Order report
BULLETIN №083Last updated · 10 Aug 2026

Fine Tracker.

A public register of regulatory fines issued under EU compliance directives. Updated as decisions are published by national supervisory authorities.

5,273 entries

Total fines
€8.6bn
Decisions
5,273
Jurisdictions
33
Regulators
74
Avg monthly
€162.5m
YoY volume
-23.1%
Country
Type
Date range
ImposedCompanyCountryAuthorityTypeAmount↗
21 Jul 2023Hozzáférési kérelem nemteljesítéseThe controller did not respond to the access request within the one-month deadline. It also failed to provide substantive information about the processing of personal data, in breach of GDPR Articles 12 and 15.HUNAIHGDPR€26,300↗
25 Jul 2023EDICIONES PERIÓDICAS DEL NOROESTE, S.L.The entity published a private video on Twitter without the data subject’s consent. The authority found a breach of data minimization because excessive data were processed beyond what was necessary for the intended purpose.ESAEPDGDPR€10,000↗
27 Jul 2023B.B.B.A neighbor installed a surveillance camera that captured images of the complainant’s property without authorization. The AEPD found this to be a breach of Article 5(1)(c) GDPR and imposed a fine of EUR 300.ESAEPDGDPR€300↗
27 Jul 2023B.B.B.B.B.B. was fined EUR 800 by the AEPD for installing a surveillance system that captured images and sounds from a neighbor’s property and potentially the public street. The authority found breaches of GDPR Articles 13 and 6(1), citing the lack of a valid legal basis and proper notice to affected individuals.ESAEPDGDPR€800↗
31 Jul 2023DOÑA B.B.B.The sanctioned individual created a WhatsApp group with 255 participants without prior consent. As a result, the names and phone numbers of the participants were disclosed, constituting a breach of personal data protection rules.ESAEPDGDPR€2,000↗
02 Aug 2023Adatbázisban tárolt személyes adatok kezelésének jogszerűségeThe entity was fined by NAIH HUF 1,500,000 for processing personal data without a legal basis. The authority also found that the entity failed to demonstrate compliance with data processing requirements and did not provide adequate information to data subjects.HUNAIHGDPR€3,870↗
03 Aug 2023Sdam s.r.l.Sdam s.r.l. was fined by the Italian data protection authority, Garante, in the amount of 5,000 EUR. The case concerned the sending of promotional emails without proper consent, which constitutes a GDPR violation.ITGaranteGDPR€5,000↗
03 Aug 2023Med Life SAMed Life SA was fined EUR 2,000 by ANSPDCP. The authority found that the company violated the complainant’s right of access by refusing to provide certain video recordings from the reception area of one of its hospitals.ROANSPDCPGDPR€2,000↗
07 Aug 2023FORMACIÓN Y EMPLEO DE EXTREMADURA, S.L.The company sent emails to multiple recipients without using BCC, allowing each recipient to see the other recipients’ email addresses. AEPD treated this as a breach of data protection rules and imposed an 8,000 EUR fine.ESAEPDGDPR€8,000↗
07 Aug 2023Anonymizováno (ÚOOÚ UOOU-00414.23-30)The decision confirms a fine for a healthcare entity for failing to notify data subjects and document a personal data breach after a cyberattack. The authority found breaches of GDPR transparency and notification obligations.CZUOOUGDPR€12,756↗
08 Aug 2023VODAFONE ESPAÑA, S.A.U.The AEPD fined VODAFONE ESPAÑA, S.A.U. 100,000 EUR for processing personal data without proper authorization. The case involved unsolicited marketing calls and messages sent to a complainant who had no commercial relationship with the company.ESAEPDGDPR€100,000↗
09 Aug 2023AUTOFER, S.L.AUTOFER, S.L. was fined EUR 10,000 by the AEPD for sending multiple unsolicited advertising SMS messages. The messages were sent despite the recipient’s prior request not to receive further communications, breaching Article 21 of the LSSI.ESAEPDePrivacy€10,000↗
18 Aug 2023Személyes adatok kezelése online közszolgáltatás nyújtása soránThe supervisory authority found that the controller did not provide adequate information about the data retention period. It also unlawfully refused access to the requested call recordings, breaching GDPR Articles 12, 13, and 15.HUNAIHGDPR€13,050↗
21 Aug 2023Uipath SRLUipath SRL was fined by ANSPDCP EUR 70,000 for violations related to cross-border data processing. The case concerned compliance issues in the transfer or handling of data across borders.ROANSPDCPGDPR€70,000↗
23 Aug 2023GAFAS EN RED DE ÓPTICAS, S.L.GAFAS EN RED DE ÓPTICAS, S.L. was fined by the AEPD 5,000 EUR for sending commercial emails to a complainant after they had opted out. The authority treated this as a breach of data protection rules.ESAEPDePrivacy€5,000↗
23 Aug 2023BODY LINE SRLIn July 2023, the Romanian authority ANSPDCP completed an investigation at BODY LINE SRL and found violations of GDPR provisions. The operator was fined 49,322 lei, equivalent to EUR 10,000.ROANSPDCPGDPR€10,000↗
24 Aug 2023Kamerás adatkezelés szálláshelyenThe entity was fined for failing to provide easily accessible and transparent information about data processing through a camera system. The authority found a breach of GDPR Articles 12 and 13.HUNAIHGDPR€2,600↗
25 Aug 2023This Is The Big Deal LimitedThis Is The Big Deal Limited sent or instigated 41,417,889 unsolicited direct marketing messages to individuals without consent, breaching regulation 22 of PECR. In addition, 102,132 text messages were sent without the required opt-out information under regulation 23 of PECR. The ICO imposed a fine of 30,000 GBP.GBICOePrivacy€35,028↗
28 Aug 2023Trygg-HansaTrygg-Hansa Försäkring filial was fined by IMY SEK 35,000,000 for failing to implement appropriate technical measures. This allowed unauthorized access to sensitive customer data, breaching GDPR Articles 5(1)(f) and 32(1).SEIMYGDPR€2,941,000↗
28 Aug 2023VOX ESPAÑAVOX ESPAÑA was fined by the AEPD EUR 1,000 for failing to properly sign its surveillance cameras and for capturing an excessive area of public space. The authority found breaches of GDPR data minimisation and transparency obligations.ESAEPDGDPR€1,000↗