Compliance Radar
Who was sanctioned, and for what?
Fines, court rulings and incidents from Europe, North America, Latin America and Asia-Pacific: 1,847 cases from 39 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.
Click a bar to drill down one level.
Where?
by regionAll jurisdictions
What for?
by topicWho?
by company- Anonymised companies €5.17m 28 % · 10 cases
- IQVIA Operations France €5m 27 % · 1 case
- Australian Clinical Labs Limited €3.28m 18 % · 1 case
- 23andMe, Inc. €2.74m 15 % · 1 case
- IDCQ Hospitales y Sanidad, S.L.U. €1.2m 7 % · 1 case
- Hôpital Privé de la Loire €500,000 3 % · 1 case
- Health Service Executive (HSE) €300,000 2 % · 1 case
- Γενικό Νοσοκομείο Θεσσαλονίκης Γ. Γεννηματάς «Ο Άγιος Δημήτριος» (Allgemeines Krankenhaus Thessaloniki G. Gennimatas – Agios Dimitrios) €25,000 0 % · 1 case
- Azienda Sanitaria Universitaria Friuli Centrale (ASUFC) €24,000 0 % · 1 case
- Specer sp. z o.o. €2,669 0 % · 1 case
- 8 more€3,273
When?
per quarter, by date of decision| Period | Cases | Total |
|---|---|---|
| Q4 2023 | 0 | – |
| Q1 2024 | 0 | – |
| Q2 2024 | 0 | – |
| Q3 2024 | 0 | – |
| Q4 2024 | 0 | – |
| Q1 2025 | 0 | – |
| Q2 2025 | 0 | – |
| Q3 2025 | 0 | – |
| Q4 2025 | 1 | €1.2m |
| Q1 2026 | 0 | – |
| Q2 2026 | 0 | – |
| Q3 2026 | 0 | – |
| Q4 2026 | 0 | – |
1 case
21 Nov 2025 IDCQ Hospitales y Sanidad, S.L.U.AEPD: €1.2m fine for hospital operator IDCQ over disposed patient scans €1.2m
A hospital of the group had removed from its archive earlier MRI scans that a patient had brought in for comparison once an internal collection period had expired, so that they were no longer available. The AEPD imposed 100,000 EUR each for processing health data without a legal basis (Art. 9 and Art. 6) and 1,000,000 EUR for lack of data protection by design in the procedure (Art. 25), 1,200,000 EUR in total.
Documents handed over by patients are health data and must not be destroyed under internal clear-out deadlines.
Handling health records handed over by patients
- Authority / court
- Agencia Española de Protección de Datos (AEPD)
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- Art. 6, 9, 25 DSGVO
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Healthcare
- Published
- 20 Mar 2026
- AEPD, Resolución PS/00288/2024 (EXP202402851), IDCQ Hospitales y Sanidad Decision of an authority
- BOE: Resolución de 4 de marzo de 2026 der AEPD, Sanktionen über 1 Mio. Euro Official register or notice
Checked against the official source on 28 Sep 2026 · Direct link