BULLETIN №081Last updated · 27 Jul 2026
Fine Tracker.
A public register of regulatory fines issued under EU compliance directives. Updated as decisions are published by national supervisory authorities.
5,273 entries
- Total fines
- €8.6bn
- Decisions
- 5,273
- Jurisdictions
- 33
- Regulators
- 74
- Avg monthly
- €162.7m
- YoY volume
- -20.7%
| Imposed | Company | Country | Authority | Type | Amount | ↗ |
|---|---|---|---|---|---|---|
| 01 Sept 2025 | SOCIETE DE VENTE EN LIGNE DE VETEMENTS, CHAUSSURES ET ACCESSOIRESSOCIETE DE VENTE EN LIGNE DE VETEMENTS, CHAUSSURES ET ACCESSOIRES was fined EUR 150,000,000 by CNIL. The case concerns a regulatory breach that resulted in an administrative sanction. | FR | CNIL | GDPR | €150,000,000 | ↗ |
| 01 Sept 2025 | Osnovna škola XAZOP imposed a fine of EUR 2,000 on Osnovna škola X for breaching GDPR rules on personal data processing. The case involved unlawful processing of personal data, indicating a compliance failure under data protection requirements. | HR | AZOP | GDPR | €2,000 | ↗ |
| 31 Aug 2025 | A.A.A.A.A.A. was fined by the AEPD EUR 3,000 for using surveillance cameras in a tourist accommodation without a valid legal basis and without informing the individuals concerned. The authority found a breach of Article 6 of the GDPR. | ES | AEPD | GDPR | €3,000 | ↗ |
| 31 Aug 2025 | RISING SUN CAR RENTAL S.L.RISING SUN CAR RENTAL S.L. was fined by the AEPD 6,000 EUR for using surveillance cameras that recorded images and sound without explicit consent or proper justification. The authority also found that the mandatory camera information signs were not displayed. | ES | AEPD | GDPR | €6,000 | ↗ |
| 31 Aug 2025 | DELAFRUIT, S.L.DELAFRUIT, S.L. was fined by the AEPD in the amount of 6,000 EUR for installing cameras in a break area without proper notice to affected individuals. The authority treated this as a breach of data protection rules. | ES | AEPD | GDPR | €6,000 | ↗ |
| 29 Aug 2025 | EXTRA MADRID, S.L.EXTRA MADRID, S.L. sent personalized postal advertising without the recipient’s consent. The AEPD found this to be a breach of Article 6 GDPR and imposed a fine of 1,000 EUR. | ES | AEPD | GDPR | €1,000 | ↗ |
| 29 Aug 2025 | FIATC MUTUA DE SEGUROS Y REASEGUROSFIATC Mutua de Seguros y Reaseguros was fined €40,000 by the AEPD after unauthorized access to its systems. The incident may have exposed personal data, including DNI/CIF, and the authority found inadequate security measures and a breach of Article 5(1)(f) GDPR. | ES | AEPD | GDPR | €40,000 | ↗ |
| 28 Aug 2025 | Home Improvement Marketing LtdHome Improvement Marketing Ltd was investigated by the ICO as part of a wider review of complaint trends in the energy and home improvements sector. After a search warrant and extensive investigation, the ICO found that between 31 May 2023 and 31 August 2023 the company initiated 2,449,380 automated marketing calls to subscribers without prior consent, contrary to PECR. The conduct generated 274 complaints to the TPS and ICO reporting tools. | GB | ICO | ePrivacy | €347,000 | ↗ |
| 28 Aug 2025 | Green Spark Energy LtdThe ICO investigated Green Spark Energy Ltd as part of a wider operation focused on complaint trends in the energy and home improvements sector. It found that between May 2023 and May 2024 the company initiated 9,587,050 automated recorded marketing calls in breach of regulation 19 of PECR, leading to 497 complaints. The recordings used misleading claims to pressure homeowners, and some recipients believed the calls were a scam. | GB | ICO | ePrivacy | €289,000 | ↗ |
| 27 Aug 2025 | INGPoland’s data protection authority, UODO, fined ING more than PLN 18 million. The authority found that the bank scanned identity documents in situations not required by AML rules, including for non-customers and in cases unrelated to service provision. | PL | Urząd Ochrony Danych Osobowych | GDPR | €4,215,000 | ↗ |
| 25 Aug 2025 | ASSOCIATION DE DEFENSE DE DROITS FONDAMENTAUX (procédure simplifiée)The CNIL imposed an administrative fine of EUR 10,000 on ASSOCIATION DE DEFENSE DE DROITS FONDAMENTAUX and issued an injunction. The case was handled under a simplified procedure. | FR | CNIL | GDPR | €10,000 | ↗ |
| 21 Aug 2025 | Anonymisiert (DSB 2025-0.625.944)Dr. Martha N. unlawfully accessed the electronic health records of a former assistant without a legitimate purpose. The authority found this to be a breach of GDPR principles governing personal data processing. | AT | DSB | GDPR | €1,000 | ↗ |
| 20 Aug 2025 | MOBILITY EVOLUTION S.A.MOBILITY EVOLUTION S.A. was fined EUR 15,000 by the AEPD for failing to properly process data deletion requests submitted through its application. The authority found that the company’s handling of these requests breached Article 25 GDPR on data protection by design and by default. | ES | AEPD | GDPR | €15,000 | ↗ |
| 18 Aug 2025 | SC Elite Conta SRLThe National Supervisory Authority for Personal Data Processing completed an investigation in July 2025 at SC Elite Conta SRL and found a GDPR violation. The company was fined for failing to properly notify a personal data security breach. | RO | ANSPDCP | GDPR | €3,000 | ↗ |
| 14 Aug 2025 | ALIQUAM SOFTWARE DEVELOPMENT, S.R.L.UALIQUAM SOFTWARE DEVELOPMENT, S.R.L.U was fined by the AEPD 1,400 EUR for sending unsolicited marketing emails despite requests to stop. The case concerns a breach of the LSSI rules on commercial communications. | ES | AEPD | ePrivacy | €1,400 | ↗ |
| 13 Aug 2025 | TELECONTACT LIST S.L.TELECONTACT LIST S.L. was fined by the AEPD €1,000 for failing to respond to a data subject’s requests to exercise the rights of access and erasure. The authority found a breach of GDPR obligations, including Article 17. | ES | AEPD | GDPR | €1,000 | ↗ |
| 13 Aug 2025 | Anonimizirano (IP-RS 0609-97/2024/2)A sole proprietor was fined for failing to respond to a request from the Information Commissioner within the specified 10-day period. The authority treated this as a breach of Article 31 GDPR. | SI | IP-RS | GDPR | €500 | ↗ |
| 12 Aug 2025 | Asociația Casa de Ajutor Reciproc „FLEXICREDIT”In June 2025, ANSPDCP completed an investigation at Asociația Casa de Ajutor Reciproc „FLEXICREDIT” and found violations of GDPR provisions. The entity was fined EUR 3,000. | RO | ANSPDCP | GDPR | €3,000 | ↗ |
| 11 Aug 2025 | APARELLS ORTOPEDICS CURTO, S.L.APARELLS ORTOPEDICS CURTO, S.L. did not provide complete personal data and medical records in response to an access request. The AEPD found this to be a breach of data protection rules and imposed a fine of 10,000 EUR. | ES | AEPD | GDPR | €10,000 | ↗ |
| 11 Aug 2025 | FUNDACIÓN PARA EL DESARROLLO DE LA ENFERMERÍA y SINDICATO DE ENFERMERÍA, SATSESATSE and FUDEN were fined by the AEPD EUR 15,000 after a ransomware incident affected personal data. The authority also found that the parties had not properly formalized a joint controllership agreement under the GDPR. | ES | AEPD | GDPR | €15,000 | ↗ |