BULLETIN №082Last updated · 29 Jul 2026
Fine Tracker.
A public register of regulatory fines issued under EU compliance directives. Updated as decisions are published by national supervisory authorities.
5,273 entries
- Total fines
- €8.6bn
- Decisions
- 5,273
- Jurisdictions
- 33
- Regulators
- 74
- Avg monthly
- €162.7m
- YoY volume
- -21%
| Imposed | Company | Country | Authority | Type | Amount | ↗ |
|---|---|---|---|---|---|---|
| 16 Dec 2025 | Anonymisé (CNPD decision-07-fr-2025)The entity did not maintain a complete and accurate record of processing activities, as required by Article 30 GDPR. CNPD imposed an administrative fine of EUR 12,010. | LU | CNPD | GDPR | €12,010 | ↗ |
| 13 Dec 2022 | Anonymisé (CNPD decision-22-fr-2022)The CNPD found that the entity breached GDPR transparency obligations by failing to provide information in a concise, transparent, and easily accessible manner. The infringement concerned Articles 12 and 13 of the GDPR. | LU | CNPD | GDPR | €1,700 | ↗ |
| 04 Aug 2021 | Anonymisé (CNPD decision-30-fr-2021)The public establishment failed to communicate the DPO’s contact details to the supervisory authority and did not provide the DPO with the resources needed to perform the role effectively. CNPD found breaches of GDPR Articles 37(7), 38(2), and 39(1)(b) and imposed a fine of 6,600 EUR. | LU | CNPD | GDPR | €6,600 | ↗ |
| 10 Mar 2022 | Anonymisé (CNPD decision-07-fr-2022)The CNPD found that Société A breached the GDPR by failing to comply with data minimization, retention limitation, and information provision requirements. The case concerned improper personal data processing in relation to compliance obligations. | LU | CNPD | GDPR | €3,500 | ↗ |
| 22 Apr 2022 | Anonymisé (CNPD decision-11-fr-2022)The company did not meet the information obligations under Article 13 GDPR in relation to video surveillance and employee geolocation systems. CNPD imposed an administrative fine of EUR 1,500. | LU | CNPD | GDPR | €1,500 | ↗ |
| 09 Nov 2021 | Anonymisé (CNPD decision-44-fr-2021)The company failed to meet the GDPR information obligations under Article 13 and the data minimization principle under Article 5(1)(c), particularly in connection with video surveillance. CNPD imposed a fine of 1,500 EUR. | LU | CNPD | GDPR | €1,500 | ↗ |
| 08 Apr 2021 | Anonymisé (CNPD decision-11-fr-2021)The company breached the GDPR by failing to respect data retention limits, by not adequately informing employees about data processing, and by applying insufficient security measures. The CNPD decision of 8 April 2021 resulted in a fine of 4,000 EUR. | LU | CNPD | GDPR | €4,000 | ↗ |
| 30 Apr 2025 | Anonymisé (CNPD decision-03-fr-2025)The company did not maintain a complete record of processing activities as required by Article 30 GDPR. CNPD imposed an administrative fine of €11,964. | LU | CNPD | GDPR | €11,964 | ↗ |
| 13 Dec 2022 | Anonymisé (CNPD decision-24-fr-2022)The entity failed to meet GDPR transparency obligations, particularly regarding the accessibility and comprehensibility of information provided to data subjects. CNPD imposed a fine of EUR 3,700. | LU | CNPD | GDPR | €3,700 | ↗ |
| 12 May 2021 | Anonymisé (CNPD decision-15-fr-2021)The CNPD imposed a EUR 2,900 fine for breaching the data minimization principle in connection with video surveillance. The camera’s field of view covered areas that were not necessary for the processing purpose, contrary to Article 5(1)(c) GDPR. | LU | CNPD | GDPR | €2,900 | ↗ |
| 30 Jun 2022 | Anonymisé (CNPD decision-13-fr-2022)The company breached GDPR by failing to respect data retention limits and by not providing employees with adequate information about the vehicle geolocation system. The CNPD imposed a fine of EUR 5,600. | LU | CNPD | GDPR | €5,600 | ↗ |
| 04 Oct 2023 | Amazon EuropeThe CNPD imposed a fine of EUR 746,000,000 on Amazon Europe for breaches of data protection rules. The case concerned shortcomings in the processing of personal data and compliance with GDPR requirements. | LU | CNPD | GDPR | €746,000,000 | ↗ |
| 16 Dec 2025 | Anonymisé (CNPD decision-04-fr-2025)The company did not maintain a complete and accurate record of processing activities under Article 30 GDPR. CNPD treated this as a breach of documentation obligations and imposed an administrative fine. | LU | CNPD | GDPR | €2,784 | ↗ |
| 27 Oct 2021 | Anonymisé (CNPD decision-41-fr-2021)The CNPD imposed a fine of 18,700 EUR on Anonymisé for improper implementation of Data Protection Officer obligations. The company did not publish the DPO’s contact details, did not involve the DPO in all data protection matters, did not ensure the DPO’s autonomy, and did not assign monitoring of GDPR compliance. | LU | CNPD | GDPR | €18,700 | ↗ |
| 10 Oct 2023 | UAB RamidonasThe supervisory authority imposed a €6,000 fine on UAB Ramidonas for personal data security violations. The case concerned deficiencies in data protection controls that could have exposed individuals’ information to risk. | LT | Valstybinė duomenų apsaugos inspekcija | GDPR | €6,000 | ↗ |
| 01 Jan 2024 | UAB VintedUAB Vinted received a EUR 2.385 million GDPR fine in Lithuania. The authority cited issues in user data processing, handling of data subject rights, and risk management. | LT | Valstybinė duomenų apsaugos inspekcija | GDPR | €2,385,000 | ↗ |
| 01 Feb 2026 | Biržų ligoninėVDAI imposed a EUR 6,000 fine on Biržų ligoninė for improper processing of personal data. The case concerns a breach of data protection requirements and indicates non-compliance with GDPR obligations. | LT | VDAI | GDPR | €6,000 | ↗ |
| 18 Mar 2025 | JRSY Laser LimitedThe Jersey Data Protection Authority fined JRSY Laser Limited 500 GBP following an investigation opened on 27 March 2024. The case concerned a breach of data protection requirements by the data controller. | JE | JOIC | GDPR | €594 | ↗ |
| 25 Mar 2025 | Star Delta Electrical ServicesThe Jersey Data Protection Authority fined Jon Peacock t/a Star-Delta Electrical Services £4,000. The case arose from a client complaint concerning the handling of personal data by the sole trader. The penalty was issued under the Data Protection (Jersey) Law 2018. | JE | JOIC | GDPR | €4,787 | ↗ |
| 14 Nov 2024 | Comune di MaddaloniThe Garante fined Comune di Maddaloni EUR 2,000 for failing to communicate the Data Protection Officer’s contact details to the Authority. This constituted a breach of Article 37(7) GDPR. | IT | Garante | GDPR | €2,000 | ↗ |