BULLETIN №082Last updated · 29 Jul 2026
Fine Tracker.
A public register of regulatory fines issued under EU compliance directives. Updated as decisions are published by national supervisory authorities.
5,273 entries
- Total fines
- €8.6bn
- Decisions
- 5,273
- Jurisdictions
- 33
- Regulators
- 74
- Avg monthly
- €162.7m
- YoY volume
- -21%
| Imposed | Company | Country | Authority | Type | Amount | ↗ |
|---|---|---|---|---|---|---|
| 17 Jan 2025 | Dane anonimowe (X. z siedzibą w K.)The UODO imposed administrative fines on X. based in K. for breaches of Article 6(1), Article 9(1), Article 13(1) and (2), Article 25(1), and Article 32(1) and (2) of the GDPR. These breaches also resulted in violations of the principles in Article 5(1)(a) and (f) and Article 5(2) of the GDPR. | PL | UODO | GDPR | €161,000 | ↗ |
| 17 Jan 2025 | DELIVERY SOLUTIONS S.A.The company was fined for failing to implement adequate technical and organizational measures to ensure a level of security appropriate to the risk. The authority also found insufficient safeguards to ensure data confidentiality. | RO | ANSPDCP | GDPR | €2,000 | ↗ |
| 17 Jan 2025 | OLALA MNG, S.L.OLALA MNG, S.L. was fined by the AEPD EUR 1,600 for requesting excessive personal data from guests booking through a website. The authority found that asking for images of identity documents constituted a data protection breach. | ES | AEPD | GDPR | €1,600 | ↗ |
| 16 Jan 2025 | Comune di PaternòThe Garante fined Comune di Paternò EUR 6,000 for failing to communicate the Data Protection Officer’s contact details to the Authority. The breach concerned the obligation under Article 37(7) GDPR. | IT | Garante | GDPR | €6,000 | ↗ |
| 16 Jan 2025 | CENTRE DE FORMATION A DISTANCE D'APPRENTIS (procédure simplifiée)The CNIL imposed an administrative fine of EUR 10,000 on CENTRE DE FORMATION A DISTANCE D'APPRENTIS and issued an injunction. The case was handled under a simplified procedure. | FR | CNIL | GDPR | €10,000 | ↗ |
| 16 Jan 2025 | Comune di CoriThe Garante fined Comune di Cori EUR 2,000 for violations related to the processing of personal data in connection with the issuance of the “Dedicata a te” card. The case involved electronic payment cards provided by Poste Italiane. | IT | Garante | GDPR | €2,000 | ↗ |
| 13 Jan 2025 | Centrul Medical Unirea S.R.L.The National Supervisory Authority for Personal Data Processing completed an investigation at Centrul Medical Unirea S.R.L. and found a breach of Article 32 of the GDPR. A fine of EUR 2,000 was imposed. | RO | ANSPDCP | GDPR | €2,000 | ↗ |
| 13 Jan 2025 | OrangeCNIL imposed a EUR 50 million fine on Orange for displaying commercial ads in email inboxes without prior user consent. The authority also found that advertising and statistical cookies continued to be read after consent had been withdrawn, in breach of the GDPR. | FR | Commission Nationale de l'Informatique et des Libertés | GDPR | €50,000,000 | ↗ |
| 13 Jan 2025 | BLEISOR SOLUTIONS, S.A.S.BLEISOR SOLUTIONS, S.A.S. was fined 600 EUR by the AEPD. The authority found that the company failed to provide access to personal data and information requested by the supervisory authority, in breach of Article 58(1) GDPR. | ES | AEPD | GDPR | €600 | ↗ |
| 10 Jan 2025 | CRUZ ROJA ESPAÑOLACRUZ ROJA ESPAÑOLA was fined EUR 50,000 by the AEPD for a personal data protection breach. The case involved the unauthorized disclosure of patient data in a communication about a change in embryo bank management. | ES | AEPD | GDPR | €50,000 | ↗ |
| 10 Jan 2025 | Stowarzyszenie „Maraton” z GorlicThe President of the Personal Data Protection Office imposed an administrative fine of PLN 916.71 on Stowarzyszenie „Maraton” z Gorlic. The penalty concerned failure to notify a personal data breach within the required 72-hour deadline, together with related compliance shortcomings. | PL | Prezes Urzędu Ochrony Danych Osobowych | GDPR | €215 | ↗ |
| 09 Jan 2025 | SOCIETE REALISANT DES TRAVAUX D'ISOLATION, DE RENOVATION ENERGETIQUE ET DE CHAUFFAGE (procédure simplifiée)The CNIL imposed an administrative fine of 15,000 EUR on SOCIETE REALISANT DES TRAVAUX D'ISOLATION, DE RENOVATION ENERGETIQUE ET DE CHAUFFAGE and issued an injunction. The case was handled under simplified proceedings. | FR | CNIL | GDPR | €15,000 | ↗ |
| 09 Jan 2025 | National Bank of GreeceNational Bank of Greece was fined €20,000 by the HDPA. The authority found that the bank failed to provide data subjects with timely access to their personal data, breaching GDPR Articles 15 and 12. | GR | HDPA | GDPR | €20,000 | ↗ |
| 06 Jan 2025 | Anonymisé (CNPD decision-01-fr-2025)The entity failed to comply with the response time requirements for data subject requests, which constitutes a breach of Article 12 GDPR. CNPD imposed a fine of EUR 493,560. | LU | CNPD | GDPR | €493,000 | ↗ |
| 01 Jan 2025 | MONUMENTAL FORMA SPORT, S.L.MONUMENTAL FORMA SPORT, S.L. was fined by the AEPD EUR 3,000 for requesting excessive personal data, including banking information, in connection with a free gym access promotion. The authority found that the data requested breached the GDPR data minimisation principle under Article 5(1)(c). | ES | AEPD | GDPR | €3,000 | ↗ |
| 01 Jan 2025 | Εθνική Τράπεζα της Ελλάδος Α.Ε.The data protection authority imposed a EUR 220,000 fine on Εθνική Τράπεζα της Ελλάδος Α.Ε. for a GDPR violation. The case concerned deficiencies in personal data protection and compliance with GDPR requirements. | GR | Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα | GDPR | €220,000 | ↗ |
| 01 Jan 2025 | SGKLegalThe Greek data protection authority, ΑΠΔΠΧ, imposed a fine of EUR 22,000 on SGKLegal for a GDPR violation. The case involved recorded conversations and deficiencies in personal data protection compliance. | GR | Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (ΑΠΔΠΧ) | GDPR | €22,000 | ↗ |
| 01 Jan 2025 | B3C CONSULTORÍA DE SERVICIOS 2010 S.L.B3C CONSULTORÍA DE SERVICIOS 2010 S.L. was fined by the AEPD EUR 800 for subcontracting TELCO without authorization from the data controller, AIRE NETWORKS. The company also failed to impose the required contractual obligations on TELCO, breaching GDPR Articles 28.2 and 28.4. | ES | AEPD | GDPR | €800 | ↗ |
| 01 Jan 2025 | STRATESYS TECHNOLOGY SOLUTIONS, S.L.STRATESYS TECHNOLOGY SOLUTIONS, S.L. was fined EUR 100,000 by the AEPD for breaching Article 5(1)(f) of the GDPR. The case concerned a failure to protect the integrity and confidentiality of personal data. | ES | AEPD | GDPR | €100,000 | ↗ |
| 01 Jan 2025 | A.A.A.A.A.A. failed to properly handle a data access request, which constitutes a breach of Article 15 GDPR. The AEPD imposed a fine of EUR 200, reduced to EUR 160 for early payment. | ES | AEPD | GDPR | €200 | ↗ |