BULLETIN №081Last updated · 26 Jul 2026
Fine Tracker.
A public register of regulatory fines issued under EU compliance directives. Updated as decisions are published by national supervisory authorities.
5,273 entries
- Total fines
- €8.6bn
- Decisions
- 5,273
- Jurisdictions
- 33
- Regulators
- 74
- Avg monthly
- €162.7m
- YoY volume
- -20.7%
| Imposed | Company | Country | Authority | Type | Amount | ↗ |
|---|---|---|---|---|---|---|
| 08 Jan 2026 | Amendă pentru încălcarea Legii nr. 506/2004 și a RGPDA fine of EUR 2,000 was imposed for violations of certain provisions of Law No. 506/2004 and the GDPR. The case concerns non-compliant personal data processing and privacy protection obligations. | RO | ANSPDCP | GDPR | €2,000 | ↗ |
| 08 Jan 2026 | OPÉRATEUR DE TÉLÉPHONIE FIXECNIL imposed an administrative fine of EUR 15 million on a fixed-line telecom operator and issued an injunction. The case concerns a breach requiring corrective action and compliance with regulatory obligations. | FR | CNIL | GDPR | €15,000,000 | ↗ |
| 08 Jan 2026 | MEDIOS DE PREVENCIÓN EXTERNOS SUR, S.L.The company suffered a ransomware attack that caused a breach of the confidentiality and availability of personal data. AEPD found a violation of Article 5(1)(f) GDPR. | ES | AEPD | GDPR | €60,000 | ↗ |
| 02 Jan 2026 | Dane anonimowe (Spółkę)UODO imposed an administrative fine of PLN 978,128 on the company. The authority found that the controller did not ensure the independence of the Data Protection Officer and failed to prevent a conflict of interest arising from the DPO’s other tasks and duties. | PL | UODO | GDPR | €232,000 | ↗ |
| 01 Jan 2026 | Telekommunikationsunternehmen aus NRWThe Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen imposed a total fine of EUR 300,000 on a telecommunications company from North Rhine-Westphalia. The authority found breaches of transparency obligations and data subject rights, including requests for access, deletion, and objection. | DE | Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen | GDPR | €300,000 | ↗ |
| 01 Jan 2026 | CloudflareAGCOM issued an ordinanza ingiunzione against Cloudflare under the Digital Services Act. The fine is 100,000 EUR and relates to a breach of DSA obligations. | IT | AGCOM | DSA | €100,000 | ↗ |
| 31 Dec 2025 | UNIVERSITE (procédure simplifiée)CNIL imposed an administrative fine of EUR 20,000 on UNIVERSITE (procédure simplifiée). The case concerned a confirmed breach of rules supervised by CNIL. | FR | CNIL | GDPR | €20,000 | ↗ |
| 30 Dec 2025 | SOCIETE DU SECTEUR TERTIAIREThe CNIL imposed an administrative fine of EUR 3,500,000 on SOCIETE DU SECTEUR TERTIAIRE. The case concerns a breach of personal data protection rules. | FR | CNIL | GDPR | €3,500,000 | ↗ |
| 30 Dec 2025 | SOCIETE EXERCANT UNE ACTIVITE DE FRET AEROPORTUAIRE (procédure simplifiée)The CNIL imposed an administrative fine of EUR 10,000 on SOCIETE EXERCANT UNE ACTIVITE DE FRET AEROPORTUAIRE. The case was handled under a simplified procedure. | FR | CNIL | GDPR | €10,000 | ↗ |
| 30 Dec 2025 | Roumasport S.R.LRoumasport S.R.L was fined EUR 10,000 by ANSPDCP for violating GDPR provisions. The case concerns non-compliant processing of personal data. | RO | ANSPDCP | GDPR | €10,000 | ↗ |
| 30 Dec 2025 | SOCIETE AYANT POUR ACTIVITE L'ACQUISITION ET LA GESTION D'HOTELS/RESIDENCES HOTELIERES (procédure simplifiée)The CNIL imposed an administrative fine of 5,000 EUR on the company engaged in the acquisition and management of hotels and hotel residences. The case was handled under a simplified procedure. | FR | CNIL | GDPR | €5,000 | ↗ |
| 29 Dec 2025 | SOCIETE EXERCANT UNE ACTIVITE D'EDITION DE JOURNAUX (procédure simplifiée)The CNIL imposed an administrative fine of 5,000 EUR on SOCIETE EXERCANT UNE ACTIVITE D'EDITION DE JOURNAUX. The case was handled under a simplified procedure. | FR | CNIL | GDPR | €5,000 | ↗ |
| 29 Dec 2025 | KomendantaUODO imposed an administrative fine of PLN 40,000 on Komendanta for unlawful processing of personal data, including special category data, by publishing it on a website without a legal basis. The authority also found that appropriate technical and organizational measures were not implemented and ordered the processing operations to be brought into compliance with GDPR requirements. | PL | UODO | GDPR | €9,457 | ↗ |
| 29 Dec 2025 | SOCIETE EXERCANT UNE ACTIVITE DE COMMERCE DE GRANDE DISTRIBUTION (procédure simplifiée)CNIL imposed an administrative fine of 6,000 EUR on SOCIETE EXERCANT UNE ACTIVITE DE COMMERCE DE GRANDE DISTRIBUTION and issued an injunction. The case was handled under a simplified procedure. | FR | CNIL | GDPR | €6,000 | ↗ |
| 29 Dec 2025 | Ordinul Asistenților Medicali Generaliști, Moașelor și Asistenților Medicali din România – Filiala NeamțANSPDCP imposed a fine on the Neamț branch of the Romanian Order of General Nurses, Midwives, and Nurses for GDPR violations. The case concerned non-compliance with personal data protection requirements. | RO | ANSPDCP | GDPR | €2,000 | ↗ |
| 29 Dec 2025 | SOCIETE EDITANT UNE APPLICATION MOBILECNIL imposed an administrative fine of EUR 270,000 on SOCIETE EDITANT UNE APPLICATION MOBILE. The case concerns a breach of personal data protection rules and should be considered in compliance assessments. | FR | CNIL | GDPR | €270,000 | ↗ |
| 29 Dec 2025 | SOCIETE EXERCANT UNE ACTIVITE D'EDITION DE JOURNAUX (procédure simplifiée)The CNIL imposed an administrative fine of EUR 7,000 on SOCIETE EXERCANT UNE ACTIVITE D'EDITION DE JOURNAUX and issued an injunction. The case concerns a breach of rules supervised by the CNIL. | FR | CNIL | GDPR | €7,000 | ↗ |
| 22 Dec 2025 | NEXPUBLICA FRANCECNIL imposed a fine of 1,700,000 EUR on NEXPUBLICA FRANCE on 2025-12-22. The decision concerns serious security failures under Article 32 GDPR in the PCRM software used by public social action bodies, which processed sensitive personal data. | FR | CNIL | GDPR | €1,700,000 | ↗ |
| 22 Dec 2025 | Dane anonimowe (Pana K. S. prowadzącego działalność gospodarczą pod firmą B.)The President of UODO imposed an administrative fine of PLN 12,964 on Mr. K. S., operating a business under the name B. The sanction was issued for failing to provide access to all personal data and information necessary for the authority to perform its duties. | PL | UODO | GDPR | €3,077 | ↗ |
| 22 Dec 2025 | SOCIETE EXERCANT UNE ACTIVITE DE CONSEIL EN SYSTEMES ET LOGICIELS INFORMATIQUESCNIL imposed an administrative fine of 1,700,000 EUR on SOCIETE EXERCANT UNE ACTIVITE DE CONSEIL EN SYSTEMES ET LOGICIELS INFORMATIQUES. The decision concerns a breach of rules supervised by the French data protection authority. | FR | CNIL | GDPR | €1,700,000 | ↗ |