BULLETIN №082Last updated · 02 Aug 2026
Fine Tracker.
A public register of regulatory fines issued under EU compliance directives. Updated as decisions are published by national supervisory authorities.
5,273 entries
- Total fines
- €8.6bn
- Decisions
- 5,273
- Jurisdictions
- 33
- Regulators
- 74
- Avg monthly
- €162.7m
- YoY volume
- -21.7%
| Imposed | Company | Country | Authority | Type | Amount | ↗ |
|---|---|---|---|---|---|---|
| 18 Oct 2019 | National Revenue Agency (Bulgaria)The Commission for Personal Data Protection imposed a fine of 5,100,000 BGN on Bulgaria’s National Revenue Agency. The sanction concerned the unauthorized disclosure and dissemination of personal data following a major security breach. | BG | Commission for Personal Data Protection | GDPR | €2,607,000 | ↗ |
| 21 Dec 2018 | Nationale PolitieThe Dutch Data Protection Authority imposed a penalty payment on Nationale Politie for failing to regularly and proactively review log files. The authority found this breached the Police Data Act. | NL | AP | GDPR | €40,000 | ↗ |
| 21 Dec 2018 | Nationale PolitieThe Dutch Data Protection Authority imposed a penalty payment on Nationale Politie for failing to regularly and proactively review log files. The authority found this breached the Police Data Act. | NL | AP | GDPR | €40,000 | ↗ |
| 14 Oct 2024 | National Debt Advice LimitedNational Debt Advice Limited sent 129,902 unsolicited direct marketing text messages, breaching regulation 22 of PECR. The activity generated more than 4,000 complaints to the 7726 spam reporting service. The ICO imposed a £30,000 fine and issued an enforcement notice. | GB | ICO | ePrivacy | €35,856 | ↗ |
| 21 Aug 2018 | National Bank of GreeceNational Bank of Greece was fined EUR 5,000 by the HDPA for failing to maintain accurate data about its debtors. The case concerned compliance with data protection obligations. | GR | HDPA | GDPR | €5,000 | ↗ |
| 09 Jan 2025 | National Bank of GreeceNational Bank of Greece was fined €20,000 by the HDPA. The authority found that the bank failed to provide data subjects with timely access to their personal data, breaching GDPR Articles 15 and 12. | GR | HDPA | GDPR | €20,000 | ↗ |
| 20 Feb 2025 | NAROBESA INV, S.L.NAROBESA INV, S.L. was fined EUR 2,000 by the AEPD for failing to provide the required documentation to the data protection authority. The case concerns a breach of the cooperation duty under Article 58(1) GDPR. | ES | AEPD | GDPR | €2,000 | ↗ |
| 10 Jan 2026 | NAROBESA INV, S.L.NAROBESA INV, S.L. was fined 1,000 EUR by the AEPD for unlawfully accessing a job applicant's credit information without consent during recruitment. The conduct breached data protection rules and occurred in the hiring process. | ES | AEPD | GDPR | €1,000 | ↗ |
| 07 May 2015 | Nappo Nicola JolandaNappo Nicola Jolanda was fined EUR 45,000 by the Garante for activating 37 phone cards in the names of 15 individuals without their knowledge. The conduct breached data protection rules. | IT | Garante | GDPR | €45,000 | ↗ |
| 09 Jan 2023 | NANDIVALE, S.L.NANDIVALE, S.L. was fined by the AEPD EUR 10,000 for publishing images of minors on Instagram without parental consent. The authority found this conduct to be in breach of GDPR Article 6(1). | ES | AEPD | GDPR | €10,000 | ↗ |
| 25 Jul 2022 | MZN HELLAS A.E.The company was fined for sending unsolicited SMS messages for marketing purposes despite the recipient's objection. This conduct breached GDPR rules on personal data processing and direct marketing. | GR | HDPA | GDPR | €5,000 | ↗ |
| 07 Apr 2021 | MZN HELLAS A.E.The company was fined for sending unsolicited marketing SMS messages to a customer who had explicitly objected to such communications. The authority found this to be a breach of GDPR rules on data subject rights and data protection by design. | GR | HDPA | GDPR | €20,000 | ↗ |
| 11 Sept 2025 | MY s.r.l.MY s.r.l. was fined by the Garante for operating video surveillance without proper alignment with data protection requirements. The case concerned breaches related to the processing of personal data through the camera system. | IT | Garante | GDPR | €6,000 | ↗ |
| 03 Dec 2019 | MYMOVILES EUROPA 2000, S.L.MYMOVILES EUROPA 2000, S.L. was fined by the AEPD €1,500 for failing to provide the required privacy information on its website. The authority found a breach of Article 13 GDPR. | ES | AEPD | GDPR | €1,500 | ↗ |
| 15 Oct 2012 | MYID ESPAÑA S.L.MYID ESPAÑA S.L. was fined by the AEPD in the amount of 1,200 EUR for sending unsolicited commercial emails despite requests to unsubscribe. The authority found a breach of Article 21.1 of the LSSI. | ES | AEPD | ePrivacy | €1,200 | ↗ |
| 02 Nov 2021 | MYHERITAGE, LTDMYHERITAGE, LTD was fined EUR 20,000 by the AEPD for international data transfers without adequate safeguards and for unclear legal grounds for processing. The authority also found insufficient information provided to data subjects and improper handling of genetic data. | ES | AEPD | ePrivacy | €20,000 | ↗ |
| 01 Jan 2022 | MUXERS CONCEPT, S.L.MUXERS CONCEPT, S.L. was fined EUR 20,000 by the AEPD for installing an unauthorized audio recording system in employee areas. The authority found this conduct to be in breach of Article 6 of the GDPR. | ES | AEPD | GDPR | €20,000 | ↗ |
| 28 Oct 2015 | MUTUA MADRILEÑA AUTOMOVILISTA SOCIEDAD DE SEGUROS A PRIMA FIJAMutua Madrileña was fined 40,001 EUR by the AEPD for sending unsolicited commercial emails despite the recipient’s objection. The case concerns a breach of data protection and direct marketing rules. | ES | AEPD | ePrivacy | €40,001 | ↗ |
| 27 Jan 2022 | Musicraiser S.r.l.Musicraiser S.r.l. was fined 1,000 EUR by the Garante for continuing to send newsletters to a user despite multiple requests to be removed. The case concerns a breach of data protection rules on respecting opt-out and cancellation requests for marketing communications. | IT | Garante | GDPR | €1,000 | ↗ |
| 07 Dec 2023 | Mushtaq RubinaThe Garante fined Mushtaq Rubina 2,000 EUR for operating a video surveillance system without adequate informational signage. The authority found a breach of GDPR transparency requirements toward recorded individuals. | IT | Garante | GDPR | €2,000 | ↗ |