Content type · 39 documents in this view · 3,634 in total

Enforcement

Regulatory actions, fines, warnings, and enforcement decisions

🇪🇺 EU 🇳🇱 NL
Enforcement dashboard — fines by country, authority and article →
Filtering by Topic Clear filter Supervisory Authorities3564 Processing Agreement2800 Processing2632 Personal Data2596 Controllers2211 Data Controller1862 Law Enforcement1540 IP Address1282 Security1024 Supervision879 Monitoring545 Consent518
1–39 of 39 sort newestlargest fineoldest
€2,000 HDPA (Greece) 33/2020 — Employee's access and erasure claims against the American College The data subject was under the employment of the College for a certain period of time, during which two female students of the College filed a complaint against the complainant… Art. 4, 5, 12 +8 Personal Data Right to be Forgotten Right of Access Procedures Jul 24, 2026
€20,000 Italian DPA: Enna Health Authority violated GDPR by publishing judicial data The provincial Health Authority of Enna (the controller) published a resolution that contained the personal data of a data subject (specifically related to their judicial… Italy ·Garante per la protezione dei dati personali ·Art. 5, 6, 10 +1 Personal Data Fairness & Transparency Right to be Forgotten Jul 18, 2026
€880,000 HDPA fines DEI for unlawful telemarketing calls to opt-out registered subscribers The Greek DPA (HDPA) received twelve complaints filed against DEI, the Greek Public Power Corporation, (the controller) from telephone subscribers (data subjects) regarding the… Greece ·Art. 5, 28, 29 +1 Personal Data Controllers Direct Marketing Jun 2, 2026
PLN 26,711 UODO (Poland) - DKE.561.4.2026 The DPA initiated an ex officio investigation against an individual (the controller) after several data subjects complained about the controller’s video surveillance extending… Art. 5 Monitoring Video Surveillance Fairness & Transparency May 22, 2026
HDPA (Greece) examines deletion request from National Registry of Undesirable Aliens The complainant, a foreign national, submitted a complaint to the Hellenic DPA through his authorized attorney, seeking his deletion from the Hellenic the National Registry of… 12/2026 ·Art. 23 Personal Data Controllers Criminal Data May 13, 2026
€6,000 Geturhotels Srl: Overtreding van de algemene principes voor gegevensverwerking. Een boete van 6.000 euro - opgelegd door de Italiaanse Autoriteit voor Gegevensbescherming (Garante). ITALY ·Garante ·Art. 5, 6, 17 +1 Processing Controllers Personal Data NL Dec 23, 2025
€3,000 Cucina di Fabio S.R.L.: Onvoldoende juridische basis voor de verwerking van persoonsgegevens. Een boete van 3.000 euro - van de Roemeense nationale toezichthoudende autoriteit voor de verwerking van persoonsgegevens (ANSPDCP). ROMANIA ·ANSPDCP ·Art. 6, 15, 17 +1 Processing Marketing Personal Data NL Nov 26, 2025
DSB Austria: Online shop violated GDPR by ignoring request to stop gender-specific On 18 September 2023, a data subject created a customer account with a public limited company operating an online shop (the controller). It allowed customers to place orders… 2025-0.950.759 ·Art. 5, 6, 16 +2 Privacy by Design Privacy by Default Privacy by Design & Default Nov 24, 2025
€2,000 NATIONALE VERENIGING VAN TAXATIE-EXPERTEN EN RECHTELIJKE EXPERTS OP HET GEBIED VAN INFORMATICA: Onvoldoende naleving van de rechten van betrokkenen bij de verwerking van persoonsgegevens. Een boete van 2.000 euro - opgelegd door de Spaanse Autoriteit voor Gegevensbescherming (AEPD). SPAIN ·aepd ·Art. 13, 17 Personal Data Processing Data Controller NL Nov 19, 2025
€2,000 Whitedecor SRL: Onvoldoende juridische basis voor de verwerking van persoonsgegevens. Een boete van 2.000 euro - van de Roemeense nationale toezichthoudende autoriteit voor de verwerking van persoonsgegevens (ANSPDCP). ROMANIA ·ANSPDCP ·Art. 6, 7, 12 +3 Processing Personal Data Data Controller NL Nov 10, 2025
€3,000 Gemeente Isola del Gran Sasso: Onvoldoende juridische basis voor de verwerking van gegevens. Een boete van 3.000 euro - opgelegd door de Italiaanse Autoriteit voor Gegevensbescherming (Garante). ITALY ·Garante ·Art. 5, 6, 10 +2 Personal Data Processing Data Controller NL Sep 25, 2025
€10,000 La Prima Srl: Onvoldoende juridische basis voor de verwerking van persoonsgegevens. Een boete van €10.000 - van de Italiaanse Autoriteit voor Gegevensbescherming (Garante). ITALY ·Garante ·Art. 6, 12, 17 +1 Personal Data Processing Data Controller NL Sep 25, 2025
€1,000 Dr. Max SRL: Onvoldoende naleving van de rechten van betrokkenen. 1.000 euro boete - Roemeense nationale toezichthoudende autoriteit voor de verwerking van persoonsgegevens (ANSPDCP). ROMANIA ·ANSPDCP ·Art. 12, 17 Right to be Forgotten Health Data Personal Data NL Sep 18, 2025
€8,000 Università degli Studi di Cassino e del Lazio Meridionale: Niet-naleving van de algemene principes voor gegevensverwerking. Een boete van 8.000 euro - van de Italiaanse Autoriteit voor Gegevensbescherming (Garante). ITALY ·Garante ·Art. 5, 6, 12 +2 Right to be Forgotten Data Controller Processing NL Jul 10, 2025
€200,000 ASNEF-EQUifax, een bedrijf dat informatie verstrekt over kredietwaardigheid, heeft onvoldoende juridische basis voor de verwerking van gegevens. Een boete van 200.000 euro - opgelegd door de Spaanse Autoriteit voor Gegevensbescherming (AEPD). SPAIN ·aepd ·Art. 6, 17 Data Controller Controllers Personal Data NL May 19, 2025
€6,000 Real Estate Agency: Insufficient cooperation with supervisory authority The Belgian DPA imposed a fine of EUR 6,000 on a real estate agency. The Belgian DPA had previously issued a remedy to the controller in an earlier case due to the controller… BELGIUM ·APD ·Art. 5, 6, 17 +1 Right to be Forgotten Controllers Data Subject Rights Exercise Modalities and Procedures Apr 24, 2025
€10,000 Dante International SA: Onvoldoende naleving van de rechten van betrokkenen bij de verwerking van persoonsgegevens. Een boete van €10.000 - De Roemeense nationale toezichthoudende autoriteit voor de verwerking van persoonsgegevens (ANSPDCP). ROMANIA ·ANSPDCP ·Art. 12, 17, 19 Personal Data Processing Article 19 GDPR - Notification of Rectification, Erasure or Restriction NL Apr 24, 2025
€6,000 Immobiliënbureau: Onvoldoende samenwerking met de toezichthoudende instantie. 6.000 euro boete - Belgische Autoriteit voor gegevensbescherming (APD). BELGIUM ·APD ·Art. 5, 6, 17 +1 Personal Data Data Controller Right to be Forgotten NL Apr 24, 2025
€1,000 Office Nova Concept SRL: Onvoldoende naleving van de rechten van betrokkenen. Een boete van €1.000 - De Roemeense nationale toezichthoudende autoriteit voor de verwerking van persoonsgegevens (ANSPDCP). ROMANIA ·ANSPDCP ·Art. 12, 15, 17 +1 Right of Access Personal Data Right to Object NL Apr 14, 2025
€18,000 Multiple Companies: Insufficient legal basis for data processing The Italian DPA imposed fines on 3 companies which ammount to EUR 6,000 each. The fined companies (Powerfit s.s.d.a.r.l., Soleo s.s.d.a.r.l. and Zero Due Villa s.s.d.a.r.l.) run a… ITALY ·Garante ·Art. 5, 6, 12 +1 Right to be Forgotten Direct Marketing Fines Mar 27, 2025
€18,000 Meerdere bedrijven: Onvoldoende juridische basis voor gegevensverwerking. Een boete van €18.000 - van de Italiaanse Autoriteit voor Gegevensbescherming (Garante). ITALY ·Garante ·Art. 5, 6, 12 +1 Processing Consent Personal Data NL Mar 27, 2025
€2,000 Corint Logistic SRL.: Insufficient fulfilment of data subjects rights The Romanian DPA has imposed a fine of EUR 2,000 on Corint Logistic SRL. A customer had filed a complaint with the DPA because they had received advertising text messages from the… ROMANIA ·ANSPDCP ·Art. 5, 17, 21 Right to be Forgotten Data Subject Rights Exercise Modalities and Procedures Personal Data May 30, 2024
€5,000 Attorney: Insufficient fulfilment of data subjects rights The French DPA has imposed a fine of EUR 5000 on an attorney. The fine was imposed due to a lack of cooperation with the DPA and a lack of fulfillment of a request of erasure of… FRANCE ·CNIL ·Insufficient fulfilment of data subjects rights Right to be Forgotten Personal Data Supervisory Authorities Jan 15, 2024
Belgian DPA settles with Mediafin: De Tijd cookie banner must add equal "refuse all" On 19 July 2023, a data subject, represented by noyb (European Centre for Digital Rights), filed a complaint against Mediafin, a Belgian media group, with the Belgian DPA. The… 159/2023 ·Belgium ·APD/GBA Cookies Direct Marketing Consent Nov 24, 2023
€2,000 KUGELCHEN PROPIERTIES, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 2,000 on KUGELCHEN PROPIERTIES, S.L.. The controller had continued to process data of the data subject, despite exercising their right to… SPAIN ·aepd ·Art. 6 Right to be Forgotten Controllers Data Subject Rights Exercise Modalities and Procedures Jul 7, 2023
Greek DPA: Google breached Art. 17 GDPR erasure right over outdated criminal case links In 2020, the data subject filed a complaint with the DPA against Google LLC (the controller) for failing to fulfill their right to erasure (Article 17 GDPR) concerning links -… 54/2024 ·Greece ·HDPA Right to be Forgotten Personal Data Data Subject Rights Exercise Modalities and Procedures Jun 29, 2023
€10,000 Bper Banca S.p.A.: Insufficient fulfilment of data subjects rights The Italian DPA has imposed a fine of EUR 10,000 on Bper Banca S.p.A.. An individual had filed a complaint with the DPA regarding the failure to fulfill their right to erasure of… ITALY ·Garante ·Art. 12 Right to be Forgotten Data Subject Rights Exercise Modalities and Procedures Personal Data Sep 15, 2022
€10M Google LLC: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine of EUR 10 million on GOOGLE LLC. Two data subjects had complained to the DPA that Google had disclosed their personal data to third… SPAIN ·aepd ·Art. 6, 17 Right to be Forgotten Data Subject Rights Exercise Modalities and Procedures Personal Data May 18, 2022
€60,000 Kutxabank, S.A.: Insufficient fulfilment of data subjects rights The Spanish DPA (AEPD) has imposed a fine of EUR 100,000 on Kutxabank, S.A.. Following a complaint from a former customer, claiming that the bank did not comply with his request… SPAIN ·aepd ·Art. 17 Right to be Forgotten Personal Data Data Subject Rights Exercise Modalities and Procedures Apr 8, 2021
€2,000 Anmavas 61, S.L.: Insufficient cooperation with supervisory authority The Spanish DPA (AEPD) imposed a fine on Anmavas 61, S.L. for neither granting nor justifiably denying the right to erasure to the data subject, even after receiving a warning… SPAIN ·aepd ·Art. 58 Right to be Forgotten Supervisory Authorities Data Subject Rights Exercise Modalities and Procedures Nov 18, 2020
€1,000 American College of Greece: Insufficient fulfilment of information obligations The Hellenic DPA (HDPA) imposed a fine of EUR 1,000 against the American College of Greece for violations of the right of access and the right to erasure of personal data. HDPA ·Art. 12 ·Insufficient fulfilment of information obligations Right to be Forgotten Right of Access Procedures Right of Access Oct 29, 2020
DSB (Austria) - 2020-0.303.727 In June 2019, the complainant requested erasure of her personal data from the respondent's website, claiming that an article on that website contained wrong statements about her.… 2020-0.303.727 ·Art. 17, 85 Right to be Forgotten Personal Data Controllers Sep 1, 2020
€45,000 Vodafone España SAU: Insufficient legal basis for data processing Unlawfull processing of a telephone number for marketing purposes even after the data subject had exercised its right to erasure SPAIN ·aepd ·Art. 5, 6 Right to be Forgotten Personal Data Direct Marketing Jul 31, 2020
€600,000 Google Belgium SA: Insufficient fulfilment of data subjects rights The Belgian data protection authority has fined Google Belgium SA, a subsidiary of Google, 600,000 euros. The reasons for the fine were the rejection of an application by a data… APD ·Art. 5, 6, 12 +1 ·Insufficient fulfilment of data subjects rights Right to be Forgotten Fairness & Transparency Personal Data Jul 14, 2020
€1,000 Non-profit organisation: Insufficient fulfilment of data subjects rights The Belgian data protection authority has imposed a fine of EUR 1000 on a non-profit organisation for sending out direct marketing messages, despite the fact that data subjects… BELGIUM ·APD ·Art. 6, 21 Right to Object Right to be Forgotten Legitimate Interest May 29, 2020
€47,000 ClickQuickNow: Non-compliance with general data processing principles The UODO imposed a fine of EUR 47000 for obstructing the exercise of the right of withdrawal for the processing of personal data. The company has not taken appropriate technical… POLAND ·UODO ·Art. 5 Right to be Forgotten Personal Data Consent Oct 16, 2019
CNPD (Portugal) - Deliberação 2019/494 In its Opinion 20/2018 concerning the draft of Law 58/2019 which ensures the implementation of the GDPR in the portuguese national legal framework, the DPA drew the attention of… Deliberação 2019/494 ·Art. 2, 3, 5 +8 Controllers Processing Personal Data Sep 3, 2019
€7,000 Online Services: Insufficient fulfilment of data subjects rights A merchant who provides services in an online store has infringed the 'right to be forgotten' pursuant to Art. 17 GDPR when he was repeatedly requested by a data subject to delete… LATVIA ·DSI ·Art. 17 Right to be Forgotten Personal Data Direct Marketing Aug 26, 2019
€500 Bank: Insufficient legal basis for data processing A fine of 1000 BGN (or roughly 500 EUR) was imposed on a bank for calling a client for the unresolved bills of his neighbor. This provoked the client to evoke his right to be… BULGARIA ·KZLD ·Art. 5, 6 Right to be Forgotten Personal Data Insurance Dec 4, 2018