BULLETIN №084Last updated · 13 Aug 2026
Fine Tracker.
A public register of regulatory fines issued under EU compliance directives. Updated as decisions are published by national supervisory authorities.
5,273 entries
- Total fines
- €8.6bn
- Decisions
- 5,273
- Jurisdictions
- 33
- Regulators
- 74
- Avg monthly
- €162.5m
- YoY volume
- -24%
| Imposed | Company | Country | Authority | Type | Amount | ↗ |
|---|---|---|---|---|---|---|
| 11 Dec 2025 | ZMLUK LimitedZMLUK Limited received an MPN from the ICO for sending unsolicited emails promoting energy-saving products. The case concerns a breach of electronic marketing rules and should be reviewed for compliance with applicable consent requirements. | GB | ICO | GDPR | €119,000 | ↗ |
| 11 Dec 2025 | UPGYMS IBERIA, S.L.UPGYMS IBERIA, S.L. was fined by the AEPD EUR 5,000 for sending unsolicited commercial SMS messages without obtaining recipient consent. The conduct breached the LSSI rules on marketing communications. | ES | AEPD | ePrivacy | €5,000 | ↗ |
| 11 Dec 2025 | SOCIETE EXERCANT UNE ACTIVITE D'ARTS DU SPECTACLE VIVANT (procédure simplifiée)The CNIL imposed an administrative fine of EUR 5,000 on SOCIETE EXERCANT UNE ACTIVITE D'ARTS DU SPECTACLE VIVANT and issued an injunction. The case concerns a breach of regulatory obligations under the data protection authority's supervision. | FR | CNIL | GDPR | €5,000 | ↗ |
| 11 Dec 2025 | SOCIETE AYANT POUR ACTIVITE L'ACCOMPAGNEMENT, L'ORIENTATION ET L'EDUCATION DE VICTIMES D'INCESTES (procédure simplifiée)The CNIL imposed an administrative fine of EUR 20,000 on SOCIETE AYANT POUR ACTIVITE L'ACCOMPAGNEMENT, L'ORIENTATION ET L'EDUCATION DE VICTIMES D'INCESTES and issued an injunction. The case was handled under a simplified procedure. | FR | CNIL | GDPR | €20,000 | ↗ |
| 11 Dec 2025 | SOCIETE AYANT POUR ACTIVITE LE DEVELOPPEMENT D'OUTILS MARKETINGCNIL imposed an administrative fine of 1,000,000 EUR on SOCIETE AYANT POUR ACTIVITE LE DEVELOPPEMENT D'OUTILS MARKETING. The case concerns a confirmed breach of rules under CNIL supervision. | FR | CNIL | GDPR | €1,000,000 | ↗ |
| 11 Dec 2025 | CANDIDAT AUX ELECTIONS LEGISLATIVES DE 2024 (procédure simplifiée)The CNIL imposed an administrative fine of EUR 2,500 on CANDIDAT AUX ELECTIONS LEGISLATIVES DE 2024. The case was handled under a simplified procedure and concerned a confirmed regulatory breach. | FR | CNIL | GDPR | €2,500 | ↗ |
| 12 Dec 2025 | Police Service of ScotlandThe Information Commissioner's Office (ICO) fined the Police Service of Scotland £66,000 and issued a reprimand for serious failures in handling sensitive personal information. The case concerned improper handling of information requiring special protection, increasing the risk to affected individuals. | GB | ICO | GDPR | €75,280 | ↗ |
| 15 Dec 2025 | SOCIETE EXERCANT UNE ACTIVITE D'EDITION DE LOGICIELS, NOTAMMENT DE PAIE (procédure simplifiée)The CNIL imposed an administrative fine of EUR 15,000 on a company active in software publishing, including payroll software. The case was handled under a simplified procedure. | FR | CNIL | GDPR | €15,000 | ↗ |
| 15 Dec 2025 | SOCIETE EXERCANT UNE ACTIVITE DE COMMERCE D'ALIMENTATION GENERALE SPECIALISEE (procédure simplifiée)The CNIL imposed an administrative fine of EUR 8,000 on SOCIETE EXERCANT UNE ACTIVITE DE COMMERCE D'ALIMENTATION GENERALE SPECIALISEE and issued an injunction. The case was handled under simplified proceedings. | FR | CNIL | GDPR | €8,000 | ↗ |
| 16 Dec 2025 | Anonymisé (CNPD decision-06-fr-2025)The company failed to maintain a proper record of processing activities under Article 30 GDPR. The register contained inaccuracies and omissions, indicating a breach of documentation obligations. | LU | CNPD | GDPR | €1,277 | ↗ |
| 16 Dec 2025 | Anonymisé (CNPD decision-05-fr-2025)The company did not maintain a complete and accurate record of processing activities under Article 30 GDPR. The record lacked or contained incomplete information on data categories and transfers to third countries. | LU | CNPD | GDPR | €7,341 | ↗ |
| 16 Dec 2025 | Anonymisé (CNPD decision-07-fr-2025)The entity did not maintain a complete and accurate record of processing activities, as required by Article 30 GDPR. CNPD imposed an administrative fine of EUR 12,010. | LU | CNPD | GDPR | €12,010 | ↗ |
| 16 Dec 2025 | Bank MillenniumThe Polish Supreme Administrative Court upheld a PLN 350,000 administrative fine imposed on Bank Millennium by the President of the Personal Data Protection Office. The sanction concerned failure to report a personal data breach and failure to notify affected individuals after a courier shipment containing customer data was lost. | PL | Urząd Ochrony Danych Osobowych | GDPR | €82,922 | ↗ |
| 16 Dec 2025 | Anonymisé (CNPD decision-04-fr-2025)The company did not maintain a complete and accurate record of processing activities under Article 30 GDPR. CNPD treated this as a breach of documentation obligations and imposed an administrative fine. | LU | CNPD | GDPR | €2,784 | ↗ |
| 17 Dec 2025 | Stichting Hogeschool van Arnhem en NijmegenThe Autoriteit Persoonsgegevens imposed a fine of €175,000 on Stichting Hogeschool van Arnhem en Nijmegen for failing to implement adequate technical and organizational measures appropriate to the risk. These deficiencies resulted in a data breach. | NL | AP | GDPR | €175,000 | ↗ |
| 17 Dec 2025 | HAN University of Applied SciencesThe Autoriteit Persoonsgegevens announced on 17 December 2025 that it had imposed a fine on HAN University of Applied Sciences. According to the notice, the university was hacked in September 2021, resulting in a data breach, and HAN will not object to the decision. | NL | Autoriteit Persoonsgegevens | GDPR | €100,000 | ↗ |
| 18 Dec 2025 | Comune di NaveComune di Nave was fined by the Garante for failing to ensure transparency in the processing of vehicle license plate data captured by surveillance cameras. The authority also found a breach of GDPR principles and the absence of a data protection impact assessment. | IT | Garante | GDPR | €6,000 | ↗ |
| 18 Dec 2025 | Elba Catering Distribuzioni s.r.l.s.Elba Catering Distribuzioni s.r.l.s. was fined EUR 2,000 by the Garante for installing a video surveillance system that primarily captured public streets. The authority found that this processing breached data protection rules. | IT | Garante | GDPR | €2,000 | ↗ |
| 18 Dec 2025 | Anticimex s.r.l.Anticimex s.r.l. was fined EUR 40,000 by the Garante for breaching data protection rules. The company failed to provide an employee with access to personal data, including work-related emails and CRM access logs, despite a request under Article 15 GDPR. | IT | Garante | GDPR | €40,000 | ↗ |
| 18 Dec 2025 | SOCIETE EXERCANT UNE ACTIVITE D'AGENCE DE VOYAGE (procédure simplifiée)The CNIL imposed an administrative fine of EUR 2,000 on SOCIETE EXERCANT UNE ACTIVITE D'AGENCE DE VOYAGE and issued an injunction. The case concerns a breach of rules supervised by the CNIL. | FR | CNIL | GDPR | €2,000 | ↗ |