Order report
BULLETIN №084Last updated · 12 Aug 2026

Fine Tracker.

A public register of regulatory fines issued under EU compliance directives. Updated as decisions are published by national supervisory authorities.

5,273 entries

Total fines
€8.6bn
Decisions
5,273
Jurisdictions
33
Regulators
74
Avg monthly
€162.5m
YoY volume
-23.7%
Country
Type
Date range
ImposedCompanyCountryAuthorityTypeAmount↗
11 Apr 2025NEW GAMBLING SOLUTIONS S.R.L.In March 2025, ANSPDCP completed an investigation into NEW GAMBLING SOLUTIONS S.R.L. and found a GDPR violation. The company was fined EUR 2,000.ROANSPDCPGDPR€2,000↗
11 Apr 2025AIRE NETWORKS DEL MEDITERRÁNEO, S.L.The AEPD fined AIRE NETWORKS DEL MEDITERRÁNEO, S.L. 100,000 EUR for a data security incident. A SIM card duplication enabled unauthorized bank transactions, indicating insufficient safeguards and access controls.ESAEPDGDPR€100,000↗
14 Apr 2025Office Nova Concept SRLThe National Supervisory Authority for Personal Data Processing imposed a fine on Office Nova Concept SRL for breaching Article 17 of the GDPR. The case concerned non-compliance with obligations related to the right to erasure.ROANSPDCPGDPR€1,000↗
14 Apr 2025niegoAn administrative fine of 25,255 PLN was imposed for failure to comply with an order contained in an administrative decision of the President of UODO. The case concerns non-fulfilment of an obligation imposed by the supervisory authority.PLUODOGDPR€5,893↗
14 Apr 2025DPP Law LtdThe UK Information Commissioner fined law firm DPP Law Ltd 60,000 GBP for breaches of Articles 5(1)(f), 32(1), 32(2) and 33(1) of the UK GDPR. The infringements occurred between 25 May 2018 and 17 July 2022. The case concerned inadequate security measures and incident reporting obligations.GBICOGDPR€69,456↗
15 Apr 2025United Business Solutions SRLANSPDCP completed an investigation at United Business Solutions SRL and found a violation of GDPR provisions. As a result, a fine of EUR 2,000 was imposed.ROANSPDCPGDPR€2,000↗
15 Apr 2025LVMH IBERIA, S.L.LVMH IBERIA, S.L. was fined by the AEPD 70,000 EUR for adding an employee’s personal phone number to a WhatsApp group without consent. The authority treated this as a breach of data protection rules.ESAEPDGDPR€70,000↗
15 Apr 2025COLPER BUSINESS 2020 S.L.COLPER BUSINESS 2020 S.L. was fined by the AEPD EUR 20,000 for failing to provide access to personal data and the information requested by the data protection authority. The conduct was found to breach Article 58(1) of the GDPR.ESAEPDGDPR€20,000↗
16 Apr 2025SERVICIOS INMOBILIARIOS Y GESTIÓN RCL-MADRID, S.L.SERVICIOS INMOBILIARIOS Y GESTIÓN RCL-MADRID, S.L. was fined 600 EUR by the AEPD. The authority found that the company did not provide access to personal data and other information requested during the investigation. The conduct breached Article 58(1) of the GDPR.ESAEPDGDPR€600↗
16 Apr 2025COMUNIDAD DE PROPIETARIOS ***COMUNIDAD.1The community of property owners was fined by the AEPD for publishing personal data on a notice board. The authority found a breach of the confidentiality principle under GDPR.ESAEPDGDPR€1,000↗
16 Apr 2025CAIXABANK, S.A.CAIXABANK, S.A. was fined by the AEPD EUR 500,000 for failing to implement measures to ensure data integrity and confidentiality. The breach resulted in unauthorized access to personal data, indicating insufficient technical or organizational safeguards.ESAEPDGDPR€500,000↗
16 Apr 202520 MINUTOS EDITORA, S.L.20 MINUTOS EDITORA, S.L. was fined by the AEPD for the unauthorized dissemination of a video containing personal data. The authority found a breach of the data minimization principle under Article 5(1)(c) GDPR.ESAEPDGDPR€30,000↗
23 Apr 2025MetaThe European Commission fined Meta EUR 200 million for breaching the Digital Markets Act. The sanction concerns Meta’s “consent or pay” model used for Facebook and Instagram users in Europe.IEEuropean CommissionDMA€200,000,000↗
23 Apr 2025Diskriminerings­ombudsmannen (DO)The Swedish Authority for Privacy Protection (IMY) fined the Equality Ombudsman (DO) 100,000 SEK. IMY found that DO failed to implement appropriate technical and organizational measures to ensure an adequate level of security for personal data collected via a web form.SEIMYGDPR€9,141↗
24 Apr 2025Darian Bishop trading as ECO4UBetween 9 January 2023 and 9 October 2023, 194,110 unsolicited direct marketing calls were made to subscribers registered with the TPS who had not indicated consent to receive such calls. The conduct generated 21 complaints to the Commissioner and the TPS, leading to an ICO fine.GBICOGDPR€58,480↗
24 Apr 2025Dante International SAIn April 2025, ANSPDCP completed an investigation into Dante International SA and found violations of GDPR provisions. As a result, a fine of 10,000 EUR was imposed.ROANSPDCPGDPR€10,000↗
25 Apr 2025SC Travel Planner SRLSC Travel Planner SRL was fined EUR 5,000 by ANSPDCP for breaching Article 15 of the GDPR. The case concerned the improper handling of a data subject access request.ROANSPDCPGDPR€5,000↗
25 Apr 2025SC Travel Planner SRLSC Travel Planner SRL was fined EUR 1,000 by ANSPDCP for breaching Article 33 of the GDPR. The case concerned failure to notify a personal data breach to the supervisory authority.ROANSPDCPGDPR€1,000↗
28 Apr 2025Xiting ROM SRLIn April 2025, ANSPDCP completed an investigation at Xiting ROM SRL and found violations of GDPR provisions. As a result, a fine of EUR 1,000 was imposed.ROANSPDCPGDPR€1,000↗
29 Apr 2025Comune di San Francesco al CampoThe Garante imposed a fine of 1,200 EUR on Comune di San Francesco al Campo for violations related to the publication of personal data on its institutional website. The data were subsequently removed.ITGaranteGDPR€1,200↗