Here is brief list containing all of the EU/GDPR fines imposed on companies since the implementation of the law. This list does not contain any fines charged outside of the EU or the UK.
| Country | Date | Fine £ | Controller/Processor | Quoted Art. | Type | Source |
|---|---|---|---|---|---|---|
| UNITED KINGDOM | 1-7-2021 | 200,000 | Brazier Consulting Services | 21A of PECR | unlawful nuisance calls to public | link |
| ICELAND | 29-6-2021 | 29,247 | Huppuís ISK | violation of Articles 6(1)(a) and (c), Article 5(1), 12(1) and (2) and 13 | unlawful employee video surveillance | link |
| NORWAY | 24-6-2021 | 42,312 | Moss municipality | Articles 32(1)(b) and 32(1)(d) | Failure in ensring confidentiality and integrity processing systems and services also lack of organisational measures in ensuring security of data processing | link |
| UNITED KINGDOM | 23-6-2021 | 130,000 | ColourCoat | Regulations 21 and 24 (PECR) | 969,273 nuisance marketing calls without consent of users | link |
| NORWAY | 22-06-2021 | 12,662 | Unknown | Articles 13, 17, and 21 of the (GDPR) | Company accessed the former employee data without valid consent | link |
| SPAIN | 22-06-2021 | 8,590 | TNT Express Worldwide | Article 5(1)(d) (GDPR) | violation of principles of data processing | link |
| ITALY | 22 -6-2021 | 72,159 | Municipality of Bolzano | Articles 5 (1)(a) and (c), 6, 9,13, 88, and 35 (GDPR') | indiscriminate monitoring of employees | link |
| ITALY | 22 -06-2021 | 42,951 | Mayor Menissa | Article 5(1)(a) and (b) of (GDPR') | publishing content on social media portraying identifiable minors and persons iwithout such publication being justified by reasons of public interest, | link |
| ITALY | 22 -06-2021 | 2,577,585 | Iren Mercato SpA | Articles 5(1) and (2), 6(1), and 7(1) | carrying out telemarketing activities without valid consent | link |
| SPAIN | 22-06-2021 | 10,297 | Audax Renovables | Article 21 | Unsolcited telemarketing calls despite of data subject request to opt out | link |
| LITHUANIA | 21-06-2021 | 17,165 | UAB VS FITNESS | Art. 5 (1) a), c) GDPR, Art. 9 (1) GDPR, Art. 13 (1), (2) GDPR, Art. 30 GDPR, Art. 35 (1) GDPR | Non-compliance with general data processing principles | link |
| FRANCE | 17-06-2021 | 428,466 | Brico Privé | Article 5(1)(e)Articles 13, 17, and 32 of GDPR | failure to respect the data retention periods, the right to erasure, and data security obligations | link |
| ROMANIA | 16-06-2021 | 1,714 | La Santrade | Article 83(5)(e), 83(5)(b) and 12(2) and (3) | no adoption measures to ensure the effective exercise of the rights of data subjects, which led to the failure to comply with an erasure request | link |
| UNITED KINGDOM | 15-06-2021 | 10,000 | Papa Jhon's | Regulation 22 of PECR | sending marketing texts without consent | link |
| GREECE | 15-06-2021 | 12,856 | Purple Sea | Articles 5(1)(a) and (c) and 5(2) | for illegal installation and operation of video surveillance system | link |
| DENAMRK | 16-06-2021 | 23,161 | Vejle Municipality | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 14-06-2021 | 1,029 | Inmopiso Zaragoza S.L. | Art. 13 GDPR | Insufficient fulfilment of information obligations | link |
| NORWAY | 11-06-2021 | 34,079 | BRAbank ASA | Articles 24(1), 32(1), and 32(2) | a risk assessment and implement appropriate technical measures when launching a customer portal | link |
| ROMANIA | 09-06-2021 | La Santrade S.R.L. | Art. 31 GDPR, Art. 58 GDPR | Insufficient cooperation with supervisory authority | link | |
| SWEDEN | 09-06-2021 | 29,855 | Directorate of the Östra Skaraborg Rescue Service | Art. 5 (1) a), c) GDPR, Art. 32 (1), (4) GDPR | Non-compliance with general data processing principles | link |
| ROMANIA | 9-6-2021 | 1,718 | SC Dreamtime Call S.R.L. | Article 83(5)(e) ('GDPR'). | illegally processed the personal data of an individual. without prior consent | link |
| SWEDEN | 7-6-2021 | 55,376 | Voice Integrate Nordic AB | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SWEDEN | 7-6-2021 | 1,030,401 | MedHelp AB | Art. 5 (1) a), f) GDPR, Art. 6 GDPR, Art. 9 (1) GDPR, Art. 13 GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | link |
| SWEDEN | 7-6-2021 | 42,936 | Region Stockholm | Art. 5 (1) a) GDPR, Art. 13 GDPR, Art. 14 GDPR | Insufficient fulfilment of information obligations | link |
| LUXEMBOURG | 7 -6- 2021 | 2,061 | Unknown | Article 5(1)(e) and 13 GDPR | violation principle of data minimisation with regards to their use of video surveillance | link |
| SPAIN | 7 -6- 2021 | 21,474 | Master Distancia | Article 6(1) of GDPR | violation of the principle of lawfulness of processing | link |
| UNITED KINGDOM | 3-6-2021 | 10,000 | Conservative Party | Regulation 22 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 ('PECR'). | Sending 51 marketing emails to individuals without obtaining valid consent | link |
| SPAIN | 3 -6-2021 | 5,161 | Creator Energy, S.L | Article 6(1)(b) | data processing without consent | link |
| SPAIN | 1-6-2021 | 3,446 | Avalos Consultores | Article 6(1) GDPR' | transfer of personal data to a third party without the consent | link |
| SPAIN | 28-5-2021 | 1,292 | local community owners | Article 5(1)(c) GDPR | video surveillance without just cause. | link |
| SPAIN | 27-5-2021 | 1,719 | Private Individual | Art. 5 (1) (c) GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 25-5-2021 | 774 | unknown | Article 13 of the GDPR | the defendant did not provide the claimant with any information relating to the processing of personal data | link |
| SPAIN | 25-5-2021 | 85,982 | Vodafone España, SAU | Article 28(1) of the GDPR | Insufficient technical and organisational measures to ensure information security | link |
| GREECE | 25-5-2021 | 8,598 | Municipal Organisation of Preschool Education and Social Solidarity ('DOPAKA') | Articles 5 and 6(1)(c) , Articles 12(3) and (4), and 17(1)(d) of the GDPR. | processing personal data without a legal basis, failure to comply with its obligation to delete personal data upon such request, | link |
| SPAIN | 25-5-2021 | 38,712 | Telefonica De Espana, SAU | Article 6 GDPR | Processing the personal data without a legitimate basis | link |
| SPAIN | 25-5-2021 | 775 | Managing Director of a company | Art. 13 GDPR | Insufficient fulfilment of information obligations | link |
| SPAIN | 21-5-2021 | 2,581 | Physician | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| NORWAY | 20-5- 2021 | 33,781 | Oslo Municipality | Article 32 | disclosure of personal data without consent | link |
| UNITED KINGDOM | 20-5-2021 | 90,000 | American Express | violation of Regulation 22 of the Privacy and Electronic Communications Regulation 2003 ('PECR') | sending 4M marketing emails without consent | link |
| SPAIN | 20-5-2021 | 2,593 | Unknown | Article 6 | unlawful data processing of client's personal data | link |
| ITALY | 20-5-2021 | 34,562 | Proma S.S.A. Srl. | Articles 5 and 13 | unlawful processing of employees' personal data | link |
| ITALY | 20-5-2021 | 34,568 | Municipality of Palermo | Article 5 of the GDPR | failures to adequately project personal data | link |
| UNITED KINGDOM | 20-5-2021 | 8,000 | Tested.com | Regulation 22 of the Privacy and Electronic Communications Regulations 2003 ('PECR') | email marketing without consent | link |
| ITALY | 20-5-2021 | 6,052 | AUSSL 9 Scaligera and the doctor | Articles 5 & and Article 33 | unlawful dissemination of sensitive personal data | link |
| ROMANIA | 19-5- 2021 | 432 | Municipality of Iasi | Article 83(5)(e) read with Article 58(1)(a) and (e) | information not provided by organisation to data subject | link |
| NETHERLANDS | 19-5-2021 | 12,964 | CP&A B.V. | Articles 9 & Article32 | processed more health data than was allowed. Moreover, the absenteeism registration was insufficiently secured. | link |
| NORWAY | 18-5-2021 | 82,106 | Innovasjon Norge | Art. 5 (1) GDPR, Art. 6 (1) GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 18-5-2021 | 1,729 | Banca Comercială Română | Articles 5(1)(a) and (d), 5(2), and 6 | used data without consent | link |
| GREECE | 17-5-2021 | 8,597 | Municipal Organization for Pre-School Education and Social Solidarity (DOPAKA) of the municipality of Tavros Moschato | Art. 6 (1) c) GDPR, Art. 12 (3), (4) GDPR, Art. 17 (1) d) GDPR | Insufficient legal basis for data processing | link |
| POLAND | 17-5-2021 | 218,710 | Cyfrowy Polsat | Articles 24(1) and 32 | lack of appropriate technical and organisational security measures | link |
| ROMANIA | 14-5-2021 | 173 | Website operator | Art. 5 (1) a), b) GDPR, Art. 5 (2) GDPR, Art. 6 (1) GDPR, Art. 13 (1), (2), (3) GDPR, Art. 32 (2) GDPR | Non-compliance with general data processing principles | link |
| ROMANIA | 13-5-2021 | 1,726 | Telekom Romania Communications | Art. 6 GDPR, Art. 21 GDPR | Commercial calls despite the data subject’s objection. | link |
| SPAIN | 13-5-2021 | 25,878 | Allianz Serguros | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| NEITHERLANDS | 12-5-2021 | 452,438 | locatefamily.com | Article 27 | no representative for the EU | link |
| NEITHERLANDS | 12-5-2021 | 6,467 | PVV Overijssel | Article 33 | Failure to notify data protection authority of data breach. | link |
| SPAIN | 12-5-2021 | 2,586 | Solram T Y R S.L. | Art. 17 | Insufficient fulfilment of data subjects rights | link |
| ROMANIA | 7-5-2021 | 1,721 | World Class România S.A. | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 4-5-2021 | 1,291,058 | EDP Energía, S.A.U | Art. 13 GDPR, Art. 25 GDPR | Insufficient fulfilment of information obligations | link |
| SPAIN | 4-5-2021 | 1,291,147 | EDP Comercializadora, S.A.U | Art. 13 GDPR, Art. 25 GDPR | Insufficient fulfilment of information obligations | link |
| FINLAND | 30-4-2021 | 64,550 | ParkkiPate Oy | Art. 5 (1) c) GDPR, Art. 12 (3), (4), (6) GDPR, Art. 14 (2) a) GDPR, Art. 14 (3) GDPR, Art. 15 GDPR, Art. 17 (1) a) GDPR, Art. 25 (2) GDPR | Insufficient fulfilment of data subjects rights | link |
| ICELAND | 29-4-2021 | 19,885 | InfoMentor ehf | Art. 5 (1) f) GDPR, Art. 32 (1) b), d) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| THE NETHERLANDS | 29-4-2021 | 517,561 | Municipality of Enschede | Art. 5 (1) a) GDPR, Art. 6 (1) GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 27-4-2021 | 2,594 | Pagamastarde S.L. | Art. 17 (1) GDPR, Art. 21 LSSI | Insufficient fulfilment of data subjects rights | link |
| SPAIN | 27-4-2021 | 13,037 | Anytime Fitness Iberia S.L. | Art. 17 GDPR, Art. 21 LSSI | Insufficient fulfilment of data subjects rights | link |
| BELGIUM | 26-4-2021 | 86,911 | Financial company | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 23-4-2021 | 869,162 | Equifax Iberica S.L. | Art. 5 (1) a), b), c), d) GDPR, Art. 6 (1) GDPR, Art. 14 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 22-4-2021 | 1,305 | Private Individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | link |
| FINLAND | 21-4-2021 | 64,553 | ParkkiPate Oy | Art. 5 (1) c) GDPR, Art. 12 (3), (4), (6) GDPR, Art. 14 (2) a) GDPR, Art. 14 (3) GDPR, Art. 15 GDPR, Art. 17 (1) a) GDPR, Art. 25 (2) GDPR | Insufficient fulfilment of data subjects rights | link |
| SPAIN | 20-4-2021 | 6,962 | Highcliffe Estates Marbella S.L. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 19-4-2021 | 1,305 | Lugera & Makler Broker S.R.L. | Art. 29 GDPR, Art. 32 (2), (4) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 19-4-2021 | 1,305 | Pub owner | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | link |
| ROMANIA | 15-4-2021 | 4,331 | S.C. Tip Top Food Industry S.R.L | Art. 5 (1) b), (c) GDPR, Art. 5 (2) GDPR, Art. 6 GDPR, Art. 7 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 15-4-2021 | 2,599 | Private Individual | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 13-4-2021 | 77,969 | Vodafone España, S.A.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | link |
| NORWAY | 9-4-2021 | 2,945 | Miljø- og Kvalitetsledelse AS | Art. 5 (1) (a) GDPR, Art. 6 (1) GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 8-4-2021 | 51,985 | Kutxabank, S.A | Art. 17 GDPR | Insufficient fulfilment of data subjects rights | link |
| SPAIN | 6-4-2021 | 2,079 | Promotech Digital S.L. | Art. 21 GDPR | Insufficient fulfilment of data subjects rights | link |
| SPAIN | 5-4-2021 | 2,598 | Kukimbia S.L. | Art. 32 (1) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 5-4-2021 | 2,598 | Electrotecnica Bastida S.L. | Art. 32 (1) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 5-4-2021 | 3,464 | Stockhunters S.L. | Art. 13 GDPR | Insufficient fulfilment of information obligations | link |
| ROMANIA | 30-3-2021 | 8,489 | Telekom Romania Mobile Communications S.A. | Art. 32 (1), (2) GDPR, Art. 58 (1) a), e) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ROMANIA | 23-3-2021 | 1,706 | S.C. Medicover S.R.L. | Art. 32 (1) b), (2), (4) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 23-3-2021 | 853 | Laboratorio Octogón, S.L. | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 18-3-2021 | 2,593 | Asesoría Alpi-Clúa S.L. | Art. 5 (1) f) GDPR, Art. 32 (1) GDPR, Art. 32 (2) GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 16-3-2021 | 51,867 | Vodafone España, S.A.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | link |
| BELGIUM | 15-3-2021 | 864 | School | Art. 5 (1) c) GDPR, Art. 6 (1) GDPR, Art. 8 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 15-3-2021 | 2,592 | Cultural association | Art. 6 (1) a) GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 15-3-2021 | 1,727 | Heredad de Urueña S.A. | Art. 13 GDPR | Insufficient fulfilment of information obligations | link |
| SPAIN | 12-3-2021 | 1,295 | Private Person | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 12-3-2021 | 10,364 | NBQ Technology, S.A.U | Art. 6 (1) GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 11-3-2021 | 7,040,173 | Vodafone España, S.A.U. | Art. 28 GDPR, Art. 24 GDPR, Art. 44 GDPR, Art. 21 LSSI, Art. 48 (1) b) LGT, Art. 21 GDPR, Art. 23 LOPDGDD | Insufficient fulfilment of data subjects rights | link |
| GERMANY | 10-3-2021 | 259,142 | VfB Stuttgart 1893 AG | Art. 5 (2) GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 10-3-2021 | 8,636 | Hospital Campogrande DE | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 10-3-2021 | 6,909 | Filigrana Comunicación S.L.U. | Art. 6 (1) GDPR, Art. 13 GPDR, Art. 14 GDPR | Insufficient fulfilment of information obligations | link |
| SPAIN | 10-3-2021 | 43,177 | Equifax Iberica S.L. | Art. 6 (1)(f) GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 10-3-2021 | 77,742 | Xfera Moviles S.A | Art. 5 (1) (f) GDPR, Art. 17 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 9-3-2021 | 12,953 | Homeowners Association | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | link |
| ROMANIA | 4-3-2021 | 432 | Natural person holding the position of General Secretary for a political party in Bucharest | Art. 32 (1), (2) GDPR, Art. 58 (1) a), e) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| GERMANY | 3-3-2021 | 173 | Private Individual | Art. 5 GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | link |
| CYPRUS | 3-3-2021 | 21,592 | Hellenic Bank | Art. 5 (1) e), f) GDPR, Art. 32 (1) b), c) GDPR, Art. 33 (1) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| CYPRUS | 3-3-2021 | 8,640 | Cypriot Real Estate Registration Authority | Art. 12 GDPR, Art. 15 GDPR, Art. 31 GDPR, 58 (1) e) GDPR | Insufficient fulfilment of information obligations | link |
| CYPRUS | 3-3-2021 | 5,183 | KEPIDES | Art. 32 (4) | Insufficient technical and organisational measures to ensure information security | link |
| CYPRUS | 3-3-2021 | 34,566 | Electricity Authority of Cyprus | Art. 6 (1) GDPR, Art. 9 (2) GDPR | Insufficient legal basis for data processing | link |
| NORWAY | 2-3-2021 | 21,069 | Unknown | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2-3-2021 | 7,771 | Unknown | Art. 6 GDPR, Art. 13 GDPR | Insufficient legal basis for data processing | link |
| LITHUANIA | 2-3-2021 | 12,951 | Registrų Centras | Art. 32 (1) b), c) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 2-3-2021 | 172,759 | I-DE Redes Eléctricas Inteligentes, S.A.U | Art. 5 (1) b), c) GDPR, Art. 6 (1) b) GDPR | Non-compliance with general data processing principles | link |
| LITHUANIA | 26-2-2021 | 10,363 | Nacionaliniam visuomenės sveikatos centrui (NVSC) | Art. 5 (1), (2) GDPR, Art. 13 GDPR, Art. 24 GDPR, Art. 32 GDPR, Art. 35 GDPR, Art. 58 (2) f) GDPR | Non-compliance with general data processing principles | link |
| LITHUANIA | 26-2-2021 | 2,591 | IT sprendimai sėkmei | Art. 5 (1), (2) GDPR, Art. 13 GDPR, Art. 24 GDPR, Art. 32 GDPR, Art. 35 GDPR, Art. 58 (2) f) GDPR | Non-compliance with general data processing principles | link |
| ITALY | 25-2-2021 | 259,035 | Istituto Nazionale Previdenza Sociale (INPS) | Art. 5 (1) a), c), d) GDPR, Art. 25 GDPR, Art. 35 GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 24-2-2021 | 10,361 | Avilon Center 2016 S.L. | Art. 48 (1) b) LGT, Art. 21 GDPR, Art. 23 (4) LOPDGDD | Insufficient fulfilment of data subjects rights | link |
| GERMANY | 23-2-2021 | 0 | Deutsche Wohnen SE | Art. 5 GDPR, Art. 25 GDPR | Non-compliance with general data processing principles | link |
| CROTIA | 22-2-2021 | Unknown | Security company (name not available at the moment) | Art. 32 (1) b), d) GDPR, Art. 32 (2), (4) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 16-2-2021 | 864 | The Washpoint S.L. | Art. 13 GDPR | Insufficient fulfilment of information obligations | link |
| DENAMRK | 12-2-2021 | 11,615 | IDdesign A / S | Art. 5 (1) e) GDPR, Art. 5 (2) GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 12-2-2021 | 103,618 | Vodafone España, SAU | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 12-2-2021 | 1,382 | Ripobruna 207, S.L. | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 11-2-2021 | 20,725 | Vamavi Phone S.L | Art. 48 (1) b) LGT, Art. 21 GDPR, Art. 23 LOPDGDD, Art. 28 GDPR | Insufficient fulfilment of data subjects rights | link |
| THE NETHERLANDS | 11-2-2021 | 379,964 | OLVG | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| POLAND | 11-2-2021 | 19,173 | Krajowa Szkoła Sądownictwa i Prokuratury | Art. 5 (1) f) GDPR, Art. 25 (1) GDPR, Art. 28 (3) GDPR, Art. 32 (1), (2) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ITALY | 11-2-2021 | 64,763 | Ministero dello Sviluppo Economico | Art. 5 (1) a), b), c) GDPR, Art. 6 (1) c), e) GDPR, Art. 6 (2) GDPR, Art. 6 (3) b) GDPR, Art. 37 (1), (7) GDPR | Non-compliance with general data processing principles | link |
| ROMANIA | 10-2-2021 | 864 | ING Bank N.V. Amsterdam - Bucharest office | Art. 29 GDPR, Art. 32 (2), (4) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 9-2-2021 | 4,317 | Predase Servicios Integrales S.L. | Art. 13 GDPR | Insufficient fulfilment of information obligations | link |
| LATAVIA | 9-2-2021 | 48,476 | Lursoft IT SIA | Art. 6 (1) GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 8-2-2021 | 2,590 | Patio Ancestral S.L. | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 8-2-2021 | 4,317 | Private Person | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 4-2-2021 | 1,727 | Private Person | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | link |
| NORWAY | 3-2-2021 | 16,667 | Cyberbook AS | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 3-2-2021 | 86,357 | Iberdrola Clientes | Art. 5 (1) d) GDPR, Art. 17 GDPR | Insufficient fulfilment of data subjects rights | link |
| SPAIN | 1-2-2021 | 20,726 | Xfera Moviles S.A. | Art. 58 (2) GDPR | Insufficient cooperation with supervisory authority | link |
| SPAIN | 1-2-2021 | 2,591 | IDFINANCE Spain, S.L. | Art. 5 (1) f) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| FRANCE | 27-1-2021 | 64,779 | Unknown | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| BELGIUM | 27-1-2021 | 43,189 | Family Service / N.D.P.K. nv. | Art. 5 GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 13 GDPR, Art. 24 GDPR, Art. 25 GDPR, Art. 28 GDPR | Insufficient legal basis for data processing | link |
| ITALY | 27-1-2021 | 43,189 | Azienda USL della Romagna | Art. 5 (1) a), d), f) GDPR, Art. 9 GDPR, Art. 32 (1) b) GDPR | Non-compliance with general data processing principles | link |
| ITALY | 27-1-2021 | 43,189 | Azienda Ospedaliero Universitaria Senese | Art. 5 (1) f) GDRP, Art. 9 GDPR | Non-compliance with general data processing principles | link |
| ITALY | 27-1-2021 | 43,189 | Azienda Ospedaliero Universitaria di Parma | Art. 5 (1) f) GDRP, Art. 9 GDPR | Non-compliance with general data processing principles | link |
| BELGIUM | 22-1-2021 | 21,591 | Unknown | Art. 5 (1) f), (2) GDPR, Art. 24 GDPR, Art. 32 GDPR, Art. 33 (1), (5) GDPR, Art. 34 (1) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 21-1-2021 | 43,178 | Alterna Operador Integral S.L. | Art. 6 (1) b) GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 21-1-2021 | 64,772 | Telefónica Móviles España, SAU | Art. 6 (1) GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 20-1-2021 | 1,036 | Individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | link |
| NORWAY | 19-1-2021 | 8,378 | Aquateknikk AS | Art. 5 GPDR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| POLAND | 15-1-2021 | 3,973 | Anwara Sp. z.o.o. | Art. 31 GDPR, Art. 58 (1) a) GDPR | Insufficient cooperation with supervisory authority | link |
| NORWAY | 14-1-2021 | 33,336 | Coop Finnmark SA | Art. 5 (1) a) GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ITALY | 14-1-2021 | 6,909 | Agenzia regionale protezione ambientale Campania (ARPAC) | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ITALY | 14-1-2021 | 25,911 | Azienda sanitaria provinciale di Enna | Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 32 GDPR | Insufficient legal basis for data processing | link |
| ITALY | 14-1-2021 | 1,727 | Poliambulatorio Talenti S.r.l. | Art. 12 (3) GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| ITALY | 14-1-2021 | 15,547 | Azienda Usl di Bologna | Art. 5 (1) f) GDRP, Art. 9 GDPR | Non-compliance with general data processing principles | link |
| ITALY | 14-1-2021 | 64,784 | Regione Lazio | Art. 5 (2) GDPR, Art. 28 GDPR | Insufficient data processing agreement | link |
| SPAIN | 13-1-2021 | 5,183,280 | Caixabank S.A. | Art. 6 GDPR, Art. 13 GDPR, Art. 14 GDPR | Insufficient legal basis for data processing | link |
| NORWAY | 12-1-2021 | 33,347 | Unknown | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| BELGIUM | 12-1-2021 | 8,638 | Unknown | Art. 6 (1) GDPR, Art. 12 (3) GDPR, Art. 21 (1) GDPR | Insufficient legal basis for data processing | link |
| POLAND | 11-1-2021 | 25,917 | Enea S.A. | Art. 33 (1) GDPR | Insufficient fulfilment of data breach notification obligations | link |
| GERMANY | 8-1-2021 | 8,988,035 | notebooksbilliger.de | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| NORWAY | 7-1-2021 | 6,265 | Gveik AS | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| NORWAY | 6-1-2021 | 8,383 | Lindstrand Trading AS | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| FRANCE | 5-1-2021 | 17,280 | Nestor SAS | Art. 12 GDPR, Art. 13 GDPR | Insufficient fulfilment of information obligations | link link |
| POLAND | 5-1-2020 | 4,753 | Śląski Uniwersytet Medyczny (Medical University of Silesia) | Art. 33 (1) GDPR, Art. 34 (1) GDPR | Insufficient fulfilment of data breach notification obligations | link |
| POLAND | 5-1-2021 | 16,416 | Unknown | Art. 34 (1), (2) GDPR, Art. 58 (2) e) GDPR | Insufficient fulfilment of data breach notification obligations | link |
| SPAIN | 4-1-2021 | 46,651 | Vodafone España, S.A.U. | Art. 5 (1) d), f) GDPR | Non-compliance with general data processing principles | link |
| NORWAY | 4-1-2021 | 82,505 | Innovasjon Norge | Art. 5 (1) GDPR, Art. 6 (1) GDPR | Insufficient legal basis for data processing | link |
| CZECH REPUBLIC | 4-1-2021 | 102,369 | Unknown | Art. 6 (1) GDPR, Art. 14 GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 30-12-2020 | 2,591 | ING Bank N.V. Amsterdam - Bucharest office | Art. 5 (1) a) - d) GDPR, Art. 6 (1) GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 29-12-2020 | 864 | Qualitance QBS SA | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| POLAND | 23-12-2020 | 16,353.32 | Towarzystwo Ubezpieczeń i Reasekuracji WARTA S.A. | Art. 33 (1) GDPR, Art. 34 (1) GDPR | Insufficient fulfilment of data breach notification obligations | link |
| Belgium | 23-12-2020 | 43,193 | Unknown | Art. 14 (1), (2) GDPR, Art. 12 (1), (2), (3) GDPR, Art. 15 (1) GDPR, Art. 5 (1) c), (2) GDPR, Art. 24 (1), (2) GDPR | Insufficient fulfilment of data subjects rights | link |
| BELGIUM | 23-12-2020 | 12,959 | Unknown | Art. 14 (1), (2) GDPR, Art. 12 (3) GDPR, Art. 6 GDPR, Art. 5 (1) c), (2) GDPR, Art. 24 (1), (2) GDPR | Insufficient fulfilment of data subjects rights | link |
| SPAIN | 22-12-2020 | 5300 | Iberdrola Clientes, SAU | Art. 48 (1) b) LGT, Art. 21 GDPR, Art. 23 (4) LOPDGDD | Insufficient fulfilment of data subjects rights | link |
| ROMANIA | 22-12-2020 | 1794 | S.C. C&V Water Control S.A. | Art. 58 (1) a), e) GDPR, Art. 58 (2) i) GDPR | Insufficient cooperation with supervisory authority | link |
| SPAIN | 21-12-2020 | 32,000 | Banco Bilbao Vizcaya Argentaria, S.A. | Art. 5 (1) d) GDPR | Non-compliance with general data processing principles | link |
| ROMANIA | 17-12-2020 | 90,700 | Banca Transilvania SA | Art. 5 (1) f) GDPR, Art. 32 (1), (2) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| FRANCE | 17-12-2020 | 2,722 | Doctor | Art. 32 GDPR, Art. 33 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| FRANCE | 17-12-2020 | 5,444 | Doctor | Art. 32 GDPR, Art. 33 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| HUNGARY | 16-12-2020 | 1,940 | Unknown | Art. 5 (1) b), c) GDPR, Art. 13 (1) GDPR | Insufficient fulfilment of information obligations | link |
| HUNGARY | 16-12-2020 | 50,269 | Robinson Tours Ltd. (Robinson Tours Idegenforgalmi és Szolgáltató Kft.) | Art. 25 (1), (2) GDPR, Art. 32 (1) b) GDPR, Art. 34 (1) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| HUNGARY | 16-12-2020 | 1,256 | Next Time Media Agency Ltd. (Next Time Media Ügynökség Kft.) | Art. 32 (1) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ROMANIA | 17-12-2020 | 92,000 | Banca Transilvania SA | Art. 5 (1) f) GDPR, Art. 32 (1) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| IRELAND | 15-12-2020 | 406,000 | Twitter International Company | Art. 33 (1) GDPR, Art. 33 (5) GDPR | Insufficient fulfilment of data breach notification obligations | link |
| POLAND | 14-12-2020 | 1,715,000 | Virgin Mobile Polska | Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 25 (1) GDPR, Art. 32 (1) b) GDPR, Art. 32 (1) d) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 11-12-2020 | 4,500,000 | Banco Bilbao Vizcaya Argentaria, S.A. | Art. 6 GDPR, Art. 13 GDPR | Insufficient fulfilment of information obligations | link |
| SWEDEN | 11-12-2020 | 48,000 | Umeå University | Art. 5 (1) f) GDPR, Art. 32 (1) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 10-12-2020 | 3,600 | Borjamotor, S.A. | Art. 7 GDPR | Insufficient fulfilment of information obligations | link |
| SPAIN | 9-12-2020 | 36,000 | Xfera Moviles S.A. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 9-12-2020 | 9,000 | Unknown | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | link |
| SWEDEN | 3-12-2020 | 1,263,000 | Aleris Sjukvård AB | Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 32 (1) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SWEDEN | 3-12-2020 | 999,000 | Aleris Sjukvård AB | Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 32 (1) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 3-12-2020 | 2,400 | Dr Marín Cirugia Plástica, S.L.P. | Art. 13 GDPR | Insufficient fulfilment of information obligations | link |
| SWEDEN | 3-12-2020 | 243,800 | Östergötland Region | Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 32 (1) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SWEDEN | 3-12-2020 | 243,800 | Västerbotten Region | Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 32 (1) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SWEDEN | 3-12-2020 | 341,300 | Sahlgrenska University Hospital | Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 32 (1) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SWEDEN | 3-12-2020 | 390,100 | Karolinska University Hospital of Solna | Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 32 (1) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SWEDEN | 3-12-2020 | 2,900,000 | Capio St. Göran AB | Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 32 (1) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| NORWAY | 3-12-2020 | 18,840 | Municipality of Indre Østfold | Art. 6 GDPR, Art. 32 (1) b) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 2-12-2020 | 6,000 | Servicio de Alojamientos Responsables, S.L. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2-12-2020 | 3,000 | Comercio Online Levante, S.L. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 2-12-2020 | 5,000 | Asociación de Víctimas por Arbitrariedades Judiciales, (JAVA) | Art. 6 (1) GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2-12-2020 | 10,000 | Losada Advocats S.L. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 27-11-2020 | 1,200 | Private Individual | Art. 5 (1) a) GDPR | Non-compliance with general data processing principles | Link |
| SWEDEN | 25-11-2020 | 19,500 | Gnosjö Municipality | Art. 5 GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 35 GDPR, Art. 36 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 25-11-2020 | 40,000 | Miraclia Telecomunicaciones S.L. | Art. 6 GDPR, Art. 13 GDPR, Art. 14 GDPR | Insufficient legal basis for data processing | link |
| BELGIUM | 25-11-2020 | 1,500 | Private Individual | Art. 6 GDPR, Art. 25 GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 24-11-2020 | 5,000 | Dada Creation S.R.L. | Art. 32 GDPR, Art. 33 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SWEDEN | 24-11-2020 | 394,000 | City of Stockholm | Art. 5 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 23-11-2020 | 12,000 | Recambios Villalegre S.L. | Art. 6 GDPR, Art. 13 GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 23-11-2020 | 4,000 | Vodafone România SA | Art. 12 GDPR, Art. 15 GDPR, Art. 17 GDPR | Insufficient fulfilment of data subjects rights | link |
| ITALY | 23-11-2020 | 20,000 | Burgo Group S.p.A | Art. 5 GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 19-11-2020 | 36,000 | Vodafone España, S.A.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 18-11-2020 | 2000 | Anmavas 61, S.L. | Art. 58 GDPR | Insufficient cooperation with supervisory authority | link |
| FRANCE | 18-11-2020 | 800,000 | Carrefour Banque | Art. 5 GDPR | Non-compliance with general data processing principles | link |
| FRANCE | 18-11-2020 | 2,250,000 | Carrefour France | Art. 5 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 15 GDPR, Art. 17 GDPR, Art. 21 GDPR, Art. 32 GDPR, Art. 33 GDPR | Non-compliance with general data processing principles | link |
| ITALY | 17-11-2020 | 30,000 | Provincial Health Authority of Cosenza | Art. 9 GDPR | Insufficient legal basis for data processing | link |
| ITALY | 17-11-2020 | 2000 | Comune di Collegno | Art. 12 GDPR, Art. 13 GDPR, Art. 14 GDPR | Insufficient fulfilment of data subjects rights | link |
| SPAIN | 16-11-2020 | 1,600 | Homeowners Association | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 16-11-2020 | 42,000 | Vodafone España, S.A.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | |
| UNITED KINGDOM | 15-11-2020 | 1.6 m | TicketMaster UK | Article 56 of the GDPR, Article 60 of the GDPR | Fincial details in chatbot compromised. | link |
| Germany | 11-11-2020 | 800,500 | Telecoms provider (1&1 Telecom GmbH) | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 5-11-2020 | 67,000 | Telefonica Moviles Espana, S.A.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 3-11-2020 | 26,000 | Vodafone España, S.A.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| UNITED KINGDOM | 30-10-2020 | 18,226,109 | Marriott International, Inc | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 28-10-2020 | 32,085 | Vodafone España, S.A.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 28-10-2020 | 3,600 | Play Orenes, S.L. | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | link |
| ITALY | 26-10-2020 | 18,000 | Università Campus Bio-medico di Roma (Polyclinic) | Art. 5 (2) a), f) GDPR, Art. 9 GDPR | Non-compliance with general data processing principles | link |
| HUNGARY | 23-10-2020 | 48,841 | Deichmann Cipőkereskedelmi Korlátolt Felelősségű Társaságnak | Art. 12 GDPR, Art. 15 GDPR, Art. 18 (1) c) GDPR, Art. 25 GDPR | Insufficient fulfilment of data subjects rights | link |
| CYPRUS | 22-10-2020 | 5,348 | Cyprus Police | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| LITHUANIA | 21-10-2020 | 13,500 | Vilnius City Municipality Administration | Art. 5 (1) d) GDPR, Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | link link |
| ROMANIA | 20-10-2020 | 1800 | Globus Score SRL | Art. 58 GDPR | Insufficient cooperation with supervisory authority | link |
| CYPRUS | 19-10-2020 | 890 | Grant Ideas Ltd | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| CYPRUS | 19-10-2020 | 13,500 | Bank of Cyprus Public Company Ltd | Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 15 GDPR, Art. 32 GDPR, Art. 33 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| UNITED KINGDOM | 16-10-2020 | 19,648,548 | British Airways | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ROMANIA | 15-10-2020 | 2,600 | S.C. Marsorom S.R.L. | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 9-10-2020 | 802.13 | Café Restaurante B.B.B | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 9-10-2020 | 1800 | Private Person | Art. 5 (1) c) GDPR, Art. 6 GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 9-10-2020 | 44,000 | Centro de Investigación y Estudio para la Obesidad, SL | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 9-10-2020 | 4,400 | Caja Rural San José de Nules S. Cooperativa de Crédito | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 6-10-2020 | 53,475 | Lycamobile | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 6-10-2020 | 3,600 | Callesgarcia, S.L. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 3-10-2020 | 2,600 | Avata Hispania, S.L. | Art. 5 GDPR, Art. 6 GDPR, Art. 28 (3) g) GDPR | Insufficient legal basis for data processing | link |
| GERMANY | 1-10-2020 | 31,424,404 | H&M Hennes & Mauritz Online Shop A.B. & Co. KG | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 1-10-2020 | 2,600 | Megareduceri TV S.R.L. | Art. 31 GDPR, Art. 58 GDPR | Insufficient cooperation with supervisory authority | link |
| ROMANIA | 1-10-2020 | 1800 | Asociația de proprietari Militari R | Art. 31 GDPR, Art. 58 GDPR | Insufficient cooperation with supervisory authority | link |
| ITALY | 30-9-2020 | 71,300 | Azienda Ospedaliera di Rilievo Nazionale ‘Antonio Cardarelli’ (Private Hospital) | Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 28 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ITALY | 30-9-2020 | 53,475 | Scanshare s.r.l. | Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 30-9-2020 | 2,600 | Venu Sanz Chef, S.L. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 25-9-2020 | 53,475 | Xfera Moviles S.A. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| NORWAY | 25-9-2020 | 12,388 | Odin Flissenter AS | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 22-9-2020 | 53,475 | GLP Instalaciones 86, SL | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 22-9-2020 | 6,952 | Iweb Internet Learning, S.L. | Art. 7 GDPR, Art. 12 GDPR, Art. 13 GDPR | Insufficient fulfilment of information obligations | link |
| SPAIN | 17-9-2020 | 53,475 | Vodafone España, SAU | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 17-9-2020 | 2,600 | Grupo Carolizan | Art. 5 GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 16-9-2020 | 8,900 | Property owners community | Art. 5 GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 11-9-2020 | 1,350 | Political Party | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| GREECE | 11-9-2020 | 6,400 | Private Person | Art. 5 GDPR | Non-compliance with general data processing principles | link |
| POLAND | 8-9-2020 | 10,033 | Warsaw University of Life Sciences | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ROMANIA | 8-9-2020 | 1800 | Sanatatea Press Group S.R.L. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 7-9-2020 | 2,600 | Barcelona Airport Security Guard Association (‘AVSAB’) | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | link |
| ITALY | 7-9-2020 | 1800 | Istituto Comprensivo Statale Crucoli Torretta | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| BELGIUM | 7-9-2020 | 4,400 | Former mayor of a community | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| NORWAY | 3-9-2020 | 247,262 | Bergen Municipality | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ITALY | 3-9-2020 | 1800 | Comune di Casaloldo | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 1-9-2020 | 67,190 | Telefónica Móviles España, SAU | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 1-9-2020 | 445 | Apartment building owners association | Art. 5 GDPR, Art. 6 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 25 GDPR, Art. 32 GDPR | Insufficient legal basis for data processing | link |
| POLAND | 31-8-2020 | 20,336 | Surveyor General of Poland (‘GKK’) | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 28-8-2020 | 44,000 | Bankia S.A. | Art. 5 (1) b) GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 28-8-2020 | 4,400 | Basketball Federation of Castilla and Leon | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 17-8-2020 | 4,400 | Party of the Socialists of Catalonia | Art. 5 (1) b) GDPR | Non-compliance with general data processing principles | link |
| ESTONIA | 17-8-2020 | 43 | Police Officer | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ITALY | 10-8-2020 | 8,900 | Cavauto S.R.L. | Art. 5 GDPR, Art. 6 GDPR, Art. 7 GDPR | Insufficient legal basis for data processing | link |
| ITALY | 10-8-2020 | 8,900 | Community of Baronissi | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 6-8-2020 | 2,600 | GROW BEATS SL | Art. 12 GDPR, Art. 13 GDPR, Art. 14 GDPR | Insufficient fulfilment of information obligations | link |
| ITALY | 6-8-2020 | 2,600 | GTL S.R.L. | Art. 12 GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| SPAIN | 6-8-2020 | 2,600 | Just Landed S.L. | Art. 13 GDPR | Insufficient fulfilment of information obligations | link |
| FRANCE | 5-8-2020 | 223,969 | Spartoo | Art. 5 (1) GDPR, Art. 13 GDPR, Art. 14 GDPR | Non-compliance with general data processing principles | link |
| FINLAND | 5-8-2020 | 6,271 | Acc Consulting Varsinais-Suomi | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 5-8-2020 | 2,600 | Restaurant | Art. 5 (1) c) GDPR, Art. 12 GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | link |
| AUSTRIA | 5-8-2020 | 89 | Bank | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ITALY | 5-8-2020 | 1800 | School | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| DENMARK | 4-8-2020 | 18,007 | PrivatBo A.M.B.A. | Art. 5 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 4-8-2020 | 53,752 | Vodafone España, SAU | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ITALY | 4-8-2020 | 13,500 | Mapei S.p.A. | Art. 5 GDPR, Art. 6 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 15 GDPR, Art. 17 GDPR | Insufficient legal basis for data processing | link |
| ITALY | 4-8-2020 | 4,400 | National Institute for Social Security – Department of the Province of Brescia | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| ITALY | 4-8-2020 | 890 | Supermarket | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| GREECE | 3-8-2020 | 2,600 | Candidate for parliamentary elections | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| SPAIN | 31-7-2020 | 40,314 | Vodafone España SAU | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 31-7-2020 | 1,343 | Tour & People Max S.L. | Art. 21 GDPR | Insufficient fulfilment of data subjects rights | link |
| ROMANIA | 30-7-2020 | 1800 | SC Viva Credit IFN SA | Art. 17 GDPR | Insufficient fulfilment of data subjects rights | link |
| ROMANIA | 30-7-2020 | 1800 | Romanian Post National Company | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ITALY | 30-7-2020 | 1800 | Community of Manduria | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ITALY | 29-7-2020 | 2,600 | Community of San Giorgio Jonico | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ITALY | 29-7-2020 | 3,600 | Region of Campania | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| DENMARK | 28-7-2020 | 132,410 | Arp Hansen Hotel Group A/S | Art. 5 (1) e) GDPR | Non-compliance with general data processing principles | link |
| BELGIUM | 28-7-2020 | 2,600 | Communal political association | Art. 5 GDPR, Art. 6 GDPR, Art. 14 GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 27-7-2020 | 4,479 | SC Cntar Tarom SA | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 23-7-2020 | 8,900 | El Periódico de Catalunya, S.L.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 23-7-2020 | 49,273 | Telefónica Móviles España, SAU | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 23-7-2020 | 62,711 | Telefónica Móviles España, SAU | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 23-7-2020 | 67,190 | Telefónica Móviles España, SAU | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 23-7-2020 | 4,400 | Xfera Moviles S.A. | Art. 58 GDPR | Insufficient cooperation with supervisory authority | link |
| SPAIN | 23-7-2020 | 4,400 | El Real Sporting de Gijón S.A.D. | Art. 6 GDPR, Art. 7 GDPR | Insufficient legal basis for data processing | link |
| HUNGARY | 23-7-2020 | 501 | Forbes Hungary | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| HUNGARY | 23-7-2020 | 1,522 | Employer | Art. 12 GDPR, Art. 15 GDPR, Art. 17 GDPR | Insufficient fulfilment of data subjects rights | link |
| SPAIN | 20-7-2020 | 21,501 | Banco Bilbao Vizcaya Argentaria, SA | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 20-7-2020 | 36,000 | Iberia Lae SA Operadora Unipersonal | Art. 58 GDPR | Insufficient cooperation with supervisory authority | link |
| SPAIN | 20-7-2020 | 1,350 | Comercial Vigobrandy, SL | Art. 12 GDPR, Art. 13 GDPR, Art. 14 GDPR | Insufficient fulfilment of information obligations | link |
| SPAIN | 20-7-2020 | 71,670 | Orange Espagne S.A.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 20-7-2020 | 62,711 | Xfera Moviles S.A. | Art. 5 GDPR | Non-compliance with general data processing principles | link |
| HUNGARY | 16-7-2020 | 25 | Google Ireland Ltd. | Art. 12 GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| POLAND | 15-7-2020 | 19,978 | Office for geodesy and cartography | Art. 31 GDPR, Art. 58 GDPR | Insufficient cooperation with supervisory authority | link |
| BELGIUM | 14-7-2020 | 537,527 | Google Belgium SA | Art. 5 GDPR, Art. 6 GDPR, Art. 17 (1) a) GDPR, Art. 12 GDPR | Insufficient fulfilment of data subjects rights | link |
| BELGIUM | 14-7-2020 | 4,400 | Operator of CCTV of a residential building | Art. 6 GDPR, Art. 7 GDPR | Insufficient legal basis for data processing | link |
| ITALY | 13-7-2020 | 180,000 | Merlini s.r.l. | Art. 5 GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 28 GDPR, Art. 29 GDPR | Insufficient legal basis for data processing | link |
| ITALY | 13-7-2020 | 14,961,172 | Wind Tre S.p.A. | Art. 5 GDPR, Art. 6 GDPR, Art. 12 GDPR, Art. 24 GDPR, Art. 25 GDPR | Insufficient legal basis for data processing | link |
| ITALY | 13-7-2020 | 716,702 | Iliad Italia S.p.A. | Art. 5 GDPR, Art. 25 GDPR | Non-compliance with general data processing principles | link |
| POLAND | 10-7-2020 | 3,045 | East Power Sp. z o.o. | Art. 31 GDPR, Art. 58 GDPR | Insufficient cooperation with supervisory authority | link |
| NORWAY | 10-7-2020 | 41,801 | Municipality of Rælingen | Art. 32 GDPR, Art. 35 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 10-7-2020 | 1,350 | Auto Desguaces Iglesias S.L. | Art. 5 GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 10-7-2020 | 890 | Centro Internacional De Crecimiento Laboral Y Profesional S.L. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 10-7-2020 | 10,750 | Vodafone España, SAU | Art. 5 GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 10-7-2020 | 4,400 | Global Business Travel Spain SLU | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 10-7-2020 | 4,400 | School Fitness Holiday & Franchising S.L. | Art. 5 GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 10-7-2020 | 49,273 | Xfera Moviles S.A. | Art. 5 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ROMANIA | 9-7-2020 | 13,500 | Proleasing Motors SRL | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| THE NETHERLANDS | 6-7-2020 | 743,579 | Bureau Krediet Registration (‘BKR’) | Art. 12 GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| SPAIN | 2-7-2020 | 21,501 | Iberdrola Clientes | Art. 5 GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 2-7-2020 | 3,600 | De Vere Spain S.L. | Art. 21 GDPR | Insufficient fulfilment of data subjects rights | link |
| NORWAY | 2-7-2020 | 25,084 | Odin Flissenter AS | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2-7-2020 | 3,225 | Saunier-Tec Mantenimientos de Calor y Frio, SL. | Art. 33 GDPR | Insufficient fulfilment of data breach notification obligations | link |
| SPAIN | 2-7-2020 | 4,400 | Xfera Moviles S.A. | Art. 31 GDPR, Art. 58 GDPR | Insufficient cooperation with supervisory authority | link |
| ITALY | 2-7-2020 | 13,500 | Mapei S.p.A. | Art. 5 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| GERMANY | 30-6-2020 | 1,110,889 | Allgemeine Ortskrankenkasse (‘AOK’) (health insurance company) | Art. 5 GDPR, Art. 6 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| DENMARK | 30-6-2020 | 6,002 | Lejre Municipality | Art. 5 GDPR, Art. 6 GDPR, Art. 33 GDPR, Art. 34 GDPR | Non-compliance with general data processing principles | link |
| IRELAND | 30-6-2020 | 36,000 | Tusla Child and Family Agency | Art. 33 GDPR | Insufficient fulfilment of data breach notification obligations | link |
| GREECE | 29-6-2020 | 4,400 | New York College S.A. | Art. 5 GDPR | Non-compliance with general data processing principles | link |
| ISLE OF MAN | 25-6-2020 | 12,094 | Department of Home Affairs | Art. 12 GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| SPAIN | 23-6-2020 | 6,719 | Miraclia (telecommunications company) | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 22-6-2020 | 1800 | Unknown | Art. 5 GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 14 GDPR | Non-compliance with general data processing principles | link |
| NORWAY | 22-6-2020 | 100,338 | Østfold HF Hospital | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| BELGIUM | 19-6-2020 | 8,900 | Unknown | Art. 5 GDPR, Art. 6 GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| NORWAY | 19-6-2020 | 25,084 | Aquateknikk AS | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 19-6-2020 | 5,375 | National Police Brigade | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 18-6-2020 | 3,600 | Enel Energie | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 16-6-2020 | 1800 | Café Bar | Art. 5 GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 14 GDPR | Non-compliance with general data processing principles | link |
| SWEDEN | 16-6-2020 | 1,702 | Housing Association | Art. 5 GDPR, Art. 6 GDPR | Non-compliance with general data processing principles | link |
| BELGIUM | 16-6-2020 | 890 | Unknown | Art. 17 GDPR, Art. 21 GDPR, Art. 31 GDPR | Insufficient fulfilment of data subjects rights | link |
| SPAIN | 15-6-2020 | 67,191 | Xfera Moviles S.A. | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| HUNGARY | 12-6-2020 | 258,013 | Digi Távközlési Szolgáltató Kft. (‘Digi’) (electronic communication service provider) | Art. 5 (1) b), (e) GDPR, Art. 32 (1), (2) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ROMANIA | 11-6-2020 | 2,600 | Telekom Romania | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 9-6-2020 | 4,400 | Consulting de Seguridad e Investigacion Mira Dp Madrid S.L. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 9-6-2020 | 483.77 | Chenming Ye (Bazar Real) | Art. 13 GDPR, Art. 14 GDPR | Insufficient fulfilment of information obligations | link |
| SPAIN | 9-6-2020 | 890 | Property Owner | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 9-6-2020 | 67,191 | Equifax Iberica, S.L. | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| SPAIN | 9-6-2020 | 34,939 | Xfera Moviles S.A. | Art. 5 (1) f) GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 9-6-2020 | 22,396 | Glovoapp23 | Art. 37 GDPR | Lack of appointment of data protection officer | link |
| SPAIN | 9-6-2020 | 36,000 | TELEFONICA MOVILES ESPAÑA, S.A.U. | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 9-6-2020 | 2,687 | Salad Market S.L. (Catering Company) | Art. 13 GDPR, Art. 14 GDPR | Insufficient fulfilment of information obligations | link |
| SPAIN | 9-6-2020 | 1800 | Attorney | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 9-6-2020 | 1800 | Property Owner | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | link |
| BELGIUM | 8-6-2020 | 4,400 | Municipal employee | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 4-6-2020 | 3,583 | Iberdrola Clientes | Art. 58 GDPR | Insufficient cooperation with supervisory authority | link |
| POLAND | 3-6-2020 | 960 | Entrepreneur running a non-public nursery and pre-school | Art. 31 GDPR, Art. 58 GDPR | Insufficient cooperation with supervisory authority | link |
| BELGIUM | 29-5-2020 | 890 | Non-profit organisation | Art. 6 GDPR, Art. 21 GDPR | Insufficient fulfilment of data subjects rights | link |
| FINLAND | 29-5-2020 | 64,503 | Taksi Helsinki | Art. 5 GDPR, Art. 6 GDPR, Art. 35 GDPR | Non-compliance with general data processing principles | link |
| FINLAND | 22-5-2020 | 89,000 | Posti Group Oyj | Art. 12 GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| FINLAND | 22-5-2020 | 14,334 | Kymen Vesi Oy | Art. 35 GDPR | Non-compliance with general data processing principles | link |
| FINLAND | 22-5-2020 | 11,198 | Unknown Company | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| IRELAND | 17-5-2020 | 67,190 | Tusla Child and Family Agency | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| DENMARK | 15-5-2020 | 6,002 | JobTeam A/S DKK | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| BELGIUM | 14-5-2020 | 44,000 | Social Media Provider | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SWEDEN | 12-5-2020 | 10,033 | Health and Medical Board of the Region of Örebro County | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 5-5-2020 | 4,450 | Banca Comercială Română SA | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| NORWAY | 3-5-2020 | 120,047 | Telenor Norge AS | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| THE NETHERLANDS | 30-4-2020 | 649,511 | Unknown Organisation | Art. 5 GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | link |
| ESTONIA | 30-4-2020 | 445 | Housing Association | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SWEDEN | 29-4-2020 | 16,752 | National Government Service Centre (NGSC) | Art. 33 GDPR, Art. 34 GDPR | Insufficient fulfilment of data breach notification obligations | link |
| BELGIUM | 28-4-2020 | 44,500 | Proximus SA | Art. 31 GDPR, Art. 58 GDPR, Art. 37 GDPR | Lack of appointment of data protection officer | link |
| ROMANIA | 23-4-2020 | 2,600 | Estee Lauder Romania | Art. 6 GDPR, Art. 7 GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 23-4-2020 | 2,600 | Telekom Romania Communications SA | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| BULGARIA | 14-4-2020 | 1800 | Political Party | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| HUNGARY | 26-3-2020 | 2,589 | Bank | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 25-3-2020 | 1800 | SOS Infertility Association | Art. 58 GDPR | Insufficient cooperation with supervisory authority | link |
| ROMANIA | 25-3-2020 | 2,600 | Enel Energie | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ROMANIA | 25-3-2020 | 3,717 | Vodafone Romania | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ROMANIA | 25-3-2020 | 2,600 | Dante International | Art. 6 GDPR, Art. 21 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 25-3-2020 | 4,400 | Xfera Moviles S.A. | Art. 58 GDPR | Insufficient cooperation with supervisory authority | link |
| GREECE | 20-3-2020 | 6,400 | Speech and Special Education Centre – Mihou Dimitra | Art. 15 GDPR, Art. 58 GDPR | Insufficient fulfilment of data subjects rights | link |
| SPAIN | 19-3-2020 | 5,375 | Oliveros Ustrell, S.L. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| HUNGARY | 19-3-2020 | 5,000 | Unknown Company | Art. 6 GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| SPAIN | 18-3-2020 | 26,876 | Telefónica | Art. 58 GDPR | Insufficient cooperation with supervisory authority | link |
| SPAIN | 16-3-2020 | 4,400 | Centro De Estudio Dirigidos Delta, S.L. | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 16-3-2020 | 3,600 | Private Person | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 16-3-2020 | 5,375 | Amalfi Servicios de Restauracion S.L. | Art. 5 GDPR, Art. 13 GDPR, Art. 14 GDPR | Non-compliance with general data processing principles | link |
| CROATIA | 13-3-2020 | unknown | Bank (name not available at the moment) | Art. 15 (1), (3) GDPR | Insufficient fulfilment of data subjects rights | link |
| SPAIN | 12-3-2020 | 1800 | Homeowners Association | Art. 5 GDPR, Art. 13 GDPR, Art. 14 GDPR | Non-compliance with general data processing principles | link |
| SWEDEN | 11-3-2020 | 6,271,150 | Google LLC | Art. 5 GDPR, Art. 6 GDPR, Art. 17 GDPR | Insufficient fulfilment of data subjects rights | link |
| DENMARK | 10-3-2020 | 6,271 | Hørsholm Municipality | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| DENMARK | 10-3-2020 | 12,542 | Gladsaxe Municipality | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ICELAND | 10-3-2020 | 18,455 | National Center of Addiction Medicine (‘SAA’) | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ICELAND | 10-3-2020 | 8,063 | Breiðholt Upper Secondary School | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 9-3-2020 | 13,500 | Gesthotel Activos Balagares | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | link |
| POLAND | 9-3-2020 | 3,942 | Vis Consulting Sp. z o.o. | Art. 31 GDPR, Art. 58 GDPR | Insufficient cooperation with supervisory authority | link |
| HUNGARY | 9-3-2020 | 779.41 | Creditor | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ITALY | 6-3-2020 | 3,600 | Liceo Artistico Statale di Napoli | Art. 5 GDPR, Art. 6 GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | link |
| ITALY | 6-3-2020 | 3,600 | Liceo Scientifico Nobel di Torre del Greco | Art. 5 GDPR, Art. 6 GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 6-3-2020 | 3,600 | Private person | Art. 5 GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 6-3-2020 | 2,867 | Retailer | Art. 13 GDPR, Art. 14 GDPR | Insufficient fulfilment of information obligations | link |
| ITALY | 5-3-2020 | 2,600 | San Giorgio Jonico | Art. 5 GDPR, Art. 6 GDPR, Art. 17 GDPR | Insufficient legal basis for data processing | link |
| POLAND | 4-3-2020 | 3,800 | School in Gdansk (Danzig) (fine imposed against town of Gdansk) | Art. 5 GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 4-3-2020 | 53,753 | Vodafone España, S.A.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| HUNGARY | 4-3-2020 | 259.8 | Representative of a local government | Art. 5 GDPR, Art. 6 GDPR, Art. 12 GDPR, Art. 15 GDPR, Art. 17 GDPR | Insufficient legal basis for data processing | link |
| THE NETHERLANDS | 3-3-2020 | 445,500 | Royal Dutch Tennis Association (‘KNLTB’) | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 3-3-2020 | 1,613 | Solo Embrague | Art. 13 GDPR | Insufficient fulfilment of information obligations | link |
| SPAIN | 3-3-2020 | 37,627 | Vodafone España, S.A.U. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 3-3-2020 | 36,000 | Vodafone España, S.A.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 3-3-2020 | 21,501 | Vodafone España, S.A.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 28-2-2020 | 43,002 | Vodafone ONO, S.A.U. | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 28-2-2020 | 3,225 | AEMA Hispánica | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | link |
| NORWAY | 28-2-2020 | 32,968 | Coop Finnmark SA | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 27-2-2020 | 107,505 | Vodafone España, S.A.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| NORWAY | 26-2-2020 | 65,937 | Rælingen Municipality | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 25-2-2020 | 43,002 | HM Hospitales | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 25-2-2020 | 4,200 | Casa Gracio Operation | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | link |
| GREECE | 21-2-2020 | 4,479 | Public Power Corporation S.A. | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| BULGARIA | 20-2-2020 | 2,293 | T.K. EOOD | Art. 25 (1) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| BULGARIA | 20-2-2020 | 2,293 | L.E. EOOD | Art. 25 (1) GDPR, Art. 32 GDPR, Art. 6 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 18-2-2020 | 1,350 | Mymoviles Europa 2000, S.L. | Art. 13 GDPR | Insufficient fulfilment of information obligations | link |
| SPAIN | 14-2-2020 | 2,240 | Grupo Valsor Y Losan, S.L. | Art. 5 (1) f) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 14-2-2020 | 2,600 | Colegio Arenales Carabanchel (School) | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 14-2-2020 | 71,670 | Iberdrola Clientes | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 14-2-2020 | 37,627 | Vodafone España, S.A.U. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 14-2-2020 | 26,876 | Xfera Moviles S.A. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ITALY | 13-2-2020 | 3,600 | Comune di Urago | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 11-2-2020 | 2,600 | Vodafone Romania | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ITALY | 6-2-2020 | 1,800 | RTI – Reti Televisive Italiane s.p.a. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 4-2-2020 | 1,350 | Cafetería Nagasaki | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 3-2-2020 | 53,753 | Xfera Moviles S.A. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 3-2-2020 | 67,191 | Vodafone España, S.A.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 3-2-2020 | 53,753 | Vodafone España, S.A.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 3-2-2020 | 44,794 | Vodafone España, S.A.U. | Art. 5 GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 3-2-2020 | 1,800 | Iberia Lineas Aereas de Espana, S.A. Operadora Unipersonal | Art. 5 GDPR, Art. 6 GDPR, Art. 21 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 3-2-2020 | 67,191 | Vodafone España, S.A.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 3-2-2020 | 5,976 | Banco Bilbao Vizcaya Argentaria S.L. | Art. 5 GDPR, Art. 6 GDPR, Art. 21 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 3-2-2020 | 4,400 | Queseria Artesenal Ameco S.L. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 3-2-2020 | 716.7 | Automoción | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ITALY | 30-1-2020 | 3,600 | Comune di Colledara | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| HUNGARY | 24-1-2020 | 1,299 | Accounting firm | Art. 24 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ITALY | 23-1-2020 | 26,000 | Azienda Ospedaliero Universitaria Integrata di Verona (Hospital) | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ITALY | 23-1-2020 | 26,000 | Sapienza Università di Roma | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ITALY | 15-1-2020 | 24,905,425 | TIM (telecommunications operator) | Art. 5 GDPR, Art. 6 GDPR, Art. 17 GDPR, Art. 21 GDPR, Art. 32 GDPR | Insufficient legal basis for data processing | link |
| ITALY | 15-1-2020 | 8,900 | Community of Francavilla Fontana | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 14-1-2020 | 3,225 | Zhang Bordeta 2006, S.L. (Store and Restaurant) | Art. 5 GDPR | Non-compliance with general data processing principles | link |
| CYPRUS | 13-1-2020 | 8,063 | Social Insurance Services of the Ministry of Labor, Welfare and Social Insurance | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| CYPRUS | 13-1-2020 | 890 | eShop for Sports (M.L. PRO.FIT SOLUTIONS LTD) | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| GREECE | 13-1-2020 | 13,500 | Allseas Marine S.A. | Art. 5 (1) a), (2) GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 9-1-2020 | 2,600 | Vodafone España, S.A.U. | Art. 58 GDPR | Insufficient cooperation with supervisory authority | link |
| SPAIN | 7-1-2020 | 39,419 | Vodafone España, S.A.U. | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 7-1-2020 | 67,191 | EDP España S.A.U. | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 7-1-2020 | 67,191 | EDP Comercializadora, S.A.U. | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 7-1-2020 | 8,900 | Asociación de Médicos Demócratas | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| BULGARIA | 6-1-2020 | 4,400 | Utility Company | Art. 6 (1) GDPR | Insufficient legal basis for data processing | link |
| GREECE | 19-12-2019 | 134,382 | Aegean Marine Petroleum Network Inc. | Art. 5 GDPR, Art. 6 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ROMANIA | 18-12-2019 | 1800 | Telekom Romania Mobile Communications SA | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| UNITED KINGDOM | 17-12-2019 | 286,681 | Doorstep Dispensaree Ltd. (Pharmacy) | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| BELGIUM | 17-12-2019 | 1800 | Nursing Care Organisation | Art. 12 GDPR, Art. 15 GDPR, Art. 17 GDPR | Insufficient fulfilment of data subjects rights | link |
| BELGIUM | 17-12-2019 | 13,500 | Website providing legal information | Art. 6 GDPR, Art. 12 GDPR, Art. 13 GDPR | Insufficient fulfilment of information obligations | link |
| SWEDEN | 16-12-2019 | 31,356 | Nusvar AB | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 16-12-2019 | 1800 | Globus Score SRL | Art. 58 GDPR | Insufficient cooperation with supervisory authority | link |
| ROMANIA | 16-12-2019 | 5,375 | SC Enel Energie S.A. (Electricity Distributor) | Art. 5 GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 21 GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 13-12-2019 | 4,400 | Entirely Shipping & Trading S.R.L. | Art. 5 (1) GDPR, Art. 6 GDPR, Art. 7 GDPR | Non-compliance with general data processing principles | link |
| ROMANIA | 13-12-2019 | 4,400 | Entirely Shipping & Trading S.R.L. | Art. 5 (1) GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 9 GDPR | Non-compliance with general data processing principles | link |
| HUNGARY | 11-12-2019 | 1,281 | Unknown Company | Art. 5 GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 24 GDPR, Art. 25 GDPR | Non-compliance with general data processing principles | link |
| ITALY | 11-12-2019 | 7,614,968 | Eni Gas e Luce | Art. 5 GDPR, Art. 6 GDPR, Art. 17 GDPR, Art. 21 GDPR | Insufficient legal basis for data processing | link |
| ITALY | 11-12-2019 | 2,600,000 | Eni Gas e Luce | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 10-12-2019 | 1,433 | Megastar SL | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | |
| SPAIN | 10-12-2019 | 4,400 | Shop Macoyn, S.L. | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ROMANIA | 10-12-2019 | 12,542 | Hora Credit IFN SA | Art. 5 GDPR, Art. 25 GDPR, Art. 32 GDPR, Art. 33 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| GERMANY | 9-12-2019 | 8,555,640 | Telecoms provider (1&1 Telecom GmbH) | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| GERMANY | 9-12-2019 | 8,900 | Rapidata GmbH | Art. 37 GDPR | Lack of appointment of data protection officer | link |
| ROMANIA | 4-12-2019 | 18,000 | S CNTAR TAROM SA (Airline) | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| GERMANY | 3-12-2019 | 94,067 | Hospital | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 3-12-2019 | 1,350 | Cerrajeria Verin S.L. | Art. 13 GDPR | Insufficient fulfilment of information obligations | link |
| SPAIN | 3-12-2019 | 4,479 | Linea Directa Aseguradora | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 2-12-2019 | 1800 | Nicola Medical Team 17 SRL | Art. 58 GDPR | Insufficient cooperation with supervisory authority | link |
| ROMANIA | 29-11-2019 | 2,240 | Royal President S.R.L. | Art. 15 GDPR, Art. 6 GDPR, Art. 32 GDPR | Insufficient fulfilment of data subjects rights | link |
| ROMANIA | 29-11-2019 | 440 | Homeowners Association | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| BELGIUM | 28-11-2019 | 4,400 | Mayor | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| BELGIUM | 28-11-2019 | 4,400 | Municipal alderman | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 28-11-2019 | 71,670 | ING Bank N.V. | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 28-11-2019 | 67,191 | Curenergía Comercializador de último recurso | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 26-11-2019 | 2,600 | Modern Barber | Art. 58 GDPR | Insufficient cooperation with supervisory authority | link |
| ROMANIA | 25-11-2019 | 9,700 | Courier Services Company | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ROMANIA | 22-11-2019 | 1800 | BNP Paribas Personal Finance S.A. | Art. 12 GDPR, Art. 17 GDPR | Insufficient fulfilment of data subjects rights | link |
| SPAIN | 21-11-2019 | 53,753 | Viaqua Xestión Integral Augas de Galicia | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| FRANCE | 21-11-2019 | 445,500 | Futura Internationale | Art. 5 GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 21 GDPR | Insufficient fulfilment of data subjects rights | link |
| SPAIN | 19-11-2019 | 53,753 | Corporación radiotelevisión espanola | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 19-11-2019 | 53,753 | Xfera Moviles S.A. | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 19-11-2019 | 5,375 | Sports Bar | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 14-11-2019 | 26,000 | Telefónica SA | Art. 5 GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 13-11-2019 | 2,600 | General Confederation of Labour (‘CGT’) | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 7-11-2019 | 806.29 | TODOTECNICOS24H S.L. | Art. 13 GDPR | Insufficient fulfilment of information obligations | link |
| SPAIN | 6-11-2019 | 806.29 | Cerrajero Online | Art. 13 GDPR | Insufficient fulfilment of information obligations | link |
| SPAIN | 6-11-2019 | 53,753 | Vodafone España, S.A.U. | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| LATVIA | 1-11-2019 | 135,000 | Unknown | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 31-10-2019 | 5,375 | Jocker Premium Invex | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| THE NETHERLANDS | 31-10-2019 | 806290 | UWV (Dutch employee insurance service provider) | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| THE NETHERLANDS | 31-10-2019 | 44,000 | Menzis (Health Insurance Company) | Art. 5 GDPR | Non-compliance with general data processing principles | link |
| GERMANY | 30-10-2019 | 12,990,239 | Deutsche Wohnen SE | Art. 5 GDPR, Art. 25 GDPR | Non-compliance with general data processing principles | link |
| GERMANY | 30-10-2019 | unknown | Deutsche Wohnen SE | Art. 5 GDPR | Non-compliance with general data processing principles | link |
| BULGARIA | 28-10-2019 | 445 | Employer | Art. 12 (3) GDPR, Art. 15 (1) GDPR | Insufficient fulfilment of data subjects rights | link |
| SPAIN | 25-10-2019 | 32,252 | Vodafone España, S.A.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| CYPRUS | 25-10-2019 | 62,712 | LGS Handling Ltd, Louis Travel Ltd, and Louis Aviation Ltd | Art. 6 GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | link |
| CYPRUS | 25-10-2019 | 8,959 | LGS Handling Ltd, Louis Travel Ltd, and Louis Aviation Ltd | Art. 6 GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | link |
| CYPRUS | 25-10-2019 | 1,800 | LGS Handling Ltd, Louis Travel Ltd, and Louis Aviation Ltd | Art. 6 GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | link |
| HUNGARY | 24-10-2019 | 6,630 | Military Hospital | Art. 32 GDPR, Art. 33 GDPR | Insufficient fulfilment of data breach notification obligations | link |
| GERMANY | 24-10-2019 | 89,000 | Food company | Art. 5 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| AUSTRIA | 23-10-2019 | 16,125,814 | Austrian Post | Art. 5 (1) a) GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 23-10-2019 | 53,753 | Vodafone España, S.A.U. | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | link |
| POLAND | 18-10-2019 | 8,403 | Major of Aleksandrów Kujawski | Art. 28 GDPR | Insufficient data processing agreement | link |
| GREECE | 18-10-2019 | 18,000 | Wind Hellas Telecommunications | Art. 21 GDPR | Insufficient fulfilment of data subjects rights | link |
| ROMANIA | 17-10-2019 | 2,240 | UTTIS INDUSTRIES SRL | Art. 12 GDPR, Art. 13 GDPR, Art. 5 (1) c) GDPR, Art. 6 GDPR | Insufficient fulfilment of information obligations | link |
| SPAIN | 16-10-2019 | 53,753 | Xfera Moviles S.A. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 16-10-2019 | 7,167 | Iberdrola Clientes | Art. 31 GDPR | Insufficient cooperation with supervisory authority | link |
| POLAND | 16-10-2019 | 42,106 | ClickQuickNow | Art. 5 GDPR | Non-compliance with general data processing principles | link |
| HUNGARY | 15-10-2019 | 2,562 | Unknown Company | Art. 5 GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 24 GDPR, Art. 25 GDPR | Non-compliance with general data processing principles | link |
| ROMANIA | 9-10-2019 | 135,000 | Raiffeisen Bank SA | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ROMANIA | 9-10-2019 | 18,000 | Vreau Credit SRL | Art. 32 GDPR, Art. 33 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| BULGARIA | 8-10-2019 | 4,550 | The Ministry of Interior Affairs | Art. 5 (1) GDPR, Art. 6 (1) GDPR | Insufficient legal basis for data processing | link |
| GREECE | 7-10-2019 | 180,000 | Telecommunication Service Provider | Art. 5 (1) c) GDPR, Art. 25 GDPR | Non-compliance with general data processing principles | link |
| GREECE | 7-10-2019 | 180,000 | Telecommunication Service Provider | Art. 21 (3) GDPR, Art. 25 GDPR | Non-compliance with general data processing principles | link |
| BULGARIA | 7-10-2019 | 445 | B.D. | Art. 31 GDPR | Insufficient cooperation with supervisory authority | link |
| SPAIN | 1-10-2019 | 26,000 | Vueling Airlines | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| HUNGARY | 1-10-2019 | 13,500 | Town of Kerepes | Art. 6 (1) GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 26-9-2019 | 8,063 | Inteligo Media SA | Art. 5 (1) a) GDPR, Art. 6 (1) a) GDPR | Insufficient legal basis for data processing | link |
| GERMANY | 19-9-2019 | 175,061 | Delivery Hero | Art. 15 GDPR, Art. 17 GDPR, Art. 21 GDPR | Insufficient fulfilment of data subjects rights | link |
| BELGIUM | 17-9-2019 | 89,000 | Merchant | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | link |
| POLAND | 10-9-2019 | 577,842 | Morele.net | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| BULGARIA | 3-9-2019 | 25,174 | National Revenue Agency | Art. 6 (1) GDPR, Art. 58 (2) e) GDPR, Art. 83 (5) a) GDPR | Insufficient legal basis for data processing | link |
| BULGARIA | 3-9-2019 | 900 | Telecommunication service provide | Art. 6 (1) GDPR, Art. 25 (1) GDPR | Insufficient legal basis for data processing | link |
| BULGARIA | 3-9-2019 | 4,500 | Telecommunication service provide | Art. 6 (1) GDPR, Art. 25 (1) GDPR | Insufficient legal basis for data processing | link |
| BULGARIA | 3-9-2019 | 10,536 | Commercial representative of telecommunication service provider | Art. 6 (1) GDPR | Insufficient legal basis for data processing | link |
| BULGARIA | 3-9-2019 | 900 | Private enforcement agent | Art. 12 (4) GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| BULGARIA | 28-8-2019 | 2,329,284 | National Revenue Agency | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| BULGARIA | 28-8-2019 | 445,000 | DSK Bank | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| LATVIA | 26-8-2019 | 6,271 | Online Services | Art. 17 GDPR | Insufficient fulfilment of data subjects rights | link |
| SWEDEN | 20-8-2019 | 16,690 | School in Skellefteå | Art. 5 (1) c) GDPR, Art. 9 GDPR, Art. 35 GDPR, Art. 36 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 16-8-2019 | 53,753 | AVON COSMETICS | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| HUNGARY | 8-8-2019 | 1,536 | Government Office Managing the Real Estate Register | Art. 5 GDPR, Art. 14 GDPR | Non-compliance with general data processing principles | link |
| GERMANY | 5-8-2019 | 180 | Private person (YouTube-Channel) | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| HUNGARY | 2-8-2019 | 3,843 | Public area maintenance company | Art. 5 GDPR, Art. 6 GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | link |
| AUSTRIA | 1-8-2019 | 44,000 | Company in the medical sector | Art. 13 GDPR, Art. 37 GDPR | Insufficient fulfilment of information obligations | link |
| GREECE | 30-7-2019 | 134,382 | PWC Business Solutions | Art. 5 (1) GDPR, Art. 5 (2) GDPR, Art. 6 (1) GDPR, Art. 13 (1) c) GDPR, Art. 14 (1) c) GDPR | Insufficient legal basis for data processing | link |
| FRANCE | 25-7-2019 | 161,258 | ACTIVE ASSURANCES (car insurer) | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| HUNGARY | 17-7-2019 | 7,682 | Budapest Environs Regional Court | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 5-7-2019 | 2,600 | LEGAL COMPANY & TAX HUB SRL | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| ROMANIA | 2-7-2019 | 13,438 | WORLD TRADE CENTER BUCHAREST SA | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| AUSTRIA | 1-7-2019 | 9,100 | Private person (soccer coach) | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| ROMANIA | 27-6-2019 | 116,464 | UNICREDIT BANK SA | Art. 25 (1) GDPR, Art. 5 (1) c) GDPR | Insufficient technical and organisational measures to ensure information security | link |
| HUNGARY | 26-6-2019 | 2,553 | Unknown | Art. 5 GDPR, Art. 6 GDPR, Art. 17 GDPR | Insufficient legal basis for data processing | link |
| HUNGARY | 26-6-2019 | 2,553 | Financial Enterprise | Art. 5 GDPR, Art. 6 GDPR, Art. 21 GDPR | Insufficient legal basis for data processing | link |
| HUNGARY | 25-6-2019 | 13,500 | Unknown | Art. 33 GDPR | Insufficient fulfilment of data breach notification obligations | link |
| THE NETHERLANDS | 18-6-2019 | 412,104 | Haga Hospital | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| FRANCE | 13-6-2019 | 18,000 | Employer UNIONTRAD COMPANY | Art. 5 (1) c) GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 32 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 11-6-2019 | 223,970 | Professional Football League (LaLiga) | Art. 5 (1) a), Art. 7 (3) GDPR | Insufficient fulfilment of information obligations | link |
| DENMARK | 3-6-2019 | 179,937 | IDdesign A / S | Art. 5 (1) e) GDPR, Art. 5 (2) GDPR | Non-compliance with general data processing principles | link |
| HUNGARY | 3-6-2019 | 2,553 | Claim management company | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| HUNGARY | 31-5-2019 | 1,800 | Local bank | Art. 12 (3), (4), (5) GDPR, Art. 15 GDPR, Art. 18 GDPR | Insufficient fulfilment of data subjects rights | link |
| BELGIUM | 28-5-2019 | 1,800 | Mayor | Art. 5 (1) b) GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| FRANCE | 28-5-2019 | 360,000 | SERGIC (Real Estate) | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| HUNGARY | 23-5-2019 | 82,552 | Organizer of SZIGET festival and VOLT festival | Art. 6 GDPR, Art. 5 (1) b) GDPR, Art. 13 GDPR | Insufficient legal basis for data processing | link |
| HUNGARY | 21-5-2019 | 256.22 | Directorate of Social and Child Welfare Institutions of the Ferencvaros District of Budapest | Art. 33 GDPR | Insufficient fulfilment of data breach obligations | link |
| LITHUANIA | 16-5-2019 | 55,097 | Payment service provider UAB MisterTango | Art. 5 GDPR, Art. 32 GDPR, Art. 33 GDPR | Insufficient fulfilment of data breach notification obligations | link |
| GERMANY | 9-5-2019 | 1,300 | Police Officer | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| CZECH REPUBLIC | 6-5-2019 | 173.8 | Unknown | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| NORWAY | 29-4-2019 | 107,505 | Oslo Municipal Education Department | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| POLAND | 25-4-2019 | 11,602 | Sports association | Art. 6 GDPR | Insufficient legal basis for data processing | link link |
| ITALY | 17-4-2019 | 44,000 | Italian political party Movimento 5 Stelle | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| HUNGARY | 17-4-2019 | 8,421 | Unknown | Art. 5 (1) a) GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| GERMANY | 12-4-2019 | 71,670 | Company in the financial sector | Art. 5 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| BULGARIA | 8-4-2019 | 440 | Medical centers | Art. 5 (1) a) GDPR, Art. 9 (1) GDPR, Art. 9 (2) GDPR, Art. 6 (1) GDPR | Insufficient legal basis for data processing | link |
| HUNGARY | 5-4-2019 | 30,796 | Hungarian political party | Art. 33 (1) GDPR, Art. 33 (5) GDPR, Art. 34 (1) GDPR | Insufficient fulfilment of data breach notification obligations | link |
| HUNGARY | 5-4-2019 | 1,702 | Unknown | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| POLAND | 26-3-2019 | 197,093 | Private company working with data from publicly available sources | Art. 14 GDPR | Insufficient fulfilment of information obligations | link |
| BULGARIA | 26-3-2019 | 4,400 | A.P. EOOD | Art. 5 (1) a) GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| PORTUGAL | 25-3-2019 | 1,800 | Unknown | Art. 13 GDPR | Insufficient fulfilment of information obligations | link |
| CZECH REPUBLIC | 21-3-2019 | 8,900 | Unknown | Art. 5 (1) GDPR | Non-compliance with general data processing principles | link |
| PORTUGAL | 19-3-2019 | 1,800 | Unknown | Art. 13 GDPR | Insufficient fulfilment of information obligations | link |
| HUNGARY | 4-3-2019 | 2,867 | Unnamed financial institution | Art. 5 (1) b) GDPR, Art. 5 (1) c) GDPR, Art. 13 (3) GDPR, Art. 17 (1) GDPR, Art. 6 (4) GDRP | Insufficient fulfilment of data subjects rights | link link |
| GERMANY | 1-3-2019 | 44,000 | N26 | Art. 6 GDPR | Insufficient legal basis for data processing | Page 131 of the activity report of the Data Protection Commissioner of Berlin link link |
| NORWAY | 1-3-2019 | 152,299 | Bergen Municipality | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| CZECH REPUBLIC | 28-2-2019 | 500 | Unknown | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| HUNGARY | 28-2-2019 | 2,867 | Mayor’s Office of the city of Kecdkemét | Art. 5 (1) a) GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link link |
| BULGARIA | 26-2-2019 | 24,278 | Telecommunication service provider | Art. 6 GDPR, Art. 5 (1) a) GDPR | Insufficient legal basis for data processing | link |
| CZECH REPUBLIC | 26-2-2019 | 695.2 | Unknown | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| BULGARIA | 22-2-2019 | 440 | Employer | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| HUNGARY | 20-2-2019 | 13,500 | Debt collector | Art. 5 (1) a) GDPR, Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | link link |
| MALTA | 18-2-2019 | 4,400 | Lands Authority | Art. 5 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| HUNGARY | 8-2-2019 | 1,398 | Bank | Art. 5 (1) d) GDPR | Non-compliance with general data processing principles | link link |
| GERMANY | 5-2-2019 | 2,240 | Private person | Art. 6 GDPR, Art. 5 GDPR | Insufficient legal basis for data processing | link |
| PORTUGAL | 5-2-2019 | 18,000 | Unknown | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| CZECH REPUBLIC | 4-2-2019 | 1,044 | Car renting company | Art. 5 (1) a) GDPR | Insufficient fulfilment of information obligations | link |
| CZECH REPUBLIC | 4-2-2019 | 1,044 | Credit brokerage | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| FRANCE | 21-1-2019 | 44,000,000 | Google Inc. | Art. 13 GDPR, Art. 14 GDPR, Art. 6 GDPR, Art. 5 GDPR | Insufficient legal basis for data processing | link |
| BULGARIA | 17-1-2019 | 440 | Bank | Art. 6 GDPR, Art. 5 (1) a) GDPR | Insufficient legal basis for data processing | link |
| CZECH REPUBLIC | 10-1-2019 | 347.6 | Employer | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| CYPRUS | 2019 | 4,400 | State Hospital | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| CYPRUS | 2019 | 8,900 | Newspaper | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| DENMARK | 2019 | 143,341 | Taxa 4×35 | Art. 5(1) e) GDPR | Non-compliance with general data processing principles | link |
| CYPRUS | 2019 | 12,542 | Doctor | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| GERMANY | 2019 | Unknown | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link | |
| SPAIN | 2019 | 18,500 | Vodafone España, S.A.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2019 | 32,252 | VODAFONE ONO, S.A.U. | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 2019 | 43,002 | VODAFONE ONO, S.A.U. | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 2019 | 43,002 | TELEFONICA MOVILES ESPAÑA, S.A.U. | Art. 5 (1) a) GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 2019 | 26,000 | Vodafone España, S.A.U. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | 2019 | 36,000 | Vodafone España, S.A.U. | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | 2019 | 18,000 | Private Person | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 2019 | 8,063 | Private Person | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | link |
| SPAIN | 2019 | 3,225 | AMADOR RECREATIVOS, S.L | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | link |
| GERMANY | 2019 | 716.7 | Police Officer | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| GERMANY | 2019 | 263,388 | Unknown | Art. 5 GDPR | Non-compliance with general data processing principles | link |
| GERMANY | 2019 | 46,000 | Facebook Germany GmbH | Art. 37 GDPR | Lack of appointment of data protection officer | link |
| GERMANY | 2019 | 18,000 | Hamburger Verkehrsverbund GmbH (HVV GmbH) | Art. 33 GDPR, Art. 34 GDPR | Insufficient fulfilment of data breach notification obligations | link |
| GERMANY | 2019 | Unknown | Hamburger Volksbank eG | Art. 21 GDPR | Insufficient fulfilment of data subjects rights | link |
| GERMANY | 2019 | 1,800 | Restaurant | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | link |
| GERMANY | 2019 | 45100 | Unknown Company | Art. 15 GDPR, Art. 28 GDPR | Insufficient fulfilment of data subjects rights | link |
| AUSTRIA | 20-12-2018 | 19,800 | Private person | Art. 5 (1) a) GDPR, Art. 5 (1) c) GDPR, Art. 6 (1) GDPR, Art. 13 GDPR | Insufficient legal basis for data processing | link |
| HUNGARY | 18-12-2018 | 2,888 | Unknown | Art. 12 (4) GDPR, Art. 15 GDPR, Art. 18 (1) c) GDPR, Art. 13 GDPR | Insufficient fulfilment of data subjects rights | link |
| GERMANY | 17-12-2018 | 4,500 | Kolibri Image Regina und Dirk Maass GbR | Art. 28 (3) GDPR | Insufficient data processing agreement | link link |
| AUSTRIA | 9-12-2018 | 4,332 | Betting place | Art. 13 GDPR | Insufficient fulfilment of information obligations | link |
| BULGARIA | 4-12-2018 | 451 | Bank | Art. 5 (1) b) GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | |
| GERMANY | 21-11-2018 | 18,500 | Knuddels.de | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link link |
| CZECH REPUBLIC | 25-10-2018 | 350 | Unknown | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| AUSTRIA | 27-9-2018 | 270 | Private car owner | Art. 5 (1) a) GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| PORTUGAL | 18-7-2018 | 36,100 | Public Hospital | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| AUSTRIA | 2018 | 1,625 | Kebab restaurant | Art. 5 GDPR, Art. 13 GDPR, Art. 14 GDPR | Insufficient legal basis for data processing | link |
| GERMANY | 2018 | 18,500 | Unknown | Art. 83 (4) a) GDPR, Art. 33 (1) GDPR, Art. 34 (1) GDPR | Insufficient fulfilment of data breach notification obligations | Page 134 of the activity report of the Data Protection Commissioner of Hamburg, accessible under link |
| GERMANY | 2018 | 451 | Unknown | Unknown | Unknown | link |
| CZECH REPUBLIC | Unknown | 2,834 | UniCredit Bank Czech Republic and Slovakia, a.s. | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| GERMANY | Unknown | 106 | Unknown | Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SPAIN | Unknown | 4,500 | Vodafone España, S.A.U. | Art. 5 (1) d) GDPR | Non-compliance with general data processing principles | link |
| SPAIN | Unknown | 54,000 | Debt collecting agancy (GESTIÓN DE COBROS, YO COBRO SL) | Art. 5 (1) f) GDPR | Insufficient legal basis for data processing | link |
| SPAIN | Unknown | 24,000 | Vodafone España, S.A.U. | Art. 5 (1) d) GDPR | Insufficient fulfilment of data subjects rights | link |
| SPAIN | Unknown | 54,000 | ENDESA (energy supplyer) | Art. 5 (1) f) GDPR | Insufficient legal basis for data processing | link |
| SPAIN | Unknown | 8,666 | Restaurant (SANTI 3000, S.L.) | Art. 5 (1) a) GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | link |
| SLOVAKIA | Unknown | Unknown | Unknown | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | link |
| SLOVAKIA | Unknown | Unknown | Unknown | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SLOVAKIA | Unknown | Unknown | Unknown | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SLOVAKIA | Unknown | Unknown | Unknown | Art. 5 (1) a) GDPR, Art. 6 (1) a) GDPR | Insufficient legal basis for data processing | link |
| SLOVAKIA | Unknown | 36,000 | Slovak Telekom | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | Unknown | 10,830 | Madrileña Red de Gas | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SLOVAKIA | Unknown | 45,000 | Social Insurance Agency | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| CZECH REPUBLIC | Unknown | 538 | Alza.cz a.s. | Art. 6 GDPR, Art. 7 GDPR | Insufficient legal basis for data processing | link |
| CZECH REPUBLIC | Unknown | 884 | Individual entrepreneur – no further details published | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | link |
| SPAIN | Unknown | 9,025 | Ikea Ibérica | Art. 6 GDPR | Insufficient legal basis for data processing | link |