BULLETIN №081Last updated · 28 Jul 2026
Fine Tracker.
A public register of regulatory fines issued under EU compliance directives. Updated as decisions are published by national supervisory authorities.
5,273 entries
- Total fines
- €8.6bn
- Decisions
- 5,273
- Jurisdictions
- 33
- Regulators
- 74
- Avg monthly
- €162.7m
- YoY volume
- -20.7%
| Imposed | Company | Country | Authority | Type | Amount | ↗ |
|---|---|---|---|---|---|---|
| 05 Aug 2021 | Anonymisé (CNPD decision-31-fr-2021)The company sent emails containing sensitive medical data to incorrect recipients. The authority also found a breach of data protection duties due to improper documentation of the incidents. | LU | CNPD | GDPR | €275,000 | ↗ |
| 11 Jun 2021 | Anonymisé (CNPD decision-21-fr-2021)The company did not comply with the data minimization principle and failed to adequately inform employees and third parties about data processing activities. CNPD found these practices to breach GDPR Articles 5(1)(c) and 13. | LU | CNPD | GDPR | €7,600 | ↗ |
| 11 Jun 2021 | Anonymisé (CNPD decision-20-fr-2021)The company was fined EUR 15,000 by the CNPD for failing to properly involve the Data Protection Officer in matters related to personal data protection. The authority also found that the DPO's autonomy was not ensured and that the advisory and monitoring functions were not adequately supported. | LU | CNPD | GDPR | €15,000 | ↗ |
| 06 Oct 2021 | Anonymisé (CNPD decision-35-fr-2021)The company was fined by the CNPD in the amount of 5,300 EUR for breaching GDPR requirements. The authority found that it failed to provide adequate information to data subjects and did not comply with the data minimization principle. | LU | CNPD | GDPR | €5,300 | ↗ |
| 13 Dec 2022 | Anonymisé (CNPD decision-20-fr-2022)The entity failed to meet GDPR transparency obligations, particularly by not providing information in a clear and accessible manner. CNPD imposed a fine of 4,200 EUR. | LU | CNPD | GDPR | €4,200 | ↗ |
| 05 Jul 2023 | Anonymisé (CNPD decision-06-fr-2023)The company failed to implement appropriate technical and organizational measures to ensure data security. It also did not cooperate with the supervisory authority, breaching Articles 31 and 32 of the GDPR. | LU | CNPD | GDPR | €5,330 | ↗ |
| 13 Dec 2022 | Anonymisé (CNPD decision-21-fr-2022)The company was fined EUR 3,700 by the CNPD for breaching the transparency obligations under Article 12(1) of the GDPR. The authority found that information was not sufficiently accessible to users. | LU | CNPD | GDPR | €3,700 | ↗ |
| 13 Dec 2022 | Anonymisé (CNPD decision-19-fr-2022)The company failed to meet GDPR transparency obligations by not providing the required information in a concise, transparent, and easily accessible manner. CNPD imposed a fine of 1,000 EUR. | LU | CNPD | GDPR | €1,000 | ↗ |
| 20 Nov 2024 | Anonymisé (CNPD decision-03-fr-2024)The company was fined for installing surveillance cameras without a legal basis. The authority found breaches of GDPR principles of lawfulness, transparency, and security. | LU | CNPD | GDPR | €14,288 | ↗ |
| 16 Dec 2025 | Anonymisé (CNPD decision-05-fr-2025)The company did not maintain a complete and accurate record of processing activities under Article 30 GDPR. The record lacked or contained incomplete information on data categories and transfers to third countries. | LU | CNPD | GDPR | €7,341 | ↗ |
| 29 Jun 2021 | Anonymisé (CNPD decision-24-fr-2021)The company was fined EUR 17,000 by the CNPD for breaching the data minimization principle and for failing to provide adequate information to data subjects. The deficiencies concerned employees and third parties in relation to processing activities. | LU | CNPD | GDPR | €17,000 | ↗ |
| 11 Jun 2021 | Anonymisé (CNPD decision-22-fr-2021)The company failed to comply with GDPR requirements on data minimization and transparency. It also did not adequately inform individuals about video surveillance and geolocation systems, breaching Articles 5(1)(c), 5(1)(e), 13, and 32(1) of the GDPR. | LU | CNPD | GDPR | €7,200 | ↗ |
| 30 Jun 2022 | Anonymisé (CNPD decision-14-fr-2022)The company did not provide data subjects with adequate information about video surveillance, breaching GDPR transparency requirements. CNPD found violations of Articles 5, 12, and 13 GDPR and imposed a 1,000 EUR fine. | LU | CNPD | GDPR | €1,000 | ↗ |
| 05 Jul 2023 | Anonymisé (CNPD decision-05-fr-2023)The company did not inform data subjects about the recipients of their personal data. It also failed to implement appropriate technical and organizational measures required under the GDPR, breaching Articles 13 and 24. | LU | CNPD | GDPR | €1,500 | ↗ |
| 12 May 2021 | Anonymisé (CNPD decision-14-fr-2021)The company was fined by the CNPD in the amount of 2,600 EUR for breaching GDPR requirements on data minimization, data retention, and information obligations. The case concerned non-compliant personal data processing and a failure to provide the required information to data subjects. | LU | CNPD | GDPR | €2,600 | ↗ |
| 06 Jan 2025 | Anonymisé (CNPD decision-01-fr-2025)The entity failed to comply with the response time requirements for data subject requests, which constitutes a breach of Article 12 GDPR. CNPD imposed a fine of EUR 493,560. | LU | CNPD | GDPR | €493,000 | ↗ |
| 16 Feb 2022 | Anonymisé (CNPD decision-04-fr-2022)The CNPD found that the companies failed to meet the Article 13 GDPR information obligation toward data subjects, including employees and third parties. The breach concerned the lack of proper notice about data processing activities. | LU | CNPD | GDPR | €3,100 | ↗ |
| 20 Apr 2022 | Anonymisé (CNPD decision-09-fr-2022)The CNPD fined the company EUR 2,000 for failing to respond in time to a data subject access request and for not providing all required information under GDPR Articles 12 and 15. The company also failed to cooperate with the supervisory authority, contrary to Article 31 GDPR. | LU | CNPD | GDPR | €2,000 | ↗ |
| 02 Feb 2022 | Anonymisé (CNPD decision-02-fr-2022)The company was fined by the CNPD 6,600 EUR for breaches of GDPR requirements. The authority found deficiencies in data minimization, retention, security of processing, and the information provided to data subjects in connection with video surveillance and geolocation systems. | LU | CNPD | GDPR | €6,600 | ↗ |
| 12 May 2021 | Anonymisé (CNPD decision-16-fr-2021)The company was fined for failing to comply with the data minimization principle and for not providing adequate information to data subjects under GDPR Articles 5(1)(c) and 13. The CNPD decision indicates deficiencies in the company’s processing practices and privacy disclosures. | LU | CNPD | GDPR | €1,000 | ↗ |