Most of it wasn't anything dramatic. Most of it was a misconfigured cookie banner, a missing alt text, a fake countdown timer. Here is the data, visualised.
Three fresh decisions from three regulators, in three different sectors. The pace is not slowing.
Artmark Holding SRL was fined by ANSPDCP 10,000 RON for sending unsolicited commercial emails without obtaining prior explicit consent from recipients. The case concerns a breach of rules on electronic marketing communications and consent requirements.
AVIZIERO S.R.L was fined RON 5,000 by ANSPDCP for allowing the storage of information and access to information stored on user equipment when users accessed its website. The authority found this conduct to be in breach of ePrivacy requirements.
ANSPDCP completed an investigation at Dormeo Home SRL in May 2026 and found a breach of GDPR provisions. As a result, a fine of EUR 1,000 was imposed.
A handful of regulators do most of the work. Spain leads in volume; Ireland leads in headline numbers; Germany leads in unpredictability.
Enforcement intensifies as new directives come online. EAA arrived in June 2025. AI Act lands in August 2026. The slope only goes up.
Each rectangle is one enforcement decision, sized by amount, coloured by directive. Two companies account for nearly half of all enforcement.
GDPR still dominates, but ePrivacy and Omnibus are growing fastest. EAA is brand new. AI Act is loaded and waiting.
The EU AI Act is in force, but penalties for prohibited and high-risk AI phase in through 2026–2027. No fine has been issued yet — we'll log the first the moment it lands.
Every fine logged in the last 30 days. With short summaries and the verdict: would we have spotted it.
Artmark Holding SRL was fined by ANSPDCP 10,000 RON for sending unsolicited commercial emails without obtaining prior explicit consent from recipients. The case concerns a breach of rules on electronic marketing communications and consent requirements.
AVIZIERO S.R.L was fined RON 5,000 by ANSPDCP for allowing the storage of information and access to information stored on user equipment when users accessed its website. The authority found this conduct to be in breach of ePrivacy requirements.
ANSPDCP completed an investigation at Dormeo Home SRL in May 2026 and found a breach of GDPR provisions. As a result, a fine of EUR 1,000 was imposed.
SSG SELECT SOLUTIONS S.R.L. was fined by ANSPDCP in the amount of EUR 2,000 for GDPR violations. The investigation was completed in April 2026.
Compania Națională Poșta Română was fined by ANSPDCP in the amount of EUR 5,000 for GDPR violations. The case concerned non-compliance with personal data protection requirements.
The Norwegian DPA, Datatilsynet, fined Elkjøp 20 million NOK for processing personal data in its customer club without valid consent. The authority found that the practice breached GDPR requirements on lawful processing.
NAIH imposed a fine of 25,000,000 HUF on IndaNext Hungary Kft. for unlawfully publishing personal data and special category data of an individual on www.blikk.hu. The authority found no legal basis and identified breaches of GDPR Articles 6, 9, and 12.
Unicredit Bank SA was fined EUR 2,000 by ANSPDCP. The authority found that the bank failed to notify a personal data breach within the required 72-hour deadline.
Unicredit Bank SA was fined EUR 10,000 by ANSPDCP for violating GDPR provisions. The case concerns non-compliance with personal data protection requirements and should be considered in compliance risk assessments.
The Italian Data Protection Authority fined AgID €55,000 for failing to adequately inform professionals about the automatic registration of their digital domiciles. The authority found breaches of transparency and data processing principles.
The Italian Data Protection Authority imposed a 700 EUR fine on Croce Rossa Italiana – Comitato regionale Toscana – Presidio Anna Torrigiani. The case concerned a data protection breach during a patient's hospitalization in the orthopedics department, including improper handling of information about HIV status.
Comune di Sciacca was fined EUR 6,000 by the Garante for violations related to the processing and dissemination of personal data in the public sector. The case concerned improper handling of personal data within public administration activities.
All data is sourced from primary documents — official regulator decisions, press releases, and published rulings. No paywalls, no scraping of commercial databases.
Decisions are pulled directly from regulator websites — CNIL, AEPD, AGCM, ACM, UOKiK, Bundesnetzagentur, the European Commission and 24 others.
Each decision passes through an extraction pipeline: structured fields (company, amount, date, articles violated) are parsed and translated into a common schema.
Violation types are tagged against the Compliwatch taxonomy of 100+ technical checks. Each fine is then mapped to "detectable by automated scan: yes / partial / no".
Verified entries are published with a link to the original source. Errors and corrections are versioned and credited. All amounts are converted to EUR at the date-of-decision rate.