Compliance Radar
Who was sanctioned, and for what?
Fines, court rulings and incidents from Europe, North America, Latin America, Asia-Pacific, Middle East and Africa: 2,207 cases from 44 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.
Click a bar to drill down one level.
Where?
by regionAll jurisdictions
What for?
by topic- Data subject rights and transparency €7,000 50 % · 1 case
- no topic €7,000 50 % · 1 case
- Employee data – 0 % · 1 case
Who?
by company- Anonymised companies – 0 % · 1 case
When?
per year, by date of decision| Period | Cases | Total |
|---|---|---|
| 2024 | 1 | – |
| 2025 | 2 | €14,000 |
| 2026 | 0 | – |
3 cases
16 Dec 2025 Luxembourg: 7,000 EUR against equipment manufacturer over incomplete record of processing €7,000
During an on-site inspection in November 2023, a Luxembourg manufacturer of technical equipment (pseudonymised in the decision as “Société A”) did not hand over its record of processing activities but only showed it in an online application; the record exported from the software the following day, with 40 entries, was incomplete and inaccurate, including as regards contact details, categories of data subjects and data, recipients and transfers to third countries. The CNPD (Commission nationale pour la protection des données, the Luxembourg data protection authority) imposed 7,000 EUR, issued a reprimand and ordered the record to be completed within two months.
Have your record of processing activities available on request and name recipients and third countries specifically – “group companies” or “service providers” is not enough.
Maintaining the record of processing activities
- Authority / court
- Commission nationale pour la protection des données (CNPD), formation restreinte
- Area of law
- Data protection · Data subject rights and transparency
- Legal basis
- DSGVO Art. 30 Abs. 1 lit. a, c, d, e
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Manufacturing and mechanical engineering
- Culpability
- negligent
- Délibération n° 7FR/2025 du 16 décembre 2025 – amende et autres mesures correctrices Decision of an authority
- Entscheidung 7FR/2025 (pseudonymisierte Fassung, PDF) Decision of an authority
Checked against the official source on 28 Sep 2026 · Direct link
Report an error
30 Apr 2025 Luxembourg engineering firm: 7,000 EUR for incomplete record of processing activities €7,000
In an audit campaign on records of processing activities, the Commission nationale pour la protection des données (Luxembourg data protection authority, CNPD) found that an engineering and design consultancy (pseudonymised as ‘Société A’) had omitted mandatory information such as name and contact details, categories of data subjects and data, and retention periods. It imposed 7,000 EUR.
The record of processing activities is the first thing supervisory authorities request – it must be complete, including retention periods.
- Authority / court
- Commission nationale pour la protection des données (CNPD) – formation restreinte
- Area of law
- Data protection
- Legal basis
- DSGVO Art. 30 Abs. 1 lit. a, c, f
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Manufacturing and mechanical engineering
- CNPD – Délibération n° 3FR/2025 du 30 avril 2025 (Société A) Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
4 Sep 2024 a Canadian printing companyPrinting company: CAI orders end to facial recognition in access control Order
During the pandemic in 2020 the printing company introduced an access control system with facial recognition and temperature checks for its employees, and kept using facial recognition after the temperature function was discontinued in October 2022. The Commission d'accès à l'information (CAI, Quebec's access to information and privacy commission) found that the company had not shown that collecting the biometric data was necessary for access control and ordered it, within 90 days, to stop collecting and using facial recognition and to destroy the biometric templates created.
Biometric access control for employees requires documented evidence that its benefits outweigh the intrusion into privacy.
Biometric access control in the workplace
- Authority / court
- Commission d'accès à l'information du Québec (CAI), section de surveillance
- Area of law
- Data protection · Employee data
- Legal basis
- Loi sur la protection des renseignements personnels dans le secteur privé (RLRQ c. P-39.1), Art. 4 (Notwendigkeit der Erhebung) und Art. 83
- Action
- Order
- Status of proceedings
- unknown
- Sector
- Manufacturing and mechanical engineering
- CAI, Entscheidungen der Überwachungssektion (Übersicht) (Entscheidung 2024) Enforcement database of an authority
Checked against the official source on 3 Oct 2026 · Company name anonymised since 4 Sep 2026 · Direct link