Content type · 112 documents in this view · 3,634 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities3564 Processing Agreement2800 Processing2632 Personal Data2596 Controllers2211 Data Controller1862 Law Enforcement1540 IP Address1282 Security1024 Supervision879 Monitoring545 Consent518
€10,000 AEPD (Spain) - PS/00249/2025 MÁS SOL ENERGÍA 15, S.L., the controller, is a company that carries out customer acquisition through telephone calls to offer solar panel installation services. On 18 November… Art. 4, 5, 7 +1 Aug 12, 2026
RON 108,570 ANSPDCP (Romania) - Fine against Homelux SRL HOMELUX S.R.L. (the controller) notified the Romanian DPA (ANSPDCP) of a personal data breach pursuant to Article 33 GDPR. The controller was operating a website on a platform… Art. 32 Aug 11, 2026
RON 30 ANSPDCP (Romania) - Fine against There's an AI for that S.R.L In October 2025, the Romanian National Supervisory Authority for Personal Data Processing (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal –… Art. 4 Jul 24, 2026
HUF 2M NAIH fines online store HUF 2M for unclear and incomplete privacy notice The DPA initiated an investigation into the GDPR compliance of an online store (the controller) processing the data of its customers (the data subjects) in April 2025. The… Hungary ·Art. 12, 13 Jul 22, 2026
BfDI: Legal uncertainty in German telecom data protection law (TKG/TMG) requires urgent Both of the TKG and TMG are fundamental for the electronic communication and there are many regulations still written in both laws that are only partially or not valid at all.… 2021-02-18 - 4/2021 ·Germany Jul 17, 2026
€2M Italian DPA sanctions Lusha Systems for processing contact data without consent in B2B Lusha Systems Inc. (the controller) operated a subscription-based platform that provided professional contact information through a business-to-business (B2B) database. It was an… Italy · ·Art. 3, 5, 6 +2 Jul 14, 2026
EDPB - Binding Decision 1/2026 On 10 August 2021, a data subject represented by noyb lodged a complaint with the Austrian DPA against Vlaamse Radio- en Televisieomroeporganisatie (VRT), the controller. The… Binding Decision 1/2026 ·European Union ·Art. 4, 57, 60 +3 May 28, 2026
HUF 15M NAIH fines online store HUF 15M for transparency and Article 12(1) GDPR violations The DPA initiated an investigation into the processing of personal data of customers (the data subjects) by the operator of an online store (the controller) in April 2025. The… Hungary ·Art. 5, 12, 13 May 12, 2026
HUF 10M NAIH fines online store HUF 10M for missing and inadequate privacy notice The DPA initiated an investigation into the processing of the personal data of customers (the data subjects) by the operator of an online store (the controller) in April 2025. The… Hungary ·Art. 5, 12, 13 Apr 30, 2026
€10,000 Radio Immagine Uno S.r.l.: Insufficient fulfilment of data subjects rights Italian Data Protection Authority (Garante) fined Radio Immagine Uno S.r.l. €10,000 on 2026-02-26 for: Insufficient fulfilment of data subjects rights. Italy · ·Art. 12 Feb 26, 2026
€12,000 Ministero dell’Economia e delle Finanze: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Ministero dell’Economia e delle Finanze €12,000 on 2026-02-26 for: Insufficient legal basis for data processing. Italy · ·Art. 5, 6, 28 Feb 26, 2026
€5,000 Conservatory: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Conservatory €5,000 on 2026-02-26 for: Insufficient legal basis for data processing. Italy · ·Art. 5, 6, 10 Feb 26, 2026
€15,000 Ministero delle Imprese e del Made in Italy: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Ministero delle Imprese e del Made in Italy €15,000 on 2026-02-26 for: Insufficient legal basis for data processing. ·Art. 5, 6, 9 +1 ·Insufficient legal basis for data processing Feb 26, 2026
€1,000 Ciemme S.r.l.s.: Insufficient cooperation with supervisory authority Italian Data Protection Authority (Garante) fined Ciemme S.r.l.s. €1,000 on 2026-02-26 for: Insufficient cooperation with supervisory authority. Italy · ·Art. 58 Feb 26, 2026
€15,000 Depac Società Cooperativa Sociale a r.l.: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Depac Società Cooperativa Sociale a r.l. €15,000 on 2026-02-26 for: Insufficient legal basis for data processing. Italy · ·Art. 5, 9, 13 +2 Feb 26, 2026
€3,000 Groupharma s.r.l.s.: Insufficient fulfilment of data subjects rights Italian Data Protection Authority (Garante) fined Groupharma s.r.l.s. €3,000 on 2026-02-26 for: Insufficient fulfilment of data subjects rights. Italy · ·Art. 5, 12, 15 +1 Feb 26, 2026
€15,000 Flamel S.r.l.: Non-compliance with general data processing principles Italian Data Protection Authority (Garante) fined Flamel S.r.l. €15,000 on 2026-02-26 for: Non-compliance with general data processing principles. Italy · ·Art. 8, 11, 25 +3 Feb 26, 2026
€30,000 S.M. Trattamento Acqua di XX: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined S.M. Trattamento Acqua di XX €30,000 on 2026-02-26 for: Insufficient legal basis for data processing. Italy · ·Art. 4, 5, 6 +6 Feb 26, 2026
€32,000 Dedalus Italia S.p.A.: Insufficient technical and organisational measures to ensure information security Italian Data Protection Authority (Garante) fined Dedalus Italia S.p.A. €32,000 on 2026-02-26 for: Insufficient technical and organisational measures to ensure information… Italy · ·Art. 32 Feb 26, 2026
€2,000 Istituto Tecnico Statale “Luigi Einaudi” di Correggio: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Istituto Tecnico Statale “Luigi Einaudi” di Correggio €2,000 on 2026-02-26 for: Insufficient legal basis for data processing. Italy · ·Art. 5, 6 Feb 26, 2026
€15,000 Ministero delle Imprese e del Made in Italy: Insufficient data processing agreement Italian Data Protection Authority (Garante) fined Ministero delle Imprese e del Made in Italy €15,000 on 2026-02-26 for: Insufficient data processing agreement. ·Art. 28 ·Insufficient data processing agreement Feb 26, 2026
€12,000 Based s.r.l.: Insufficient fulfilment of data subjects rights Italian Data Protection Authority (Garante) fined Based s.r.l. €12,000 on 2026-02-12 for: Insufficient fulfilment of data subjects rights. Italy · ·Art. 5, 12, 13 +2 Feb 12, 2026
€4,000 Order of Physicians, Surgeons and Dentists of the Province of Macerata: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Order of Physicians, Surgeons and Dentists of the Province of Macerata €4,000 on 2026-02-12 for: Insufficient legal basis for… Italy · ·Art. 5, 6 Feb 12, 2026
€2,000 Sole Trader: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Sole Trader €2,000 on 2026-02-12 for: Insufficient legal basis for data processing. Italy · ·Art. 5, 6, 13 +1 Feb 12, 2026
€5,000 Unleadmited S.r.l.: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Unleadmited S.r.l. €5,000 on 2026-02-12 for: Insufficient legal basis for data processing. Italy · ·Art. 5, 6, 7 +1 Feb 12, 2026
€1,000 Sole Trader: Insufficient fulfilment of information obligations Italian Data Protection Authority (Garante) fined Sole Trader €1,000 on 2026-02-12 for: Insufficient fulfilment of information obligations. Italy · ·Art. 5, 13 Feb 12, 2026
€30,000 Sportitalia Società Sportiva Dilettantistica a.r.l.: Insufficient fulfilment of data subjects rights Italian Data Protection Authority (Garante) fined Sportitalia Società Sportiva Dilettantistica a.r.l. €30,000 on 2026-02-12 for: Insufficient fulfilment of data subjects rights. Italy · ·Art. 12, 17 Feb 12, 2026
€1,500 Sole Trader: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Sole Trader €1,500 on 2026-02-12 for: Insufficient legal basis for data processing. Italy · ·Art. 5, 13, 25 Feb 12, 2026
€15,000 Depurazione Acqua S.r.l.: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Depurazione Acqua S.r.l. €15,000 on 2026-02-12 for: Insufficient legal basis for data processing. Italy · ·Art. 4, 5, 6 +3 Feb 12, 2026
€6,000 Comune di Coccaglio: Non-compliance with general data processing principles Italian Data Protection Authority (Garante) fined Comune di Coccaglio €6,000 on 2026-02-12 for: Non-compliance with general data processing principles. Italy · ·Art. 5, 6, 12 +3 Feb 12, 2026
€4,000 Comune di Mazara del Vallo: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Comune di Mazara del Vallo €4,000 on 2026-02-12 for: Insufficient legal basis for data processing. Italy · ·Art. 5, 6, 12 +2 Feb 12, 2026
€15,000 Lex Iuris S.r.l.: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Lex Iuris S.r.l. €15,000 on 2026-02-12 for: Insufficient legal basis for data processing. Italy · ·Art. 6, 15 Feb 12, 2026
€2,000 Comune di Monterotondo: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Comune di Monterotondo €2,000 on 2026-02-12 for: Insufficient legal basis for data processing. Italy · ·Art. 5, 13, 88 Feb 12, 2026
€15,000 Bressanelli Galli Gelpi Porta & C. S.r.l.: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Bressanelli Galli Gelpi Porta & C. S.r.l. €15,000 on 2026-02-12 for: Insufficient legal basis for data processing. Italy · ·Art. 5, 6, 7 +3 Feb 12, 2026
€2,000 Comune di Velletri: Non-compliance with general data processing principles Italian Data Protection Authority (Garante) fined Comune di Velletri €2,000 on 2026-02-12 for: Non-compliance with general data processing principles. Italy · ·Art. 5, 6, 12 +2 Feb 12, 2026
€2,000 Federazione Nazionale Ordini Professioni Infermieristiche (FNOPI): Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Federazione Nazionale Ordini Professioni Infermieristiche (FNOPI) €2,000 on 2026-01-29 for: Insufficient legal basis for data… Italy · ·Art. 5, 6 Jan 29, 2026
€10,000 Istituto tecnico industriale statale “Stanislao Cannizzaro” di Catania: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Istituto tecnico industriale statale “Stanislao Cannizzaro” di Catania €10,000 on 2026-01-29 for: Insufficient legal basis for… Italy · ·Art. 5, 6, 9 Jan 29, 2026
€50,000 Università Telematica e-Campus: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Università Telematica e-Campus €50,000 on 2026-01-29 for: Insufficient legal basis for data processing. Italy · ·Art. 5, 6, 9 +1 Jan 29, 2026
€12,000 Ministero della Cultura: Non-compliance with general data processing principles Italian Data Protection Authority (Garante) fined Ministero della Cultura €12,000 on 2026-01-29 for: Non-compliance with general data processing principles. Italy · ·Art. 5, 6, 12 +3 Jan 29, 2026
€12,000 Istituto San Giuseppe La Salle di Milano: Non-compliance with general data processing principles Italian Data Protection Authority (Garante) fined Istituto San Giuseppe La Salle di Milano €12,000 on 2026-01-29 for: Non-compliance with general data processing principles. Italy · ·Art. 5, 6, 12 +3 Jan 29, 2026
€5,000 Dr. Paolo Montemurro: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Dr. Paolo Montemurro €5,000 on 2026-01-29 for: Insufficient legal basis for data processing. Italy · ·Art. 5, 9 Jan 29, 2026
DSB Austria: No fine imposed on COVID mask shop for cookie consent failure Following the first COVID-19 outbreak in March 2020, a limited liability company (the controller) decided to offer protective masks to the general public. It set up an online shop… 2026-0.043.390 ·Art. 5, 12, 13 Jan 16, 2026
€21,650 Timegrip AS: Insufficient fulfilment of data subjects rights The Norwegian DPA has imposed a fine of EUR 21,650 on Timegrip AS. The controller had been tracking the working hours of employees at a company that went bankrupt. A former… NORWAY · ·Art. 15 Jan 16, 2026
€10,000 Ikea Ibérica: Onvoldoende juridische basis voor de verwerking van persoonsgegevens. Boete van €10.000 - Spaanse Autoriteit voor Gegevensbescherming (AEPD). SPAIN · ·Art. 6 Dec 30, 2025
€10,000 Ikea Ibérica: Insufficient legal basis for data processing The company installed cookies on an end users terminal device without prior consent of the data subject. SPAIN · ·Art. 6 Dec 30, 2025
€120,000 Pioneer Hi-Bred Italia Sementi s.r.l.: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 120,000 on Pioneer Hi-Bred Italia Sementi s.r.l. The controller installed satellite telematics tracking devices to monitor driving… ITALY · ·Art. 5, 6, 28 Dec 18, 2025
€1.5M AMERICAN EXPRESS CARTE FRANCE: Insufficient legal basis for data processing The French DPA has imposed a fine of EUR 1,500,000 on AMERICAN EXPRESS CARTE FRANCE. The controller used excessive cookies on its website and failed to adequately inform data… ·Art. 82 ·Insufficient legal basis for data processing Nov 27, 2025
€1.5M AMERICAN EXPRESS CARTE FRANCE: Onvoldoende juridische basis voor de verwerking van gegevens. 1.500.000 euro boete - Frans Nationaal Instituut voor Gegevensbescherming (CNIL). ·Art. 82 ·Insufficient legal basis for data processing Nov 27, 2025
€750,000 LES PUBLICATIONS CONDE NAST: Non-compliance with general data processing principles The French DPA has imposed a fine of EUR 750,000 on LES PUBLICATIONS CONDE NAST. The controller used multiple cookies on its website but failed to adequately implement them. FRANCE · ·Art. 82 Nov 20, 2025
€750,000 LES PUBLICATIES CONDE NAST: Niet-naleving van algemene principes voor gegevensverwerking. Een boete van 750.000 euro - van de Franse Autoriteit voor Gegevensbescherming (CNIL). FRANCE · ·Art. 82 Nov 20, 2025