Order report
BULLETIN №084Last updated · 12 Aug 2026

Fine Tracker.

A public register of regulatory fines issued under EU compliance directives. Updated as decisions are published by national supervisory authorities.

5,273 entries

Total fines
€8.6bn
Decisions
5,273
Jurisdictions
33
Regulators
74
Avg monthly
€162.5m
YoY volume
-23.7%
Country
Type
Date range
ImposedCompanyCountryAuthorityTypeAmount↗
20 Feb 2025NAROBESA INV, S.L.NAROBESA INV, S.L. was fined EUR 2,000 by the AEPD for failing to provide the required documentation to the data protection authority. The case concerns a breach of the cooperation duty under Article 58(1) GDPR.ESAEPDGDPR€2,000↗
20 Feb 2025SIA “DAILENS”SIA “DAILENS” was fined EUR 500 by the DVI. The decision is final and has entered into force.LVDVIGDPR€500↗
20 Feb 2025BLUE TEAM FLIGHT SCHOOL, S.L.BLUE TEAM FLIGHT SCHOOL, S.L. was fined 6,000 EUR by the AEPD. The authority found that the company failed to provide access to personal data and information requested by the data protection authority, in breach of Article 58.1 of the GDPR.ESAEPDGDPR€6,000↗
21 Feb 2025Österreichische Post AGThe Austrian Federal Administrative Court upheld a major GDPR fine against Österreichische Post AG for unlawful processing of political affinity data and other personal data used in direct marketing. The court reduced the penalty from EUR 18 million to EUR 16 million, while confirming the underlying data protection breaches.ATÖsterreichische DatenschutzbehördeGDPR€16,000,000↗
24 Feb 2025SCHOOL FITNESS HOLIDAY & FRANCHISING, S.L.SCHOOL FITNESS HOLIDAY & FRANCHISING, S.L. was fined by the AEPD 15,000 EUR for recording gym sessions without informing participants or obtaining their consent. The authority found this to be a breach of GDPR rules on consent and personal data processing.ESAEPDGDPR€15,000↗
24 Feb 2025UNICAJA BANCO, S.A.U.UNICAJA BANCO, S.A.U. was fined by the AEPD EUR 3,500,000 for inadequate security measures in its video surveillance system. The authority found a breach of data protection requirements.ESAEPDGDPR€3,500,000↗
24 Feb 20254USPORT INSTALACIONES DEPORTIVAS, S.L.4USPORT INSTALACIONES DEPORTIVAS, S.L. was fined by the AEPD in the amount of 600 EUR for failing to provide access. The case concerned Article 58(1) of the GDPR and indicates a failure to cooperate with the supervisory authority.ESAEPDGDPR€600↗
25 Feb 2025SERVICIOS ESPECIALES, S.A.SERVICIOS ESPECIALES, S.A. was fined by the AEPD 200,000 EUR for disclosing the identity of a complainant in a workplace harassment case. The authority found a breach of personal data confidentiality principles.ESAEPDGDPR€200,000↗
26 Feb 2025SportadminIMY fined Sportadmin SEK 6 million after an IT attack exposed personal data of more than 2.1 million individuals, mostly children. The authority found that the company had not maintained an appropriate security level for the personal data it processed.SEIntegritetsskyddsmyndighetenGDPR€538,000↗
27 Feb 2025Comune di SciaccaThe Garante fined Comune di Sciacca EUR 2,500 for violations related to the processing of personal data. The case concerned the communication of data to third parties without a proper legal basis.ITGaranteGDPR€2,500↗
27 Feb 2025RED ESPAÑOLA DE IDENTIFICACIÓN DE ANIMALES DE COMPAÑÍAREIAC was fined EUR 600 by the AEPD for failing to provide the required information to the data protection authority. The case concerns Article 58(1) GDPR and reflects a failure to cooperate with the supervisory authority.ESAEPDGDPR€600↗
27 Feb 2025Velvet Medical SRLThe National Supervisory Authority for Personal Data Processing completed an investigation in February into Velvet Medical SRL. It found a GDPR violation and imposed a fine of 1,000 EUR.ROANSPDCPGDPR€1,000↗
27 Feb 2025Istarski vodovod d.o.o.Istarski vodovod d.o.o. was fined by AZOP EUR 25,000 for failing to implement adequate technical security measures. The deficiencies included the absence of two-factor authentication and monitoring systems, which led to unauthorized access and a data breach.HRAZOPGDPR€25,000↗
27 Feb 2025Energia Pulita S.r.l.Energia Pulita S.r.l. was fined EUR 300,000 by the Garante for making unsolicited marketing calls without a valid legal basis. The authority found a breach of GDPR Article 5.ITGaranteGDPR€300,000↗
27 Feb 2025Ministero dell’Interno-Dipartimento per gli affari interni e territorialiThe Ministry of the Interior was fined EUR 3,000 for processing personal data through the CIE-Agenda Online service. The authority found that the processing did not comply with the principles of lawfulness, fairness, transparency, and purpose limitation.ITGaranteGDPR€3,000↗
28 Feb 2025DYNAMIC EXPRESS COURIER S.LDYNAMIC EXPRESS COURIER S.L was fined 15,000 EUR by the AEPD for subcontracting without prior authorization and for failing to put proper contracts in place with subcontractors. The authority found this conduct breached GDPR Article 28 on processor arrangements.ESAEPDGDPR€15,000↗
01 Mar 2025Tensa Art Design S.A.The Romanian data protection authority investigated Tensa Art Design S.A., operator of lensa.ro, in March 2025. It found GDPR violations involving direct marketing without valid consent and improper handling of data subject access and erasure requests. Two fines totaling 15,000 EUR were imposed.ROANSPDCPGDPR€10,000↗
03 Mar 2025BEKO ROMÂNIA SAIn February 2025, ANSPDCP completed an investigation at BEKO ROMÂNIA SA and found violations of GDPR provisions. As a result, the controller was fined EUR 10,000.ROANSPDCPGDPR€10,000↗
04 Mar 2025WEBRASOFT SRLIn January 2025, the National Supervisory Authority for Personal Data Processing completed an investigation into WEBRASOFT SRL and found a breach of GDPR provisions. As a result, the operator was fined EUR 20,000.ROANSPDCPGDPR€20,000↗
06 Mar 2025SIA "VSV ZOO"The DVI imposed a fine of 500 EUR on SIA "VSV ZOO". The decision has entered into force.LVDVIGDPR€500↗