BULLETIN №081Last updated · 26 Jul 2026
Fine Tracker.
A public register of regulatory fines issued under EU compliance directives. Updated as decisions are published by national supervisory authorities.
5,273 entries
- Total fines
- €8.6bn
- Decisions
- 5,273
- Jurisdictions
- 33
- Regulators
- 74
- Avg monthly
- €162.7m
- YoY volume
- -20.7%
| Imposed | Company | Country | Authority | Type | Amount | ↗ |
|---|---|---|---|---|---|---|
| 21 Feb 2025 | Österreichische Post AGThe Austrian Federal Administrative Court upheld a major GDPR fine against Österreichische Post AG for unlawful processing of political affinity data and other personal data used in direct marketing. The court reduced the penalty from EUR 18 million to EUR 16 million, while confirming the underlying data protection breaches. | AT | Österreichische Datenschutzbehörde | GDPR | €16,000,000 | ↗ |
| 12 Dec 2023 | B*** GmbHB*** GmbH was fined by the DSB EUR 5,900 for failing to timely report a data breach to the supervisory authority and for not providing sufficient information required under GDPR. The company also did not cooperate with the authority’s further requests for information. | AT | DSB | GDPR | €5,900 | ↗ |
| 16 Aug 2024 | D*** Handels Ges.m.b.H.D*** Handels Ges.m.b.H. was fined by the DSB for unlawfully processing personal data through a video surveillance system without a legal basis. The authority also found a breach of the data minimization principle. | AT | DSB | GDPR | €1,500,000 | ↗ |
| 07 Oct 2024 | B*** GmbHB*** GmbH was fined EUR 600 by the Austrian Data Protection Authority (DSB). The penalty concerned a failure to cooperate in a data breach procedure, which breached Article 31 GDPR. | AT | DSB | GDPR | €600 | ↗ |
| 04 Sept 2025 | A*** GmbHA*** GmbH did not report a personal data breach to the Austrian Data Protection Authority within the 72-hour deadline required by Article 33 GDPR. As a result, a fine of EUR 870 was imposed. | AT | DSB | GDPR | €870 | ↗ |
| 05 Feb 2025 | FacharztThis case concerns a confirmed fine by the Austrian Federal Administrative Court (BVwG) against Facharzt for disclosing health data in an online review. The conduct indicates a breach of personal data protection rules involving medical information. | AT | Bundesverwaltungsgericht (BVwG) | GDPR | €4,500,000 | ↗ |
| 27 Oct 2025 | Anonymisiert (DSB 2025-0.811.087)The controller unlawfully processed personal data through video surveillance, including public sidewalk areas, contrary to data minimization principles. Images were also published online without a legal basis. | AT | DSB | GDPR | €1,500 | ↗ |
| 16 Jun 2023 | Anonymisiert (DSB 2023-0.404.421)An individual processed personal data without a legal basis by storing contact details on a private phone for political advertising. The DSB imposed a EUR 1,000 fine for breaching GDPR lawfulness requirements. | AT | DSB | GDPR | €1,000 | ↗ |
| 12 Feb 2021 | A*** GmbHA*** GmbH was fined by the Austrian Data Protection Authority for failing to cooperate in three separate complaint procedures. The authority found a breach of Article 31 GDPR, which requires cooperation with the supervisory authority. | AT | DSB | GDPR | €3,000 | ↗ |
| 05 Aug 2021 | Anonymisiert (DSB 2021-0.518.795)An individual was fined for unlawfully processing and disclosing health-related personal data of a kindergarten teacher. The violation consisted of sending an email with sensitive information to her employer. | AT | DSB | GDPR | €600 | ↗ |
| 18 Nov 2025 | Anonymisiert (DSB 2025-0.902.556)The responsible party unlawfully published parts of a private complaint on a social media platform. This breached data minimization principles and there was no legal basis for processing personal data. | AT | DSB | GDPR | €1,200 | ↗ |
| 03 Jun 2025 | B*** Parkraumbewirtschaftung Ges.m.b.H.The company was fined by the Austrian Data Protection Authority (DSB) for failing to cooperate during the investigation. It did not respond to multiple requests for statements or to a summons for an oral hearing, which constitutes a breach of Article 31 GDPR. | AT | DSB | GDPR | €16,000 | ↗ |
| 04 Jan 2024 | N*** -FußballvereinigungThe football association failed to implement appropriate technical and organizational measures for handling data deletion requests. The authority found breaches of Articles 25 and 17 GDPR and imposed a fine of EUR 11,000. | AT | DSB | GDPR | €11,000 | ↗ |
| 20 Dec 2018 | Anonymisiert (DSB DSB-D550.037/0003-DSB/2018)The DSB imposed a fine of EUR 2,200 for unlawful video surveillance covering common areas and neighboring properties without consent. The conduct breached GDPR principles of data minimization and purpose limitation. | AT | DSB | GDPR | €2,200 | ↗ |
| 11 Jul 2019 | Thomas N****The individual secretly recorded video footage of two women in a changing room without their consent. The DSB found this to be a breach of GDPR rules on lawful processing and consent. | AT | DSB | GDPR | €10,000 | ↗ |
| 16 Oct 2024 | D**** GmbHThe company appointed its managing director as the data protection officer, creating a conflict of interest. The DSB found this breached Article 38(6) GDPR and imposed a fine of EUR 5,000. | AT | DSB | GDPR | €5,000 | ↗ |
| 11 Dec 2023 | C*** Bank AGC*** Bank AG was fined by the DSB EUR 9,500 for breaching Article 15 GDPR. The bank treated an access request as a deletion request and deleted the data instead of providing the requested information. | AT | DSB | GDPR | €9,500 | ↗ |
| 29 Jun 2023 | Anonymisiert (DSB 2023-0.420.407)The responsible party unlawfully processed special categories of personal data by publishing health data in response to an online review. This breached GDPR principles of lawfulness, purpose limitation, and data minimization. | AT | DSB | GDPR | €10,000 | ↗ |
| 19 Oct 2020 | Anonymisiert (DSB 2020-0.550.322)An individual was fined for unlawfully processing image data by using a smartphone to record a person in a restroom. The authority found a breach of the principles of lawfulness, fairness, and transparency under Art. 5 GDPR and no legal basis under Art. 6 GDPR. | AT | DSB | GDPR | €150 | ↗ |
| 12 Dec 2024 | Anonymisiert (DSB 2024-0.796.258)The individual unlawfully processed intimate photos by transferring and storing them without the data subject’s consent. This breached GDPR principles of lawfulness, purpose limitation, and data minimization. | AT | DSB | GDPR | €2,000 | ↗ |