BULLETIN №081Last updated · 26 Jul 2026
Fine Tracker.
A public register of regulatory fines issued under EU compliance directives. Updated as decisions are published by national supervisory authorities.
5,273 entries
- Total fines
- €8.6bn
- Decisions
- 5,273
- Jurisdictions
- 33
- Regulators
- 74
- Avg monthly
- €162.7m
- YoY volume
- -20.7%
| Imposed | Company | Country | Authority | Type | Amount | ↗ |
|---|---|---|---|---|---|---|
| 12 Mar 2024 | DKN.5131.28.2023StatusprawomocnaTytuUODO imposed an administrative fine of PLN 78,575.4 for failing to report a personal data breach without undue delay. The incident was not notified to the supervisory authority within 72 hours of becoming aware of the breach. | PL | UODO | GDPR | €18,331 | ↗ |
| 04 Jul 2025 | Niepubliczny Zakład Opieki ZdrowotnejUODO imposed a PLN 32,832 administrative fine on Niepubliczny Zakład Opieki Zdrowotnej for failing to conduct a risk analysis for processing patient data during home visits. The authority also found that appropriate technical and organizational measures to secure the data had not been implemented. | PL | UODO | GDPR | €7,733 | ↗ |
| 03 Nov 2022 | DKN.5131.18.2022StatusnieprawomocnaTytuUODO imposed an administrative fine of PLN 250,000 on the company. The authority found that the company failed to notify the supervisory authority within 24 hours of detecting the personal data breach and did not promptly inform the affected data subject. | PL | UODO | GDPR | €53,090 | ↗ |
| 02 Nov 2022 | Dane anonimowe (Wójta Gminy U. za naruszenie przepisów art. 5 ust. 1 lit. f), art. 5 ust. 2, art. 25 ust. 1 oraz art. 32 ust. 1 i 2 rozporządzenia 2016/679)The Polish DPA (UODO) imposed an administrative fine of PLN 8,000 on the Mayor of U. Commune. The authority found that personal data were processed without adequate security, in breach of Articles 5, 25 and 32 of the GDPR. | PL | UODO | GDPR | €1,701 | ↗ |
| 12 Mar 2024 | Dane anonimowe (U.)An administrative fine was imposed for failing to notify the supervisory authority of a personal data breach within the required 72 hours after detection. The authority also found that the affected individuals were not informed without undue delay. | PL | UODO | GDPR | €336,000 | ↗ |
| 27 Feb 2026 | T., za naruszenie art. 5 ust. 1 lit. f), art. 5 ust. 2 oraz art. 32 ust. 1 i 2 rozporządzenia 2016/679,The Polish DPA (UODO) imposed an administrative fine of PLN 975 on T. for failing to implement appropriate technical and organizational measures and for lacking a proper, accountable data protection policy tailored to its processing activities. The authority also noted deficiencies in transparency notices, processor agreements, access authorizations, and the record of processing activities. | PL | UODO | GDPR | €231 | ↗ |
| 30 Nov 2023 | SzkołęUODO imposed an administrative fine of PLN 35,000 on Szkołę. The authority found that the company had not implemented appropriate technical and organizational measures to secure personal data processed in the application. It also noted the absence of regular testing, measurement, and assessment of the effectiveness of those safeguards. | PL | UODO | GDPR | €8,048 | ↗ |
| 22 Dec 2021 | wyżej wymienionąA financial penalty was imposed on an individual conducting business activity for failing to ensure that the President of the Personal Data Protection Office had access to personal data and information necessary to perform his duties. The case concerned obstruction of the supervisory authority’s powers. | PL | UODO | GDPR | €982 | ↗ |
| 31 Dec 2021 | Dane anonimowe (S. Spółka z o.o. z siedzibą w W. przy ul.)The President of UODO imposed an administrative fine of PLN 18,192 on the company. The sanction resulted from failing to provide access to personal data and other information necessary for the authority to perform its duties. | PL | UODO | GDPR | €3,957 | ↗ |
| 30 Nov 2022 | Dane anonimowe (N. B. oraz T. M., wspólników spółki cywilnej Kancelaria)UODO imposed an administrative fine on N. B. and T. M., partners in the civil-law partnership Kancelaria. The authority found that they processed personal data of clients and prospective clients without a legal basis. | PL | UODO | GDPR | €9,799 | ↗ |
| 12 Nov 2024 | Dane anonimowe (A. z siedzibą w W. przy ul.)The Polish DPA (UODO) imposed administrative fines on the controller and the processor for breaches of GDPR obligations. The case concerned, among others, integrity and confidentiality, accountability, data protection by design, processor arrangements, and security measures. | PL | UODO | GDPR | €351,000 | ↗ |
| 16 Oct 2019 | Dane anonimowe (S. Sp. z o.o. z siedzibą w P., karę pieniężną w kwocie 201 559,50 PLN)UODO imposed a fine of PLN 201,559.50 on S. Sp. z o.o. for failing to implement appropriate technical and organizational measures. The authority also found that personal data were processed without a lawful basis, which led to the sanction. | PL | UODO | GDPR | €46,923 | ↗ |
| 06 Mar 2025 | Dane anonimowe (J.)UODO imposed an administrative fine of PLN 56,824 on Anonymous data (J.) for failing to implement appropriate technical and organizational measures to ensure processing security. The case concerned a breach of personal data protection obligations. | PL | UODO | GDPR | €13,604 | ↗ |
| 25 Nov 2025 | Dane anonimowe (D. C., prowadzącego działalność gospodarczą pod firmą W.)UODO imposed a fine of PLN 7,577 on an anonymous entrepreneur for failing to implement adequate technical and organizational measures to secure data processing. The authority also found that processing was not properly limited to the controller’s instructions and that no record of processing activities was maintained. | PL | UODO | GDPR | €1,794 | ↗ |
| 30 Aug 2022 | Dane anonimowe (T. Spółkę z ograniczoną odpowiedzialnością z siedzibą w W.)The President of UODO imposed an administrative fine of PLN 31,988 on T. Ltd. The authority found that the company failed to provide access to information necessary for the President of UODO to carry out his duties. | PL | UODO | GDPR | €6,759 | ↗ |
| 14 Oct 2021 | Dane anonimowe (Bank Z. S.A.)The Polish DPA (UODO) imposed an administrative fine of PLN 363,832 on Bank Z. S.A. The authority found that the bank failed to notify the supervisory authority of a personal data breach and did not inform the affected individuals. | PL | UODO | GDPR | €79,625 | ↗ |
| 01 Apr 2025 | Dane anonimowe (G. M. prowadzącą działalność gospodarczą pod firmą)UODO imposed an administrative fine of PLN 29,043 on the business operator. The authority found that appropriate technical and organizational measures proportionate to the risk of personal data processing were not implemented, and that their effectiveness was not regularly tested, measured, and assessed. | PL | UODO | GDPR | €6,938 | ↗ |
| 24 Apr 2024 | Dane anonimowe (Komitet Inicjatywy Ustawodawczej W. na rzecz ustawy o zmianie ustawy z dn. 24 lipca 2015 r. Prawo o zgromadzeniach oraz niektórych innych ustaw)UODO imposed an administrative fine on the entity responsible for a list of citizens supporting a legislative initiative. The authority found inadequate technical and organisational measures for the risk, a failure to regularly test security controls, and delays in reporting and notifying the personal data breach. | PL | UODO | GDPR | €2,527 | ↗ |
| 13 Apr 2026 | Dane anonimowe (Pana L. A. prowadzącego działalność gospodarczą pod nazwą: A.)UODO issued a reprimand to the controller, two agents and a sub-agent, and imposed an administrative fine on the sub-agent. The case concerned GDPR breaches related to processing security, verification of processors, and the principles of confidentiality and accountability. | PL | UODO | GDPR | €2,385 | ↗ |
| 18 Feb 2020 | ZSZZS.440.768.2018StatusuchylonaTytuUODO found a breach related to the processing of children’s biometric data in connection with use of the school canteen. A fine of PLN 20,000 was imposed. | PL | UODO | GDPR | €4,679 | ↗ |