Order report
BULLETIN №083Last updated · 11 Aug 2026

Fine Tracker.

A public register of regulatory fines issued under EU compliance directives. Updated as decisions are published by national supervisory authorities.

5,273 entries

Total fines
€8.6bn
Decisions
5,273
Jurisdictions
33
Regulators
74
Avg monthly
€162.5m
YoY volume
-23.1%
Country
Type
Date range
ImposedCompanyCountryAuthorityTypeAmount↗
07 Apr 2026Dane anonimowe (Wspólnotę Mieszkaniową K.)The UODO imposed an administrative fine on K. Housing Community for failing to report a personal data breach without undue delay, and no later than 72 hours after becoming aware of it. The case concerns the obligation to notify the President of the UODO within the statutory deadline.PLUODOGDPR€1,135↗
06 Jul 2022Uniwersyteckie CentrumThe Polish DPA (UODO) imposed an administrative fine of PLN 10,000 on Uniwersyteckie Centrum Kliniczne Uniwersytetu Medycznego. The authority found that the entity failed to report the personal data breach without undue delay and did not notify the affected individuals without undue delay.PLUODOGDPR€2,096↗
15 Nov 2025Państwowego Powiatowego Inspektora Sanitarnego w M., ul.UODO imposed a PLN 20,000 administrative fine on the State District Sanitary Inspector in M. The authority found that appropriate technical and organizational measures based on a risk assessment were not implemented, and that the effectiveness of safeguards for data processed on external media was not regularly tested. The case concerned a breach of the integrity and confidentiality principle.PLUODOGDPR€4,725↗
16 May 2023Dane anonimowe (Burmistrza Miasta Z.)UODO imposed an administrative fine of PLN 30,000 on the Mayor of City Z. and ordered the processing operations to be brought into compliance with the GDPR. The authority required appropriate technical and organizational measures, including regular testing, measuring, and evaluating their effectiveness to ensure processing security.PLUODOGDPR€6,687↗
18 Dec 2024Toyota Bank Polska S.A.The Polish supervisory authority imposed an administrative fine of EUR 132,000 on Toyota Bank Polska S.A. on 18 December 2024. The penalty concerned breaches of GDPR Articles 30, 35, and 38, including DPO independence, profiling documentation, and DPIA obligations.PLPresident of the Personal Data Protection Office (UODO)GDPR€132,000↗
10 Oct 2024Dane anonimowe (X w K.)The UODO imposed an administrative fine of PLN 15,000 on the entity identified as Anonymous data (X in K.). The authority found breaches of data protection principles, including integrity and confidentiality, accountability, data protection by design, processor obligations, and security measures.PLUODOGDPR€3,485↗
10 Sept 2019Dane anonimowe (V. Sp. z o.o. z siedzibą w S. przy ul.)UODO found that V. Sp. z o.o. breached rules on the security and confidentiality of processed personal data. A fine of PLN 2,830,410 was imposed.PLUODOGDPR€653,000↗
15 Mar 2019Dane anonimowe (X. Sp. z o.o., za naruszenie stwierdzone w niniejszej decyzji,)UODO found that X. Sp. z o.o. failed to comply with its information obligation. The decision ordered remediation of the breach and imposed a fine of PLN 943,470.PLUODOGDPR€219,000↗
02 Jan 2026Dane anonimowe (Spółkę)UODO imposed an administrative fine of PLN 978,128 on the company. The authority found that the controller did not ensure the independence of the Data Protection Officer and failed to prevent a conflict of interest arising from the DPO’s other tasks and duties.PLUODOGDPR€232,000↗
14 Apr 2025niegoAn administrative fine of 25,255 PLN was imposed for failure to comply with an order contained in an administrative decision of the President of UODO. The case concerns non-fulfilment of an obligation imposed by the supervisory authority.PLUODOGDPR€5,893↗
22 Apr 2021DKN.5130.3114.2020StatusnieprawomocnaTytuUODO imposed an administrative fine of PLN 1,136,975. The authority found that the entity failed to implement appropriate technical and organizational measures to secure personal data processed in cooperation with a courier service provider.PLUODOGDPR€249,000↗
17 Jan 2025Dane anonimowe (X. z siedzibą w K.)The UODO imposed administrative fines on X. based in K. for breaches of Article 6(1), Article 9(1), Article 13(1) and (2), Article 25(1), and Article 32(1) and (2) of the GDPR. These breaches also resulted in violations of the principles in Article 5(1)(a) and (f) and Article 5(2) of the GDPR.PLUODOGDPR€161,000↗
04 Apr 2025Unnamed bankThe Polish data protection authority imposed a fine of EUR 928,498.06 on a bank. The authority found that the bank failed to inform customers about a personal data breach. The case concerns post-incident notification obligations.PLPolish Data Protection AuthorityGDPR€928,000↗
29 May 2020Dane anonimowe (R. Sp. z o.o. z siedzibą w D. przy ul.)UODO imposed a fine of PLN 15,000 on R. Sp. z o.o. The sanction concerned the failure to provide information required by the authority.PLUODOGDPR€3,371↗
27 Apr 2021Dane anonimowe (K. Spółkę Akcyjną z siedzibą w N. przy ul.)The President of UODO imposed an administrative fine of PLN 22,739 on the company. The sanction resulted from failure to cooperate with the supervisory authority and from not providing information necessary to resolve the case.PLUODOGDPR€4,982↗
14 Jan 2026ZalandoUOKiK imposed a fine on Zalando for misleading consumers by improperly presenting promotional prices and hiding the required lowest price from the previous 30 days. According to the report, the combined sanctions against Zalando and Temu were about PLN 37 million, with Zalando accounting for PLN 31,488,674.PLUrząd Ochrony Konkurencji i KonsumentówOther€7,465,000↗
08 Feb 2023DKN.5131.50.2021StatusprawomocnaTytuUODO imposed a PLN 33,012 fine on the controller and the processor for failing to implement appropriate technical and organizational measures to secure personal data. The authority also found that the controller did not verify whether the processor provided sufficient guarantees of GDPR compliance and protection of data subjects' rights.PLUODOGDPR€6,967↗
30 Jun 2021Dane anonimowe (Fundację)UODO imposed a PLN 13,644 administrative fine on the Foundation for failing to report a personal data breach without undue delay. The Foundation also did not notify the affected individuals about the incident, breaching controller obligations.PLUODOGDPR€3,018↗
13 Jul 2021Dane anonimowe (Prezesa Sądu Rejonowego w M. za naruszenie art. 5 ust. 1 lit. f), art. 25 ust. 1, art. 32 ust. 1 lit. b) i d) oraz art. 32 ust. 2 rozporządzenia 2016/679)UODO imposed a fine of PLN 10,000 on the President of the District Court for failing to implement appropriate technical and organizational measures. The authority found that the security level did not match the risk associated with processing data using portable external storage devices.PLUODOGDPR€2,189↗
21 Jun 2023Dane anonimowe (H. Sp. z o.o. z siedzibą w W. przy Al.)UODO imposed a PLN 33,012 fine on H. Sp. z o.o. The penalty was issued because the company failed to provide the President of the Personal Data Protection Office with access to information necessary to perform supervisory duties.PLUODOGDPR€7,447↗