Home / Fine records CNIL, France 1 Organisation sector Mobile phone operator 1 Outcome or appeal status Fine and injunction, 8 January 2026, for retention, security and breach notice to individuals 1 Source CNIL sanctions list 1 CNIL, France 1 Organisation sector Fixed-line operator 1 Outcome or appeal status Fine and injunction, 8 January 2026, for security and breach notice to individuals 1 Source CNIL sanctions list 1 CNIL, France 1 Organisation sector Public administrative establishment 1 Outcome or appeal status Fine and injunction, 22 January 2026, for data security 1 Source CNIL sanctions list 1 CNIL, France 1 Organisation sector Ministry 1 Outcome or appeal status Reprimand and injunction, 12 March 2026 1 Source CNIL sanctions list 1 CNIL, France 1 Organisation sector Company running several online services 1 Outcome or appeal status Fine and injunction, 1 September 2025, for cookies and e-prospecting consent 1 Source CNIL sanctions list 1 CNIL, France 1 Organisation sector Online clothing and footwear retailer 1 Outcome or appeal status Fine, 1 September 2025, for cookies information and consent 1 Source CNIL sanctions list 1 CNIL, France 1 Organisation sector Tertiary sector company 1 Outcome or appeal status Fine, 30 December 2025, for lawfulness, information, impact assessment, security and cookies 1 Source CNIL sanctions list 1 CNIL, France 1 Organisation sector IT systems consulting company 1 Outcome or appeal status Fine, 22 December 2025, for data security 1 Source CNIL sanctions list 1 CNIL, France 1 Organisation sector Deferred debit payment card issuer 1 Outcome or appeal status Fine, 27 November 2025, for cookies consent 1 Source CNIL sanctions list 1 CNIL, France 1 Organisation sector Marketing tools developer acting as processor 1 Outcome or appeal status Fine, 11 December 2025, for retention and unauthorised sub-processing 1 Source CNIL sanctions list 1 CNIL, France 1 Organisation sector Marketing and web design company 1 Outcome or appeal status Fine and injunction, 15 May 2025, for e-prospecting consent 1 Source CNIL sanctions list 1 CNIL, France 1 Organisation sector Magazine publisher and advertising agency 1 Outcome or appeal status Fine, 20 November 2025, for cookies consent and information 1 Source CNIL sanctions list 1 CNIL, France 1 Organisation sector Call centre company 1 Outcome or appeal status Fine, 16 October 2025, for minimisation, retention and security 1 Source CNIL sanctions list 1 CNIL, France 1 Organisation sector Municipality 1 Outcome or appeal status Fine and reprimand, 11 September 2025, simplified procedure 1 Source CNIL sanctions list 1 CNIL, France 9 Organisation sector Google, online services 9 Outcome or appeal status Upheld by the Conseil d'État, 19 June 2020 9 Source Conseil d'État decision 9 DPC, Ireland 2 Organisation sector TikTok 2 Outcome or appeal status One final decision of 30 April 2025 with two fines totalling €530 million, appealed by TikTok 2 Source DPC Annual Report 2025 2 DPC, Ireland 2 Organisation sector Government department, Social Protection 2 Outcome or appeal status Fine and reprimand, 9 June 2025, appealed by the department 2 Source DPC Annual Report 2025 2 DPC, Ireland 2 Organisation sector Education and training board, Dublin 2 Outcome or appeal status Fine of 18 June 2025 confirmed in the Dublin Circuit Court and collected 2 Source DPC Annual Report 2025 2 DPC, Ireland 2 Organisation sector University 2 Outcome or appeal status Fine and reprimand, 11 December 2025 2 Source DPC Annual Report 2025 2 DPC, Ireland 3 Organisation sector Google, location data 3 Outcome or appeal status Fines and order to comply within 6 months, announced 21 September 2026 3 Source DPC press release 3 DPC, Ireland 4 Organisation sector Public health service, HSE 4 Outcome or appeal status Fines, reprimand and orders, notified 25 August 2026 4 Source DPC press release 4 DPC, Ireland 5 Organisation sector WhatsApp, messaging service 5 Outcome or appeal status Fine raised after an EDPB binding decision of 28 July 2021, with reprimand and order 5 Source DPC press release 5 Datatilsynet, Norway 6 Organisation sector Advertising technology 6 Outcome or appeal status Final decision 2 October 2026 on a 2020 complaint 6 Garante, Italy 7 Organisation sector Security services company 7 Outcome or appeal status Final decision 6 August 2026 on access rights and employee information 7 Garante, Italy 11 Organisation sector OpenAI 11 Amount €15,000,000, as reported by Punto Informatico 11 Outcome or appeal status Annulled by the Tribunale di Roma, as reported on 20 March 2026 11 Source Punto Informatico 11 BfDI, Germany 8 Organisation sector Company with call-centre authentication failings 8 Outcome or appeal status Reduced to €900,000 by the Landgericht Bonn, 11 November 2020 8 Source Landgericht Bonn judgment 8 Berlin data protection authority, Germany 14 Organisation sector Deutsche Wohnen SE 14 Outcome or appeal status Berlin fine of 30 October 2019 at issue. EU Court of Justice preliminary ruling of 5 December 2023 on conditions for fining companies 14 Source CJEU judgment C-807/21 14 CNPD, Luxembourg 10 Organisation sector Amazon, behavioural advertising case 10 Amount €746,000,000, as reported by Chronicle.lu 10 Outcome or appeal status Annulled by the Administrative Court, 12 March 2026, as reported by Chronicle.lu 10 ICO, United Kingdom 12 Organisation sector Clearview AI Inc 12 Outcome or appeal status Set aside by the First-tier Tribunal on 17 October 2023, Upper Tribunal allowed the ICO appeal and remitted the case 12 Source Upper Tribunal judgment 12 ICO, United Kingdom 13 Organisation sector Clearview AI Inc 13 Amount £7.5m as stated by the ICO 13 Outcome or appeal status Clearview given permission to appeal to the Court of Appeal, December 2025 13 OAIC, Australia 15 Organisation sector Pathology provider, Australian Clinical Labs 15 Outcome or appeal status Civil penalties ordered by the Federal Court, October 2025 15 Source OAIC media release 15 PIPC, South Korea 16 Organisation sector SK Telecom, telecoms 16 Amount 134.8 billion won, as reported by Light Reading 16 Outcome or appeal status Judicial review sought in the Seoul Administrative Court, January 2026, pending as reported by Light Reading 16 HHS OCR, United States 17 Organisation sector Ambry Genetics, HIPAA-regulated entity 17 Outcome or appeal status Resolution agreement, 17 September 2026, after a phishing attack 17 Source HHS resolution agreements 17 Information Regulator, South Africa 18 Organisation sector First National Bank, banking 18 Outcome or appeal status Infringement notice signed 21 October 2026, 30 days to pay, arrange instalments or elect court 18 Source Infringement notice 18 Information Regulator, South Africa 19 Organisation sector Public TVET college 19 Outcome or appeal status Infringement notice signed 9 October 2026 for failing to comply with an enforcement notice 19 Source Infringement notice 19 ODPC, Kenya 20 Organisation sector Oppo Kenya 20 Outcome or appeal status Penalty notice of 21 December 2022 for not complying with an enforcement notice 20 Source ODPC press release 20 NDPC, Nigeria 21 Organisation sector Seven firms, four banks and three other institutions 21 Amount N400 million in total, as reported by Techeconomy 21 Outcome or appeal status Fines reported in June 2024, firms not named 21 Nothing matches. Clear the search or pick another filter.
Notes Amounts are in the currency the regulator used. Rows are not converted or added up 1 ,2 The NDPC row comes from a news report. The NDPC Annual Report 2025 does not list fines by company 21 The HHS page states an amount only for some agreements. Rows are included only where an amount was published 17 The SK Telecom, Amazon and OpenAI amounts come from press reports. The regulator's own decision was not opened for these rows 10 ,11 ,16 Rules and charges change. Check the official source linked on this page before you pay or travel. Spotted an error? Email hello@breachandfinetracker.com .
Sources CNIL: Les sanctions prononcées par la CNIL (14 April 2026) Data Protection Commission: Annual Report 2025 (undated) Data Protection Commission: Data Protection Commission fines Google €403 million following Inquiry into Google's processing of location data (21 September 2026) Data Protection Commission: Data Protection Commission announces Final Decision following Inquiry into the Health Service Executive (HSE) (2 September 2026) Data Protection Commission: Data Protection Commission announces decision in WhatsApp inquiry (2 September 2021) European Data Protection Board: Norwegian DPA fines Xandr EUR 8 600 000 for unlawful processing of personal data (16 October 2026) European Data Protection Board: Italian DPA fines security company EUR 39 000 for violations concerning employees' data (9 October 2026) Landgericht Bonn: Urteil 29 OWi 1/20 (11 November 2020) Conseil d'État: RGPD, le Conseil d'État rejette le recours dirigé contre la sanction de 50 millions d'euros infligée à Google par la CNIL (19 June 2020) Chronicle.lu: Luxembourg Court Annuls CNPD Ruling in Amazon Data Protection Case (14 March 2026) Punto Informatico, Luca Colantuoni: OpenAI, annullata la multa per violazione della privacy (20 March 2026) The National Archives, Find Case Law: The Information Commissioner v Clearview AI Incorporated, 2025 UKUT 319 (AAC) Information Commissioner's Office: UK Upper Tribunal hands down judgment on Clearview AI Inc (8 October 2025, updated 19 December 2025) EUR-Lex: Judgment of the Court (Grand Chamber), Deutsche Wohnen SE v Staatsanwaltschaft Berlin, Case C-807/21 (5 December 2023) OAIC: Australian Clinical Labs ordered to pay penalties in relation to Medlab Pathology data breach in first for Privacy Act (9 October 2025) Light Reading, Gigi Onag: SKT challenges $91M data breach fine in court (20 January 2026) HHS: Resolution Agreements Information Regulator: Infringement Notice, First National Bank (21 October 2026) Information Regulator: Infringement Notice, Central Johannesburg TVET College (9 October 2026) Office of the Data Protection Commissioner: Office Of The Data Protection Commissioner Issues A Penalty Notice Against Oppo Kenya (21 December 2022) Techeconomy, Joan Aimuengheuwa: NDPC Imposes N400 Million Fines on Seven Firms for Data Breaches (12 June 2024) 