BULLETIN №083Last updated · 11 Aug 2026
Fine Tracker.
A public register of regulatory fines issued under EU compliance directives. Updated as decisions are published by national supervisory authorities.
5,273 entries
- Total fines
- €8.6bn
- Decisions
- 5,273
- Jurisdictions
- 33
- Regulators
- 74
- Avg monthly
- €162.5m
- YoY volume
- -23.1%
| Imposed | Company | Country | Authority | Type | Amount | ↗ |
|---|---|---|---|---|---|---|
| 18 Jan 2024 | Dane anonimowe (przez Pana B.W. prowadzącego działalność gospodarczą pod firmą: B.)UODO imposed an administrative fine on B. for failing to notify the supervisory authority of a personal data breach without undue delay. The authority also found that the affected individuals were not informed of the breach without undue delay. | PL | UODO | GDPR | €2,251 | ↗ |
| 18 Aug 2022 | niegoThe Polish DPA (UODO) imposed an administrative fine of PLN 4,569 on an individual. The authority found a failure to cooperate with the President of UODO and a failure to provide access to information necessary for the performance of its duties. | PL | UODO | GDPR | €967 | ↗ |
| 09 Mar 2020 | Dane anonimowe (V. Sp. z o.o. w likwidacji z siedzibą w Z. przy ul.)The President of UODO imposed a PLN 20,000 fine on V. Sp. z o.o. in liquidation for failing to provide access to personal data, other information, and premises. This prevented the authority from carrying out inspection activities necessary for its duties. | PL | UODO | GDPR | €4,637 | ↗ |
| 20 Aug 2024 | Dane anonimowe (X. S.A.)The UODO imposed an administrative fine of PLN 4,053,173 on X. S.A. for breaching Article 34(1) and (2) of the GDPR. The case concerned failure to meet the obligations to notify affected individuals about a personal data breach. | PL | UODO | GDPR | €950,000 | ↗ |
| 21 Dec 2023 | Dane anonimowe (K. sp. z o.o. sp. k. z siedzibą w W. przy ul.)The President of UODO imposed a fine of PLN 18,864 on the company for failing to cooperate in the performance of the authority’s duties. The company also did not provide access to personal data and information necessary for the regulator’s tasks. | PL | UODO | GDPR | €4,346 | ↗ |
| 20 Dec 2023 | Ministra ZdrowiaThe President of the Personal Data Protection Office imposed an administrative fine of 100,000 PLN on Ministra Zdrowia. The authority found unlawful processing of personal data, including special-category data without a legal basis, and a failure to implement technical and organizational measures appropriate to the processing risk. The affected individual was also not provided with the information required under Article 33(3)(c) and (d) of the GDPR. | PL | UODO | GDPR | €23,035 | ↗ |
| 09 Dec 2020 | Dane anonimowe (Z. Sp. z o.o. z siedzibą w U. przy ul.)The President of the Personal Data Protection Office (UODO) imposed a fine of PLN 12,838.2 on Z. Sp. z o.o. The sanction was issued for failing to cooperate with the authority and for not providing access to personal data and other information necessary for the performance of its duties. | PL | UODO | GDPR | €2,902 | ↗ |
| 23 Jul 2025 | ING Bank Śląski SAThe Polish supervisory authority imposed an administrative fine on ING Bank Śląski SA for scanning the identity documents of customers and prospective customers without properly assessing whether this was necessary under AML rules. The decision became final on 23 July 2025 and concerns breaches of Articles 5(1)(a), (b) and (c) and 6(1) of the GDPR. | PL | President of the Personal Data Protection Office | GDPR | €4,375,000 | ↗ |
| 23 Jul 2025 | Dane anonimowe (K.)UODO imposed an administrative fine of PLN 18,416,400 for processing personal data without a lawful basis. The case concerned copying and scanning customers’ identity documents without properly verifying whether this was justified by AML obligations. | PL | UODO | GDPR | €4,328,000 | ↗ |
| 24 Aug 2020 | Głównego Geodetę KrajuUODO imposed a fine of PLN 100,000 on the Chief Surveyor of Poland. The authority found a breach of the lawfulness principle in personal data processing due to the intentional disclosure, without a legal basis, of land and mortgage register numbers obtained from the land and building records. | PL | UODO | GDPR | €22,735 | ↗ |
| 05 Oct 2022 | Dane anonimowe (D. sp. z o.o. sp. k. z siedzibą w P. przy ul.)The President of UODO imposed a fine of PLN 9,139 on the company. The sanction was issued because the company failed to comply with an order contained in an administrative decision of the data protection authority. | PL | UODO | GDPR | €1,907 | ↗ |
| 19 Jan 2022 | Dane anonimowe (U.)UODO imposed an administrative fine of 545,748 PLN on Dane anonimowe (U.) for failing to notify data subjects without undue delay about a personal data breach. The case concerns the obligation to promptly inform affected individuals under data protection rules. | PL | UODO | GDPR | €120,000 | ↗ |
| 30 Nov 2023 | Dane anonimowe (V. S.A. z siedzibą w P. ul.)UODO imposed an administrative fine of PLN 282,960 on the controller for failing to report a personal data breach to the supervisory authority. The authority also found that the affected data subject was not notified of the breach. | PL | UODO | GDPR | €65,064 | ↗ |
| 12 Mar 2024 | DKN.5131.28.2023StatusprawomocnaTytuUODO imposed an administrative fine of PLN 78,575.4 for failing to report a personal data breach without undue delay. The incident was not notified to the supervisory authority within 72 hours of becoming aware of the breach. | PL | UODO | GDPR | €18,331 | ↗ |
| 04 Jul 2025 | Niepubliczny Zakład Opieki ZdrowotnejUODO imposed a PLN 32,832 administrative fine on Niepubliczny Zakład Opieki Zdrowotnej for failing to conduct a risk analysis for processing patient data during home visits. The authority also found that appropriate technical and organizational measures to secure the data had not been implemented. | PL | UODO | GDPR | €7,733 | ↗ |
| 03 Nov 2022 | DKN.5131.18.2022StatusnieprawomocnaTytuUODO imposed an administrative fine of PLN 250,000 on the company. The authority found that the company failed to notify the supervisory authority within 24 hours of detecting the personal data breach and did not promptly inform the affected data subject. | PL | UODO | GDPR | €53,090 | ↗ |
| 02 Nov 2022 | Dane anonimowe (Wójta Gminy U. za naruszenie przepisów art. 5 ust. 1 lit. f), art. 5 ust. 2, art. 25 ust. 1 oraz art. 32 ust. 1 i 2 rozporządzenia 2016/679)The Polish DPA (UODO) imposed an administrative fine of PLN 8,000 on the Mayor of U. Commune. The authority found that personal data were processed without adequate security, in breach of Articles 5, 25 and 32 of the GDPR. | PL | UODO | GDPR | €1,701 | ↗ |
| 12 Mar 2024 | Dane anonimowe (U.)An administrative fine was imposed for failing to notify the supervisory authority of a personal data breach within the required 72 hours after detection. The authority also found that the affected individuals were not informed without undue delay. | PL | UODO | GDPR | €336,000 | ↗ |
| 27 Feb 2026 | T., za naruszenie art. 5 ust. 1 lit. f), art. 5 ust. 2 oraz art. 32 ust. 1 i 2 rozporządzenia 2016/679,The Polish DPA (UODO) imposed an administrative fine of PLN 975 on T. for failing to implement appropriate technical and organizational measures and for lacking a proper, accountable data protection policy tailored to its processing activities. The authority also noted deficiencies in transparency notices, processor agreements, access authorizations, and the record of processing activities. | PL | UODO | GDPR | €231 | ↗ |
| 30 Nov 2023 | SzkołęUODO imposed an administrative fine of PLN 35,000 on Szkołę. The authority found that the company had not implemented appropriate technical and organizational measures to secure personal data processed in the application. It also noted the absence of regular testing, measurement, and assessment of the effectiveness of those safeguards. | PL | UODO | GDPR | €8,048 | ↗ |