BULLETIN №084Last updated · 13 Aug 2026
Fine Tracker.
A public register of regulatory fines issued under EU compliance directives. Updated as decisions are published by national supervisory authorities.
5,273 entries
- Total fines
- €8.6bn
- Decisions
- 5,273
- Jurisdictions
- 33
- Regulators
- 74
- Avg monthly
- €162.5m
- YoY volume
- -24%
| Imposed | Company | Country | Authority | Type | Amount | ↗ |
|---|---|---|---|---|---|---|
| 11 Sept 2025 | Università degli Studi di VeronaUniversità degli Studi di Verona was fined by the Garante €9,000 for improperly handling personal data during a research project. The authority found a breach of GDPR requirements for lawful, fair, and transparent processing. | IT | Garante | GDPR | €9,000 | ↗ |
| 11 Sept 2025 | G.Villa S.r.l.G.Villa S.r.l. was fined by the Garante EUR 22,500 for sending unsolicited promotional emails to an address not disclosed for marketing purposes. The company also failed to respond to the data subject's request for access to and deletion of personal data. | IT | Garante | GDPR | €22,500 | ↗ |
| 11 Sept 2025 | MEDECIN GENERALISTE (procédure simplifiée)CNIL imposed an administrative fine of 3,000 EUR on MEDECIN GENERALISTE and issued an injunction. The case was handled under a simplified procedure. | FR | CNIL | GDPR | €3,000 | ↗ |
| 11 Sept 2025 | Ente Parco Regionale Migliarino San Rossore MassaciuccoliEnte Parco Regionale Migliarino San Rossore Massaciuccoli was fined EUR 8,000 by the Garante for failing to implement adequate technical and organizational measures. The authority found that more personal data was processed than necessary, in breach of the GDPR and national data protection rules. | IT | Garante | GDPR | €8,000 | ↗ |
| 11 Sept 2025 | Provvedimento dell'11 settembre 2025 [10184654]The decision imposes a fine on a healthcare company for cybersecurity-related breaches following a security incident involving patient data. The authority found non-compliance with Articles 25 and 32 GDPR. | IT | Garante | GDPR | €8,000 | ↗ |
| 11 Sept 2025 | THE OBJECTIVE MEDIA, S.L.THE OBJECTIVE MEDIA, S.L. published an individual's personal data on its website without consent. The AEPD found this to be a breach of data protection principles and imposed a 20,000 EUR fine. | ES | AEPD | GDPR | €20,000 | ↗ |
| 11 Sept 2025 | ATRESMEDIA CORPORACIÓN DE MEDIOS DE COMUNICACIÓN, S.A.ATRESMEDIA was fined by the AEPD for disclosing personal data, including a handwritten signature, in a news broadcast without necessity. The authority found that the disclosure breached data protection principles because it was not proportionate to the purpose of the publication. | ES | AEPD | GDPR | €10,000 | ↗ |
| 11 Sept 2025 | Casa di Cura Città di RomaCasa di Cura Città di Roma was fined EUR 12,000 by the Garante for allowing unauthorized access to patient medical records. The case concerns a breach of data protection rules and indicates a need for stronger access controls. | IT | Garante | GDPR | €12,000 | ↗ |
| 11 Sept 2025 | Giada FM S.r.l.Giada FM S.r.l. was fined EUR 1,000 by the Garante for failing to respond to an employee’s request to access personal data. The request covered training certificates and medical visit documentation, which is a breach of the GDPR access rights. | IT | Garante | GDPR | €1,000 | ↗ |
| 11 Sept 2025 | Comune di NichelinoComune di Nichelino was fined EUR 18,000 by the Garante for failing to provide an adequate response to a data subject's request to exercise their rights. The authority found breaches of lawfulness, fairness, transparency, and data minimization. | IT | Garante | GDPR | €18,000 | ↗ |
| 11 Sept 2025 | Comune di BuccinoComune di Buccino was fined by the Garante EUR 6,000 for breaching data protection principles, including lawfulness, fairness, transparency, and data minimization. The case involved improper handling of personal data. | IT | Garante | GDPR | €6,000 | ↗ |
| 11 Sept 2025 | Comune di VeronaThe Comune di Verona was fined for improperly sharing personal data of TARI taxpayers with a third party for engagement communications. The authority found a breach of the principles of lawfulness, fairness, and transparency. | IT | Garante | GDPR | €6,000 | ↗ |
| 11 Sept 2025 | COMMUNE (procédure simplifiée)CNIL imposed an administrative fine of EUR 10,000 on COMMUNE under a simplified procedure and issued a warning. The case concerns a breach of rules requiring supervisory intervention. | FR | CNIL | GDPR | €10,000 | ↗ |
| 11 Sept 2025 | SOCIETE EXERCANT UNE ACTIVITE DE BANQUE ET ASSURANCE (procédure simplifiée)The CNIL imposed an administrative fine of EUR 10,000 on SOCIETE EXERCANT UNE ACTIVITE DE BANQUE ET ASSURANCE. The case was handled under a simplified procedure. | FR | CNIL | GDPR | €10,000 | ↗ |
| 11 Sept 2025 | ILVA A/SVestre Landsret upheld a DKK 1.5 million GDPR fine against ILVA A/S. The case concerned retention of data on about 385,000 customers without a deletion policy, and the fine was based on the group’s total turnover. | DK | Datatilsynet | GDPR | €200,000 | ↗ |
| 12 Sept 2025 | Dane anonimowe (Q. Sp. z o.o.)The Polish DPA (UODO) imposed an administrative fine of PLN 11,365 on Q. Sp. z o.o. The authority found a breach of Article 38(6) GDPR because the data protection officer role was performed by the company’s president. | PL | UODO | GDPR | €2,669 | ↗ |
| 12 Sept 2025 | A Düsseldorf-based personnel recruitment companyOn 2025-09-12, the LDI NRW announced a data protection fine of over 35,000 EUR against a Düsseldorf-based personnel recruitment company. The authority said the company repeatedly ignored job seekers’ requests for access and deletion and failed to respond to the supervisory authority’s inquiries. | DE | Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen | GDPR | €35,000 | ↗ |
| 16 Sept 2025 | Bharat Singh ChandBharat Singh Chand, a self-employed lead generator, sent or instigated the sending of 966,449 direct marketing SMS messages between 3 December 2023 and 3 July 2024. The activity breached regulations 22 and 23 of PECR and generated 19,138 complaints to the 7726 spam reporting service. He was fined £200,000 and issued with an enforcement notice. | GB | ICO | ePrivacy | €231,000 | ↗ |
| 18 Sept 2025 | SOCIETE EXPLOITANT UN GRAND MAGASINCNIL imposed an administrative fine of EUR 100,000 on SOCIETE EXPLOITANT UN GRAND MAGASIN. The case concerns a breach of rules supervised by CNIL. | FR | CNIL | GDPR | €100,000 | ↗ |
| 18 Sept 2025 | Dr.Max SRLIn August of the current year, ANSPDCP completed an investigation at Dr.Max SRL and found a breach of GDPR provisions. As a result, the operator was fined EUR 1,000. | RO | ANSPDCP | GDPR | €1,000 | ↗ |