The controller pubilshed personal data on its website without a sufficient legal… SPAIN ·AEPD ·Art. 5 Personal Data Controllers Processing Aug 12, 2025
€3,000 'FLEXICREDIT' Mutual Aid House Association: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 3,000 on 'FLEXICREDIT' Mutual Aid House Association. The controller failed to implement adequate technical and organisational measures… ROMANIA ·ANSPDCP ·Art. 32 Security Controllers Personal Data Aug 12, 2025
€66,000 REAL SOCIEDAD DE FUTBOL S.A.D.: Insufficient technical and organisational measures to ensure information security The Spanish DPA has imposed a fine of EUR 66,000 on REAL SOCIEDAD DE FUTBOL S.A.D. The controller suffered a ransomwareattack due to insufficient technical and organisational… SPAIN ·AEPD ·Art. 5, 32 Security Controllers Processing Agreement Aug 12, 2025
€66,000 REAL SOCIEDAD DE FUTBOL S.A.D.: Insufficient technical and organisational measures to ensure information security. ⇄ Een boete van 66.000 euro - opgelegd door de Spaanse autoriteit voor gegevensbescherming (AEPD). SPAIN ·AEPD ·Art. 5, 32 Security Controllers Accountability Aug 12, 2025
€3,000 'FLEXICREDIT' Mutual Aid Cooperative: Insufficient technical and organisational measures to ensure information security. ⇄ Een boete van 3.000 euro - van de Roemeense nationale toezichthoudende autoriteit voor de verwerking van persoonsgegevens (ANSPDCP). ROMANIA ·ANSPDCP ·Art. 32 Security Processing Personal Data Aug 12, 2025
€4,800 GACM SEGUROS GENERALES, COMPAÑIA DE SEGUROS Y REASEGUROS S.A.U.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 4,800 on GACM SEGUROS GENERALES, COMPAÑIA DE SEGUROS Y REASEGUROS S.A.U. The controller failed to process customer data accurately,… SPAIN ·AEPD ·Art. 5 Controllers Personal Data Processing Aug 12, 2025
€1,600 REAL FEDERACIÓN ESPAÑOLA DE TENIS DE MESA: Insufficient legal basis for the processing of personal data. ⇄ 1.600 euro boete - Spaanse Autoriteit voor Gegevensbescherming (AEPD). SPAIN ·AEPD ·Art. 5 Personal Data Processing Controllers Aug 12, 2025
€4,800 GACM SEGUROS GENERALES, an insurance and reinsurance company S.A.U.: Non-compliance with the general principles of data processing. ⇄ Een boete van 4.800 euro - opgelegd door de Spaanse autoriteit voor gegevensbescherming (AEPD). SPAIN ·AEPD ·Art. 5 Controllers Processing Accountability Aug 12, 2025
€80,000 BIZUM, S.L.: Insufficient technical and organisational measures to ensure information security. ⇄ Een boete van 80.000 euro - opgelegd door de Spaanse autoriteit voor gegevensbescherming (AEPD). SPAIN ·AEPD ·Art. 32 Security Controllers Data Breaches Aug 11, 2025
€80,000 BIZUM, S.L.: Insufficient technical and organisational measures to ensure information security The Spanish DPA has imposed a fine of EUR 80,000 on BIZUM, S.L. The controller failed to implement sufficient technical and organisational measures to ensure data security,… SPAIN ·AEPD ·Art. 32 Security Controllers Data Breaches Aug 11, 2025
€6,200 Media Company: Insufficient cooperation with supervisory authority The Austrian DPA has imposed a fine of EUR 6,200 on a media company. The controller failed to comply with an order from the DPA to implement an adequate cookie banner. AUSTRIA ·DSB ·Art. 58 Supervisory Authorities Supervision Controllers Aug 6, 2025