Content type · 482 documents in this view · 3,813 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities 3589 Processing 2636 Personal Data 2395 Controllers 2018 Processing Agreement 1114 Security 1013 Supervision 847 Healthcare 621 Law Enforcement 568 Monitoring 547 Public Authority 539 Consent 508
€750,000 AEPD sanctions Vodafone España for inadequate Super WiFi processor agreement and oversight Vodafone España, S.A.U., the controller, operated a service known as "Super WiFi" through a third-party processor. Following a data breach affecting the service, the DPA's… Spain ·Art. 5, 28, 32 Sep 23, 2026
€403M Google Ireland Limited: Insufficient legal basis for data processing The Irish Data Protection Commission (DPC) fined Google Ireland Limited €403 million on September 21, 2026, following an inquiry into the company's processing of personal data… ·Art. 5, 6, 12 +1 ·Insufficient legal basis for data processing Sep 21, 2026
RON 108,570 Fine against Homelux SRL HOMELUX S.R.L. (the controller) notified the Romanian DPA (ANSPDCP) of a personal data breach pursuant to Article 33 GDPR. The controller was operating a website on a platform… Romania · ·Art. 32 Sep 16, 2026
€140 AEPD fines DIGI Telecom for issuing duplicate SIM to impersonator without consent On December 28, 2022, DIGI Telecom, the controller, delivered a duplicate SIM card to an unauthorized third party without the consent of the original line holder (the data… Spain ·Art. 5, 6, 83 Sep 16, 2026
HDPA investigates Greek Infrastructure Ministry for SMS sent without consent or The DPA started an investigation, after receiving 83 complaints from data subjects, against the Ministry of Infrastructure and Transportation (the controller). Particularly,… 17/2026 ·Greece ·Art. 5, 14 Sep 15, 2026
RON 285,395 AMATO BESTSELLER S.R.L. A general wholesale/retail trade company (controller) failed to implement adequate technical and organisational measures, such as appropriate training of its employees, in order… Romania · ·Art. 5, 9, 12 +2 Aug 18, 2026
€200,000 XFERA MÓVILES, S.A.U. (XFERA), the controller, is a telecommunications provider The data subject was a customer of the controller and held a mobile telephone line. On 24 July 2023, an unauthorised third party requested a duplicate SIM card for the data… ps-00148-2025 ·Spain · Aug 13, 2026
RON 30 Fine against There's an AI for that S.R.L In October 2025, the Romanian National Supervisory Authority for Personal Data Processing (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal –… Romania · ·Art. 4
€9.5M TIM S.p.A.: Non-compliance with general data processing principles The Italian Data Protection Authority (Garante) fined TIM S.p.A. €9,516,000 for violations of multiple GDPR provisions, including Articles 5, 6, 7, 15, 22, 24, 25, 28, and 32,… Italy · ·Art. 5, 6, 7 +6 Jul 23, 2026
€100,000 Orange Romania SA: Insufficient technical and organisational measures to ensure information security The Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) fined Orange Romania SA €100,000 for failing to implement sufficient technical and… ·Art. 25, 32 ·Insufficient technical and organisational measures to ensure information security Jul 17, 2026
BfDI · 4/2021 Both of the TKG and TMG are fundamental for the electronic communication and there are many regulations still written in both laws that are only partially or not valid at all.… 2021-02-18 - 4/2021 ·Germany
€1M CNIL · SAN-2022-011 The controller is a limited liability company whose business is the supply and production of electricity and gas in France. Several data subjects sent complainants to the French… France ·Art. 12, 14, 15 +2
€50,000 Garante · 10128005 The Calabrian Regional Agency for Agricultural Development (the controller) implemented a remote work policy that required employees to use a time-tracking application called… Italy ·Art. 5, 6, 13 +3
€2M Garante fines Lusha Systems Inc. over unauthorized B2B contact database Lusha Systems Inc. (the controller) operated a subscription-based platform that provided professional contact information through a business-to-business (B2B) database. It was a… Italy ·Art. 3, 5, 6 +2 Jul 14, 2026
€70,300 Blikk Kft.: Insufficient legal basis for data processing Hungarian National Authority for Data Protection and the Freedom of Information (NAIH) fined Blikk Kft. €70,300 on 2026-05-29 for: Insufficient legal basis for data processing. Hungary · ·Art. 6, 9, 12 May 29, 2026
Binding Decision 1/2026 On 10 August 2021, a data subject represented by noyb lodged a complaint with the Austrian DPA against Vlaamse Radio- en Televisieomroeporganisatie (VRT), the controller. The… Binding Decision 1/2026 ·European Union · May 28, 2026
€140,500 Mediaworks Hungary Zrt.: Insufficient legal basis for data processing Hungarian National Authority for Data Protection and the Freedom of Information (NAIH) fined Mediaworks Hungary Zrt. €140,500 on 2026-05-26 for: Insufficient legal basis for data… ·Art. 6, 9 ·Insufficient legal basis for data processing May 26, 2026
GBP 300 ICO (UK) - KRA Consultancy Ltd The Information Commissioner, the DPA, investigated KRA Consultancy Ltd, the controller, in relation to unsolicited direct marketing SMS messages promoting debt-related services.… United Kingdom May 20, 2026
€1,500 Francesco Gagliardi: Non-compliance with general data processing principles The Italian Data Protection Authority (Garante) found Francesco Gagliardi, operating as a sole proprietorship, in violation of Articles 5(1)(a) and 14 of the GDPR and Article 130… Italy · ·Art. 5, 14 May 14, 2026
€100,000 Lepida S.c.p.A.: Non-compliance with general data processing principles The Italian Data Protection Authority (Garante) fined Lepida S.c.p.A. €100,000 for violating general data processing principles under the GDPR. The enforcement action addressed… Italy · ·Art. 5, 13, 25 +1 Apr 29, 2026
€35,000 Crowd Entertainment Ltd: Insufficient legal basis for data processing Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) fined Crowd Entertainment Ltd €35,000 on 2026-04-28 for: Insufficient legal basis for data… Romania · ·Art. 5 Apr 28, 2026
€40,000 La7 S.p.A.: Non-compliance with general data processing principles Italian Data Protection Authority (Garante) fined La7 S.p.A. €40,000 on 2026-03-12 for: Non-compliance with general data processing principles. Italy · ·Art. 5 Mar 12, 2026
€1,000 Ciemme S.r.l.s.: Insufficient cooperation with supervisory authority Italian Data Protection Authority (Garante) fined Ciemme S.r.l.s. €1,000 on 2026-02-26 for: Insufficient cooperation with supervisory authority. Italy · ·Art. 58 Feb 26, 2026
€15,000 Depac Società Cooperativa Sociale a r.l.: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Depac Società Cooperativa Sociale a r.l. €15,000 on 2026-02-26 for: Insufficient legal basis for data processing. Italy · ·Art. 5, 9, 13 +2 Feb 26, 2026
€10,000 Radio Immagine Uno S.r.l.: Insufficient fulfilment of data subjects rights Italian Data Protection Authority (Garante) fined Radio Immagine Uno S.r.l. €10,000 on 2026-02-26 for: Insufficient fulfilment of data subjects rights. Italy · ·Art. 12 Feb 26, 2026
€5,000 Conservatory: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Conservatory €5,000 on 2026-02-26 for: Insufficient legal basis for data processing. Italy · ·Art. 5, 6, 10 Feb 26, 2026
€32,000 Dedalus Italia S.p.A.: Insufficient technical and organisational measures to ensure information security Italian Data Protection Authority (Garante) fined Dedalus Italia S.p.A. €32,000 on 2026-02-26 for: Insufficient technical and organisational measures to ensure information… Italy · ·Art. 32 Feb 26, 2026
€15,000 Ministero delle Imprese e del Made in Italy: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Ministero delle Imprese e del Made in Italy €15,000 on 2026-02-26 for: Insufficient legal basis for data processing. ·Art. 5, 6, 9 +1 ·Insufficient legal basis for data processing Feb 26, 2026
€2,000 Istituto Tecnico Statale “Luigi Einaudi” di Correggio: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Istituto Tecnico Statale “Luigi Einaudi” di Correggio €2,000 on 2026-02-26 for: Insufficient legal basis for data processing. Italy · ·Art. 5, 6 Feb 26, 2026
€15,000 Flamel S.r.l.: Non-compliance with general data processing principles Italian Data Protection Authority (Garante) fined Flamel S.r.l. €15,000 on 2026-02-26 for: Non-compliance with general data processing principles. Italy · ·Art. 8, 11, 25 +3 Feb 26, 2026
€3,000 Groupharma s.r.l.s.: Insufficient fulfilment of data subjects rights Italian Data Protection Authority (Garante) fined Groupharma s.r.l.s. €3,000 on 2026-02-26 for: Insufficient fulfilment of data subjects rights. Italy · ·Art. 5, 12, 15 +1 Feb 26, 2026
€30,000 S.M. Trattamento Acqua di XX: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined S.M. Trattamento Acqua di XX €30,000 on 2026-02-26 for: Insufficient legal basis for data processing. Italy · ·Art. 4, 5, 6 +6 Feb 26, 2026
€12,000 Ministero dell’Economia e delle Finanze: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Ministero dell’Economia e delle Finanze €12,000 on 2026-02-26 for: Insufficient legal basis for data processing. Italy · ·Art. 5, 6, 28 Feb 26, 2026
€15,000 Ministry of Enterprises and Made in Italy: Insufficient data processing agreement ⇄ Italian Data Protection Authority (Garante) fined Ministry of Enterprises and Made in Italy €15,000 on 2026-02-26 for: Insufficient data processing agreement. ·Art. 28 ·Insufficient data processing agreement Feb 26, 2026
€17M Reddit, Inc.: Non-compliance with general data processing principles Information Commissioner (ICO) fined Reddit, Inc. €16,610,000 on 2026-02-23 for: Non-compliance with general data processing principles. United Kingdom · ·Art. 5, 6, 8 +1 Feb 23, 2026
€15,000 Depurazione Acqua S.r.l.: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Depurazione Acqua S.r.l. €15,000 on 2026-02-12 for: Insufficient legal basis for data processing. Italy · ·Art. 4, 5, 6 +3 Feb 12, 2026
€12,000 Based s.r.l.: Insufficient fulfilment of data subjects rights Italian Data Protection Authority (Garante) fined Based s.r.l. €12,000 on 2026-02-12 for: Insufficient fulfilment of data subjects rights. Italy · ·Art. 5, 12, 13 +2 Feb 12, 2026
€2,000 Comune di Velletri: Non-compliance with general data processing principles Italian Data Protection Authority (Garante) fined Comune di Velletri €2,000 on 2026-02-12 for: Non-compliance with general data processing principles. Italy · ·Art. 5, 6, 12 +2 Feb 12, 2026
€1,000 Sole Trader: Insufficient fulfilment of information obligations Italian Data Protection Authority (Garante) fined Sole Trader €1,000 on 2026-02-12 for: Insufficient fulfilment of information obligations. Italy · ·Art. 5, 13 Feb 12, 2026
€1,500 Sole Trader: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Sole Trader €1,500 on 2026-02-12 for: Insufficient legal basis for data processing. Italy · ·Art. 5, 13, 25 Feb 12, 2026
€4,000 Comune di Mazara del Vallo: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Comune di Mazara del Vallo €4,000 on 2026-02-12 for: Insufficient legal basis for data processing. Italy · ·Art. 5, 6, 12 +2 Feb 12, 2026
€4,000 Order of Physicians, Surgeons and Dentists of the Province of Macerata: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Order of Physicians, Surgeons and Dentists of the Province of Macerata €4,000 on 2026-02-12 for: Insufficient legal basis for… Italy · ·Art. 5, 6 Feb 12, 2026
€2,000 Sole Trader: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Sole Trader €2,000 on 2026-02-12 for: Insufficient legal basis for data processing. Italy · ·Art. 5, 6, 13 +1 Feb 12, 2026
€2,000 Comune di Monterotondo: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Comune di Monterotondo €2,000 on 2026-02-12 for: Insufficient legal basis for data processing. Italy · ·Art. 5, 13, 88 Feb 12, 2026
€30,000 Sportitalia Società Sportiva Dilettantistica a.r.l.: Insufficient fulfilment of data subjects rights Italian Data Protection Authority (Garante) fined Sportitalia Società Sportiva Dilettantistica a.r.l. €30,000 on 2026-02-12 for: Insufficient fulfilment of data subjects rights. Italy · ·Art. 12, 17 Feb 12, 2026
€5,000 Unleadmited S.r.l.: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Unleadmited S.r.l. €5,000 on 2026-02-12 for: Insufficient legal basis for data processing. Italy · ·Art. 5, 6, 7 +1 Feb 12, 2026
€6,000 Comune di Coccaglio: Non-compliance with general data processing principles Italian Data Protection Authority (Garante) fined Comune di Coccaglio €6,000 on 2026-02-12 for: Non-compliance with general data processing principles. Italy · ·Art. 5, 6, 12 +3 Feb 12, 2026
€15,000 Bressanelli Galli Gelpi Porta & C. S.r.l.: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Bressanelli Galli Gelpi Porta & C. S.r.l. €15,000 on 2026-02-12 for: Insufficient legal basis for data processing. Italy · ·Art. 5, 6, 7 +3 Feb 12, 2026
€15,000 Lex Iuris S.r.l.: Insufficient legal basis for data processing Italian Data Protection Authority (Garante) fined Lex Iuris S.r.l. €15,000 on 2026-02-12 for: Insufficient legal basis for data processing. Italy · ·Art. 6, 15 Feb 12, 2026
€30,000 Vodafone – PANAFON A.E.E.T.: Insufficient fulfilment of data subjects rights Hellenic Data Protection Authority (HDPA) fined Vodafone – PANAFON A.E.E.T. €30,000 on 2026-02-11 for: Insufficient fulfilment of data subjects rights. Greece · ·Art. 12, 15, 18 Feb 11, 2026