Order report
BULLETIN №081Last updated · 28 Jul 2026

Fine Tracker.

A public register of regulatory fines issued under EU compliance directives. Updated as decisions are published by national supervisory authorities.

5,273 entries

Total fines
€8.6bn
Decisions
5,273
Jurisdictions
33
Regulators
74
Avg monthly
€162.7m
YoY volume
-20.7%
Country
Type
Date range
ImposedCompanyCountryAuthorityTypeAmount↗
09 Oct 2024Pana AB, prowadzącego działalność gospodarczą pod firmą X, ul.The Polish DPA (UODO) imposed a fine of PLN 353,589 on Pana AB, operating under the name X, for breaches of the GDPR. The authority also ordered the company to bring its processing operations into compliance with Regulation (EU) 2016/679.PLUODOGDPR€82,273↗
—DPD PolskaThe President of the Personal Data Protection Office imposed an administrative fine of more than PLN 11 million on DPD Polska for GDPR violations. The authority cited the failure to conclude data processing agreements with external carriers and inadequate organizational measures to protect data security.PLPrezes Urzędu Ochrony Danych Osobowych—€2,568,000↗
18 Oct 2023Dane anonimowe (J. Towarzystwo Ubezpieczeń S.A. z siedzibą w N.)UODO imposed an administrative fine of PLN 103,752 on J. Towarzystwo Ubezpieczeń S.A. The authority found that the company failed to notify the supervisory authority of a personal data breach without undue delay.PLUODOGDPR€23,362↗
29 Apr 2024Dane anonimowe (A. Sp. k. z siedzibą w T.)UODO imposed a PLN 238,345 administrative fine on A. Sp. k. for failing to implement appropriate technical and organizational measures proportionate to the risk of data processing, including the use of external storage media. The authority also found a lack of regular testing, measurement, and evaluation of the effectiveness of the security measures in place.PLUODOGDPR€55,103↗
13 Dec 2023Dane anonimowe (M. Sp. z o.o. z siedzibą w D. przy ul.)The President of UODO imposed a PLN 23,580 administrative fine on M. Sp. z o.o. The penalty was issued for failing to comply with two administrative decisions issued by the data protection authority.PLUODOGDPR€5,451↗
12 Jul 2023Dane anonimowe (Panią K.W. prowadzącą działalność gospodarczą pod nazwą W. z miejscem wykonywania działalności w O. przy ul.)UODO imposed an administrative fine on the business for failing to report a personal data breach to the supervisory authority within 72 hours. The authority also found that the affected individuals were not notified without undue delay.PLUODOGDPR€2,651↗
23 Oct 2025Dane anonimowe (Komornika Sądowego przy Sądzie Rejonowym w S. B. F. Kancelaria)The President of UODO imposed an administrative fine on the bailiff’s office for failing to report a personal data breach within the required 72 hours. The authority also found that the affected individual was not notified without undue delay after the data was disclosed to an unauthorized recipient.PLUODOGDPR€1,819↗
18 Jul 2023Dane anonimowe (K. za naruszenie przepisów art. 5 ust. 1 lit. f), art. 5 ust. 2, art. 25 ust. 1 oraz art. 32 ust. 1 i 2 rozporządzenia 2016/679)UODO imposed a fine on the controller for failing to implement appropriate technical and organizational measures when employees used portable company laptops. The authority also found a lack of regular testing, measuring, and evaluation of security measures, which breached the principles of integrity, confidentiality, and accountability.PLUODOGDPR€3,374↗
12 Nov 2024Dane anonimowe (X. w Y.)UODO imposed an administrative fine of PLN 24,555 on Anonymous entity (X. in Y.) for breaches of Articles 24(1), 25(1), and 32(1)-(2) of the GDPR. The authority also ordered the processing operations to be brought into compliance with Regulation (EU) 2016/679.PLUODOGDPR€5,644↗
16 Aug 2022Dane anonimowe (N. Ośrodek Kultury z siedzibą w N. przy ul.)UODO imposed an administrative fine of PLN 2,500 on the Cultural Centre. The authority found that personal data were entrusted for processing without a written data processing agreement and without verifying whether the processor provided sufficient technical and organizational safeguards under the GDPR.PLUODOGDPR€531↗
10 Jul 2024Dane anonimowe (Panią A. Z. prowadzącą działalność gospodarczą pod firmą B. z siedzibą w W przy ul.)The President of UODO imposed an administrative fine on an individual conducting business activity. The sanction resulted from failure to cooperate with the authority and from not providing access to personal data and information necessary for supervisory tasks.PLUODOGDPR€5,129↗
05 Jan 2021DKN.5131.6.2020StatusprawomocnaTytuUODO imposed a fine of PLN 25,000 on the University for failing to report a personal data breach to the President of UODO. The institution also did not notify the affected individuals about the breach.PLUODOGDPR€5,498↗
19 Feb 2026Dane anonimowe (W.)UODO imposed an administrative fine of PLN 5,898,064 on Dane anonimowe (W.). The authority found that the company processed personal data without a legal basis and in a manner that was excessive and disproportionate to the stated purpose, including by collecting photos or scans of identity cards or passports.PLUODOGDPR€1,397,000↗
11 Feb 2021Krajową Szkołę Sądownictwa i Prokuratury z siedzibą w Z.,UODO imposed a PLN 100,000 administrative fine on the National School of Judiciary and Public Prosecution. The authority found that the entity failed to implement appropriate technical and organizational measures to ensure the ongoing confidentiality of processing services and breached GDPR Article 28(3).PLUODOGDPR€22,235↗
13 Jun 2024Samodzielny Publiczny Zespół Opieki Zdrowotnej z siedzibą w P., za naruszenie art. 5 ust. 1 lit. f) i ust. 2, art. 25 ust. 1, art. 32 ust. 1 i 2 oraz art. 34 ust. 1 rozporządzenia 2016/679The Polish DPA (UODO) imposed an administrative fine of PLN 40,000 on the Samodzielny Publiczny Zespół Opieki Zdrowotnej based in P. The decision concerns breaches of Article 5(1)(f) and (2), Article 25(1), Article 32(1) and (2), and Article 34(1) of Regulation (EU) 2016/679.PLUODOGDPR€9,201↗
19 Dec 2023Sąd Okręgowy w Krakowie za naruszenie art. 33 ust. 1 i ust. 2 oraz art. 34 ust. 1 i ust. 2 rozporządzenia 2016/679UODO imposed an administrative fine of 10,000 PLN on the Regional Court in Kraków. The case concerns breaches of obligations related to personal data breach notification and informing affected individuals.PLUODOGDPR€2,306↗
22 Jan 2022Dane anonimowe (C. S.A. z siedzibą w M. przy ul.)UODO imposed an administrative fine on the controller and the processor for failing to implement appropriate technical and organizational measures to protect personal data. The breach resulted in a loss of confidentiality, and the controller also failed to properly verify the processor.PLUODOGDPR€1,083,000↗
19 Mar 2021Dane anonimowe (T. Spółka z o.o.)The President of UODO imposed an administrative fine of PLN 22,739.5 on T. Sp. z o.o. The sanction was issued for failing to cooperate with the supervisory authority and for not providing information necessary to examine a complaint.PLUODOGDPR€4,922↗
21 Aug 2020ZSOUODO imposed a PLN 50,000 fine on ZSO for breaching personal data protection rules. The case concerned non-compliance with requirements under data protection regulations.PLUODOGDPR€11,369↗
12 Jun 2025Krajowa Szkoła Sądownictwa i Prokuratury (KSSiP)The President of the Polish data protection authority imposed a PLN 100,000 fine on the National School of Judiciary and Public Prosecution for breaching data protection rules during a data migration. The Supreme Administrative Court upheld the decision, making the sanction final.PLUrząd Ochrony Danych OsobowychGDPR€23,425↗