BULLETIN №084Last updated · 13 Aug 2026
Fine Tracker.
A public register of regulatory fines issued under EU compliance directives. Updated as decisions are published by national supervisory authorities.
5,273 entries
- Total fines
- €8.6bn
- Decisions
- 5,273
- Jurisdictions
- 33
- Regulators
- 74
- Avg monthly
- €162.5m
- YoY volume
- -24%
| Imposed | Company | Country | Authority | Type | Amount | ↗ |
|---|---|---|---|---|---|---|
| 07 Nov 2025 | MAJOREL SP SOLUTIONS, S.A.MAJOREL SP SOLUTIONS, S.A. was fined by the AEPD 80,000 EUR for processing personal data without a lawful basis. The authority found a breach of Article 6(1)(b) GDPR. | ES | AEPD | GDPR | €80,000 | ↗ |
| 07 Nov 2025 | Klass Wagen S.R.L.Klass Wagen S.R.L. was fined by ANSPDCP EUR 7,000 for failing to promptly report a personal data breach. The incident involved unauthorized access to its contract management system after a former employee disclosed credentials, affecting personal data of many individuals, including data subjects from other EU member states. | RO | ANSPDCP | GDPR | €7,000 | ↗ |
| 10 Nov 2025 | Whitedecor SRLThe National Supervisory Authority for Personal Data Processing completed an investigation in October 2025 at Whitedecor SRL and found violations of GDPR provisions. As a result, a fine of 1,000 EUR was imposed. | RO | ANSPDCP | GDPR | €1,000 | ↗ |
| 12 Nov 2025 | Fan Courier Express S.R.L.Fan Courier Express S.R.L. was fined by ANSPDCP in the amount of €3,000 for processing personal data in breach of GDPR. The case concerned unlawful handling of personal data by the company. | RO | ANSPDCP | GDPR | €3,000 | ↗ |
| 12 Nov 2025 | Fan Courier Express S.R.L.Fan Courier Express S.R.L. was fined by ANSPDCP in the amount of €1,000 for processing personal data in violation of GDPR. The case concerned unlawful processing of personal data. | RO | ANSPDCP | GDPR | €1,000 | ↗ |
| 13 Nov 2025 | SOCIETE EXPLOITANT UN FONDS DE COMMERCE DE DISTRIBUTION A DOMINANTE ALIMENTAIRE (procédure simplifiée)The CNIL imposed an administrative fine of EUR 20,000 on the company. The case concerns a breach of rules under the data protection authority’s supervision. | FR | CNIL | GDPR | €20,000 | ↗ |
| 13 Nov 2025 | SOCIETE EXERCANT L'ACTIVITE DE "PORTAILS INTERNET" PERMETTANT D'ACCEDER AUX INFORMATIONS LEGALES ET FINANCIERES DES ENTREPRISES (procédure simplifiée)CNIL imposed an administrative fine of 5,000 EUR on SOCIETE EXERCANT L'ACTIVITE DE "PORTAILS INTERNET". The case was handled under a simplified procedure. | FR | CNIL | GDPR | €5,000 | ↗ |
| 13 Nov 2025 | Comune di OrteComune di Orte was fined EUR 6,000 by the Garante for installing surveillance cameras without ensuring the required transparency in data processing. The authority found breaches of the principles of lawfulness, fairness, and transparency. | IT | Garante | GDPR | €6,000 | ↗ |
| 13 Nov 2025 | GROUPEMENT D'INTERET ECONOMIQUE (GIE) EXERCANT UNE ACTIVITE D'ORGANISATION, DE DEVELOPPEMENT ET DE PROMOTION DE CENTRES COMMERCIAUX (procédure simplifiée)The CNIL imposed an administrative fine of EUR 20,000 on a GIE engaged in the organization, development, and promotion of shopping centers. The case was handled under a simplified procedure. | FR | CNIL | GDPR | €20,000 | ↗ |
| 13 Nov 2025 | Maviglia Assicurazioni snc di Gherardo Maviglia & c.Maviglia Assicurazioni was fined by the Garante 10,000 EUR for unlawful processing of personal data. The case involved automatic email redirection and indefinite retention of email logs and content, which breached GDPR principles. | IT | Garante | GDPR | €10,000 | ↗ |
| 13 Nov 2025 | SOCIETE EXERCANT UNE ACTIVITE DE COMMERCE DE DETAIL CHAUSSURES (procédure simplifiée)The CNIL imposed an administrative fine of EUR 5,000 on SOCIETE EXERCANT UNE ACTIVITE DE COMMERCE DE DETAIL CHAUSSURES under a simplified procedure. The decision is dated 13 November 2025. | FR | CNIL | GDPR | €5,000 | ↗ |
| 14 Nov 2025 | UNIVERSIDADThe university was fined EUR 200,000 by the AEPD for processing special categories of personal data, including biometric data, without proper justification. The authority also found that a data protection impact assessment had not been carried out before implementing online exams. | ES | AEPD | GDPR | €200,000 | ↗ |
| 15 Nov 2025 | Państwowego Powiatowego Inspektora Sanitarnego w M., ul.UODO imposed a PLN 20,000 administrative fine on the State District Sanitary Inspector in M. The authority found that appropriate technical and organizational measures based on a risk assessment were not implemented, and that the effectiveness of safeguards for data processed on external media was not regularly tested. The case concerned a breach of the integrity and confidentiality principle. | PL | UODO | GDPR | €4,725 | ↗ |
| 17 Nov 2025 | PGS SOFA & CO SRLIn October 2025, ANSPDCP completed an investigation at PGS SOFA & CO SRL and found a GDPR violation. The authority imposed a fine of EUR 8,000. | RO | ANSPDCP | GDPR | €8,000 | ↗ |
| 18 Nov 2025 | Anonymisiert (DSB 2025-0.902.556)The responsible party unlawfully published parts of a private complaint on a social media platform. This breached data minimization principles and there was no legal basis for processing personal data. | AT | DSB | GDPR | €1,200 | ↗ |
| 19 Nov 2025 | About YouThe Hungarian Competition Authority (GVH) found that About You used misleading discount pricing and pressured consumers with countdown timers and scarcity messages. The company was ordered to pay HUF 505 million to the Hungarian central budget and to provide compensation to affected Hungarian customers. | HU | Gazdasági Versenyhivatal | Omnibus | €1,323,000 | ↗ |
| 19 Nov 2025 | Greencorp S.R.L.Greencorp S.R.L. was fined EUR 3,000 by ANSPDCP. The authority found that the company failed to notify a personal data security breach. | RO | ANSPDCP | GDPR | €3,000 | ↗ |
| 20 Nov 2025 | LastPass UK LtdThe ICO imposed a GBP 1,228,283 penalty on LastPass UK Ltd for breaches of Article 5(1)(f) and Article 32(1)(f) UK GDPR. Failure to implement appropriate technical and organisational measures allowed a threat actor to exfiltrate personal data relating to about 1.6 million UK customers from a backup database. The most sensitive data in customer password vaults remained encrypted because of LastPass' zero-knowledge system. | GB | ICO | GDPR | €1,393,000 | ↗ |
| 20 Nov 2025 | SOCIETE AYANT POUR ACTIVITE L'EDITION DE REVUES ET PERIODIQUES ET LA REGIE PUBLICITAIRECNIL imposed an administrative fine of EUR 750,000 on SOCIETE AYANT POUR ACTIVITE L'EDITION DE REVUES ET PERIODIQUES ET LA REGIE PUBLICITAIRE. The case concerns a confirmed breach of rules supervised by the CNIL. | FR | CNIL | GDPR | €750,000 | ↗ |
| 20 Nov 2025 | SOCIETE EXERCANT DES ACTIVITES DE SOCIETES DE HOLDING ET DEVELOPPANT DES SOLUTIONS EN RESSOURCES HUMAINES (procédure simplifiée)The CNIL imposed an administrative fine of EUR 10,000 under a simplified procedure. The case concerns a breach of rules covered by the authority's decision. | FR | CNIL | GDPR | €10,000 | ↗ |