Compliance Radar
Who was sanctioned, and for what?
Fines, court rulings and incidents from Europe, North America, Latin America, Asia-Pacific, Middle East and Africa: 2,207 cases from 44 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.
Click a bar to drill down one level.
Where?
by regionAll jurisdictions
What for?
by topic- Data breaches and data security €22m 49 % · 15 cases
- Marketing and consent €19.2m 43 % · 43 cases
- Data subject rights and transparency €1.91m 4 % · 9 cases
- no topic €1.13m 3 % · 4 cases
- Employee data €306,680 1 % · 4 cases
- Video surveillance €25,839 0 % · 3 cases
- International data transfers €4,000 0 % · 1 case
- Cookies and tracking – 0 % · 1 case
Who?
by company- Capita plc und Capita Pension Solutions Limited €16.1m 36 % · 1 case
- Ö Aktiengesellschaft (in der Entscheidung abgekürzt; Adressverlag und Direktwerbeunternehmen) €13m 29 % · 1 case
- Anonymised companies €9.42m 21 % · 43 cases
- Informa D&B, S.A. €1.8m 4 % · 1 case
- Profisportorganisation, Spanien (anonymisiert) €1m 2 % · 1 case
- Solocal Marketing Services €900,000 2 % · 1 case
- Marketing-Unternehmen, UK (anonymisiert) €346,600 1 % · 1 case
- Callcenter (anonymisiert) €259,327 1 % · 2 cases
- National Amusements, Inc. €235,206 1 % · 1 case
- Marina Bay Sands Pte. Ltd. €208,955 0 % · 1 case
- 27 more€1.3m
When?
per year, by date of decision| Period | Cases | Total |
|---|---|---|
| 2022 | 9 | €891,848 |
| 2023 | 21 | €2.66m |
| 2024 | 20 | €7.49m |
| 2025 | 16 | €19.7m |
| 2026 | 14 | €13.8m |
80 cases
19 Aug 2026 Poliserv JG (PJG) SRLPhishing on admin account – Poliserv JG must pay 3,000 EUR €2,998
Attackers obtained the credentials of a user account with administrator rights through phishing and accessed customer data. The Romanian data protection authority (ANSPDCP) criticised the lack of technical and organisational measures and of regular effectiveness testing, imposed 15,728 lei (3,000 EUR) and ordered regular employee training, including on recognising phishing e-mails. Date = publication of the press release; according to the authority, the investigation was concluded in the previous month.
Admin accounts need MFA, and all employees must be able to recognise phishing – the supervisory authority now expressly orders training.
Phishing recognition, protection of privileged accounts
Missing or inadequate training played a role in the decision.
- Authority / court
- Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- Art. 32 Abs. 1 lit. b und Abs. 2 DSGVO
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Other
- Published
- 19 Aug 2026
Original amount 15,728 RON, converted at the ECB reference rate of 19 Aug 2026.
- ANSPDCP – Comunicat de presă 19.08.2026 (Poliserv JG (PJG) SRL) Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
6 Aug 2026 AMATO BESTSELLER S.R.L.AMATO BESTSELLER: 45,000 EUR plus 50,000 lei for data access and robocalls €54,316
Following several complaints, the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (Romanian data protection authority, ANSPDCP) found that current and former employees, untrained and without procedural rules, had access to extensive data (including health, family and income data), that data subjects were not informed under Art. 14 GDPR, that excessive data were collected and that automated advertising calls were made without consent. Fines: 78,465 lei (15,000 EUR, Art. 32(4)), 52,310 lei (10,000 EUR, Art. 14), 104,620 lei (20,000 EUR, Art. 5/9 GDPR) and 50,000 lei (Law 506/2004); in addition, an order to provide regular employee training. Date = publication of the press release; according to the authority, the investigation was concluded in June 2026.
Anyone giving employees access to sensitive customer data must train them and limit access on a need-to-know basis.
Training employees in handling customer data; consent for advertising calls
Missing or inadequate training played a role in the decision.
- Authority / court
- Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
- Area of law
- Data protection · Marketing and consent
- Legal basis
- Art. 5 Abs. 1 lit. c i. V. m. Art. 9, Art. 14, Art. 32 Abs. 4 DSGVO; Art. 12 Abs. 1 Gesetz 506/2004
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Other
- Published
- 6 Aug 2026
Original amount 285,395 RON, converted at the ECB reference rate of 6 Aug 2026.
- ANSPDCP – Comunicat de presă 06.08.2026 (AMATO BESTSELLER S.R.L.) Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
24 Jul 2026 Callcenter (anonymisiert)BNetzA: €34,327 fine on call centre, including for incomplete records of consent €34,327
The Bundesnetzagentur (Federal Network Agency) imposed fines totalling 34,327 EUR on a call centre that mainly marketed telecoms products: 32,000 EUR for unlawful telephone advertising and 2,327 EUR because consents to sales calls had not been fully documented. The campaign continued despite the gaps and requests to stop calling were sometimes ignored; the company has appealed.
Consents to telephone marketing must be fully documented – if the proof is missing, the campaign must not continue.
Consent and proof of consent for telephone marketing
- Authority / court
- Bundesnetzagentur (BNetzA)
- Area of law
- Data protection · Marketing and consent
- Legal basis
- UWG – Verbot unerlaubter Telefonwerbung gegenüber Verbraucherinnen und Verbrauchern; § 7a UWG (Dokumentation und Aufbewahrung von Einwilligungen)
- Action
- Fine
- Status of proceedings
- under appeal
- Sector
- Other
- BNetzA: Bußgelder Unerlaubte Telefonwerbung (laufende Liste mit Einzelmeldungen) Enforcement database of an authority
Checked against the official source on 2 Oct 2026 · Direct link
Report an error
24 Jun 2026 Ö Aktiengesellschaft (in der Entscheidung abgekürzt; Adressverlag und Direktwerbeunternehmen)VwGH sets data protection fine for party affinities definitively at 13 million EUR €13m
The company had stored statistically calculated ‘party affinities’ for around 2.2 million people and in some cases sold them to advertising clients – special categories of personal data without consent; in addition, parcel frequency data was further processed for incompatible purposes. The Austrian Data Protection Authority (Datenschutzbehörde, DSB) had imposed 18 million EUR in 2019 and the Federal Administrative Court (Bundesverwaltungsgericht, BVwG) 16 million EUR in 2024; Austria's Supreme Administrative Court (Verwaltungsgerichtshof, VwGH) has now set the fine with final effect at 13 million EUR (plus 100,000 EUR in procedural costs).
Calculated characteristics such as political leanings are themselves special categories – companies that derive them for advertising need explicit consent.
- Authority / court
- Verwaltungsgerichtshof (Ausgangsbescheid: Datenschutzbehörde)
- Area of law
- Data protection · Marketing and consent
- Legal basis
- DSGVO Art. 5 Abs. 1 lit. a und b, Art. 6 Abs. 4, Art. 9 Abs. 1 (VwGH Ro 2025/04/0007)
- Action
- Fine
- Status of proceedings
- reduced
- Sector
- Other
- Culpability
- negligent
- Mitigating circumstances
- Comprehensive cooperation, deletion of the party affinities, settlements with data subjects, long duration of proceedings (5 years, 10 months).
- Published
- 16 Jul 2026
- VwGH 24.06.2026, Ro 2025/04/0007 Court decision
- VwGH bestätigt unrechtmäßige Verarbeitung von Partei-Affinitäten und setzt Geldbuße mit EUR 13 Mio. fest Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
15 Jun 2026 SSG SELECT SOLUTIONS S.R.L.Stranger in Kaufland CCTV room – service provider SSG Select Solutions pays 2,000 EUR €1,948
An employee of the service provider acting as processor for Kaufland România let a third party into a store’s video surveillance room; that person filmed the images and distributed them on social media. Kaufland reported the incident. The Romanian data protection authority (ANSPDCP) imposed 10,200 lei (2,000 EUR) on the processor and ordered additional checks of the work instructions; the fine has been paid. Date = publication of the press release; according to the authority, the investigation was concluded in April 2026.
Anyone with access to surveillance rooms must know: video footage is confidential, and third parties have no access there.
Access to surveillance rooms; staff bound by instructions
- Authority / court
- Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
- Area of law
- Data protection · Video surveillance
- Legal basis
- Art. 29, Art. 32 Abs. 1 lit. b, Abs. 2 und 4 DSGVO
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Other
- Published
- 15 Jun 2026
Original amount 10,200 RON, converted at the ECB reference rate of 15 Jun 2026.
- ANSPDCP – Comunicat de presă 15.06.2026 (SSG SELECT SOLUTIONS S.R.L.) Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
20 May 2026 Marketing-Unternehmen, UK (anonymisiert)ICO: £300,000 fine for a marketing firm over spam and fake bailiff texts €346,600
The ICO fined a UK marketing company £300,000 and issued an enforcement notice. The ICO found that the company had sent more than 5.5 million unsolicited marketing text messages, including messages styled as if they came from bailiffs. The 7726 spam reporting service received over 60,000 complaints. The ICO relied on regulations 22 and 23 of PECR (electronic marketing without consent and concealed sender identity).
- Authority / court
- Information Commissioner's Office (ICO)
- Area of law
- Data protection · Marketing and consent
- Legal basis
- Regulations 22 und 23 PECR; section 55A DPA 1998
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Other
Original amount 300,000 GBP, converted at the ECB reference rate of 20 May 2026.
Checked against the official source on 28 Sep 2026 · Version 2 · Direct link
Report an error
23 Apr 2026 Yau Yat Chuen Garden City Club LimitedRansomware via remote maintenance access: enforcement notice against private club Order
In a ransomware attack on the membership management system of Yau Yat Chuen Garden City Club Limited, a private, non-profit recreational club, reported on 31 October 2025, data of 9,045 current and former members and supplementary card holders were affected, including identity card or passport numbers. The attacker exploited a known vulnerability in outdated remote access software of the external service provider and reached the server, which had been left logged in, without further authentication; antivirus software and firewall were outdated, and personal data had been kept longer than necessary. In its investigation report published on 23 April 2026 the PCPD (Privacy Commissioner for Personal Data, Hong Kong's data protection authority) found breaches of DPP 4(1) and DPP 2(2) and served an enforcement notice.
Service providers' remote maintenance access belongs in an organisation's own security concept: current software, additional authentication and no servers left permanently logged in.
Service providers' remote access, patch management and retention periods
- Authority / court
- Privacy Commissioner for Personal Data (PCPD), Hongkong
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- Personal Data (Privacy) Ordinance, Data Protection Principles 4(1) und 2(2); Enforcement Notice
- Action
- Order
- Status of proceedings
- unknown
- Sector
- Other
- Published
- 23 Apr 2026
Checked against the official source on 3 Oct 2026 · Direct link
Report an error
9 Apr 2026 Arbeitgeber (in der Mitteilung nicht namentlich genannt)Slovenia: 71,474 EUR for covert monitoring of employees using spyware €71,474
An employer installed the software Spyrix Employee Monitoring on the work computers of individual employees, which for months recorded screen content, audio and even private e-mails and conversations without informing the employees. The supervisory authority, the Informacijski pooblaščenec (Information Commissioner of the Republic of Slovenia, IP), imposed 71,474 EUR on the company.
Covert employee monitoring by software is practically never permissible – IT and managers must know this before tools are installed.
Permissible monitoring of employees and IT use
- Authority / court
- Informacijski pooblaščenec Republike Slovenije (IP)
- Area of law
- Data protection · Employee data
- Legal basis
- Art. 5 und Art. 6 Abs. 1 DSGVO
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Other
- Culpability
- intentional
- Liability of senior managers
- Measures against individuals are not reported here.
- Published
- 9 Apr 2026
- Delodajalcu, ki je prikrito nadzoroval vse aktivnosti zaposlenih na računalnikih, izrečena globa več kot 70.000 EUR Press release of an authority
Checked against the official source on 28 Sep 2026 · Version 2 · Direct link
Report an error
24 Mar 2026 SIA "Fitsypro"Fitsypro fails to answer access request and DVI enquiries – 1,500 EUR €1,500
A person complained that Fitsypro had not responded to their request for access, rectification and erasure of November 2023. Three requests for information from the Datu valsts inspekcija (Latvian Data State Inspectorate, DVI) between 2024 and 2026 went unanswered, and nobody attended the hearing. The DVI imposed 1,500 EUR and requested the information by 21 April 2026.
Official mailboxes (eAdrese) and data protection e-mail addresses must be monitored – silence towards the supervisory authority costs money.
Handling data subject requests and correspondence from authorities
- Authority / court
- Datu valsts inspekcija (DVI)
- Area of law
- Data protection · Data subject rights and transparency
- Legal basis
- Art. 58 Abs. 1 lit. e, Art. 83 Abs. 5 lit. e DSGVO
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Other
- Culpability
- intentional
- DVI Lēmums Par soda piemērošanu (SIA „Fitsypro“), 24.03.2026 Decision of an authority
- Datu valsts inspekcija – Lēmumi (Liste der veröffentlichten Entscheidungen) Official register or notice
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
12 Mar 2026 Direktmarketing-Unternehmen, UK (anonymisiert)ICO: £130,000 fine for a direct marketing firm over calls to TPS numbers €150,737
In March 2026 the ICO fined a small UK direct marketing company £130,000 and also served an enforcement notice. According to the ICO, over almost eleven months in 2024 the company had staff make more than 230,000 marketing calls to lines that had been on the UK's opt-out register for sales calls (Telephone Preference Service, TPS) for over 28 days, prompting 12 complaints. The ICO treated this as a breach of regulation 21 of PECR.
- Authority / court
- Information Commissioner's Office (ICO)
- Area of law
- Data protection · Marketing and consent
- Legal basis
- Regulations 21 und 24 PECR; section 55A DPA 1998
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Other
Original amount 130,000 GBP, converted at the ECB reference rate of 12 Mar 2026.
Checked against the official source on 28 Sep 2026 · Version 2 · Direct link
Report an error
10 Mar 2026 World Anti-Doping Agency (WADA)WADA: compliance agreement with Canada's Privacy Commissioner on athletes' data Other
The Montreal-based World Anti-Doping Agency (WADA), a foundation under Swiss private law, entered into a compliance agreement under PIPEDA with the Privacy Commissioner of Canada, under which an investigation opened in November 2024 following a complaint is held in abeyance and will be discontinued once the agreement is fulfilled. WADA must ensure that anti-doping organisations use athletes' personal information in the ADAMS system only for anti-doping purposes from 1 January 2027, amend the World Anti-Doping Code and the ADAMS agreements accordingly, document a control mechanism and report quarterly. WADA disputes any contravention and the Commissioner's jurisdiction; if it fails to comply, the Commissioner may apply to the Federal Court for an order.
Operators of data platforms used by partners must enforce, contractually and technically, that partners use the data only for the intended purpose.
Purpose limitation on shared data platforms
- Authority / court
- Office of the Privacy Commissioner of Canada (OPC)
- Area of law
- Data protection
- Legal basis
- Personal Information Protection and Electronic Documents Act (PIPEDA), Sections 17.1 und 17.2 (Compliance Agreement)
- Action
- Other
- Status of proceedings
- unknown
- Sector
- Other
- Published
- 17 Mar 2026
Checked against the official source on 3 Oct 2026 · Direct link
Report an error
2 Mar 2026 Nordic Cleaning ApSNordic Cleaning: fine for leaving access request unanswered despite an order €8,031
Despite repeated follow-ups by the trade union, the cleaning company did not respond to a union member’s access request and also failed to comply with the order of the Danish Data Protection Agency (Datatilsynet) to decide on the request. Datatilsynet reported the company; the case was closed on 2 March 2026 with a fine notice of 60,000 DKK.
Access requests and orders from authorities need a fixed intake channel and a responsible person – ignoring them leads straight to a criminal complaint.
Handling access requests (Art. 15 GDPR)
- Authority / court
- Anklagemyndigheden (Bødeforelæg) auf Anzeige der Datatilsynet
- Area of law
- Data protection · Data subject rights and transparency
- Legal basis
- DSGVO Art. 15; Nichtbefolgung einer Anordnung der Datatilsynet; databeskyttelsesloven
- Action
- Fine
- Status of proceedings
- final
- Sector
- Other
Original amount 60,000 DKK, converted at the ECB reference rate of 2 Mar 2026.
- Datatilsynet – Klein2 ApS og Nordic Cleaning ApS indstilles til bøde (Opdatering: afgjort 2. marts 2026) Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
3 Feb 2026 TMAC LtdICO: £100,000 fine for TMAC over marketing calls to TPS numbers €115,969
The ICO fined TMAC Ltd £100,000 and issued an enforcement notice. The ICO found that between 8 February and 24 September 2024 the company made 260,332 unsolicited marketing calls to numbers registered with the Telephone Preference Service (TPS). Recipients were also not given the caller details required by regulation 24 of PECR. The legal basis is regulations 21 and 24 of PECR.
- Authority / court
- Information Commissioner's Office (ICO)
- Area of law
- Data protection · Marketing and consent
- Legal basis
- Regulations 21(1)(b) und 24 PECR; section 55A DPA 1998
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Other
Original amount 100,000 GBP, converted at the ECB reference rate of 3 Feb 2026.
- ICO Enforcement: TMAC Ltd (MPN). Enthält Informationen des Information Commissioner's Office, lizenziert unter der Open Government Licence v3.0. Enforcement database of an authority
- Monetary Penalty Notice: TMAC Ltd (3 February 2026) Decision of an authority
Checked against the official source on 28 Sep 2026 · Version 2 · Direct link
Report an error
19 Jan 2026 D*** GmbH (Digitalmarketing- und Recruitingagentur, anonymisiert)Recruitment agency: 25,500 EUR for secretly recorded calls with applicants €25,500
The agency conducted telephone pre-screening interviews with applicants on behalf of client companies, recorded them without valid consent, stored them indefinitely and presented itself as the client company in doing so. The Austrian Data Protection Authority (Datenschutzbehörde, DSB) imposed 25,500 EUR (plus 2,550 EUR in costs) for lack of a legal basis and transparency; the company has lodged an appeal against the amount of the fine with the Federal Administrative Court (Bundesverwaltungsgericht).
Call recordings in recruitment need a genuine legal basis and clear information about who is actually responsible.
Recording of telephone calls and applicant data
- Authority / court
- Datenschutzbehörde
- Area of law
- Data protection · Data subject rights and transparency
- Legal basis
- DSGVO Art. 5 Abs. 1 lit. a, c und e, Art. 6 Abs. 1, Art. 12, 13
- Action
- Fine
- Status of proceedings
- under appeal
- Sector
- Other
- Employees
- Under 50
- Mitigating circumstances
- No relevant previous violations, cooperation in the proceedings; adjustment of the starting amount to the company's small size.
- Datenschutzbehörde, Straferkenntnis 2025-1.049.138 vom 19.01.2026 Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
31 Dec 2025 ONE WAY PRIVATE COMPANYGreece: 80,000 EUR against call centre One Way over marketing calls for gas supplier €80,000
Following numerous complaints about marketing calls for the gas supplier ZENITH, the Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority) found that the call centre engaged had insufficient security measures and called persons without valid consent. By Decision 44/2025, One Way received 40,000 EUR each as processor and as controller, together with an order to delete the data of persons without valid consent; ZENITH and two other service providers were also held liable (10,000, 10,000 and 5,000 EUR).
Anyone outsourcing telemarketing must regularly carry out sample checks on call centres – and call centres are themselves liable for calls made without consent.
Checking consent before telemarketing
- Authority / court
- Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority)
- Area of law
- Data protection · Marketing and consent
- Legal basis
- Art. 5, 6, 7, 29, 32 DSGVO
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Other
- Repeat case
- yes
- Απόφαση 44/2025 της Αρχής Προστασίας Δεδομένων Προσωπικού Χαρακτήρα Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
30 Dec 2025 Rickenbacher Data LLC (Datamasters)CPPA: $45,000 against data broker Datamasters over failure to register €38,275
Without registering as a data broker, the Texas reseller traded in the names and contact details of millions of people, sorted by illnesses such as Alzheimer's or addiction, by age, presumed ethnicity and political views. In addition to the fine, the California Privacy Protection Agency (CPPA) requires it to stop selling data on all Californians.
Companies that buy or sell address lists for advertising must check registration obligations – health-related lists are particularly risky.
- Authority / court
- California Privacy Protection Agency (CPPA)
- Area of law
- Data protection · Marketing and consent
- Legal basis
- California Delete Act (Registrierungspflicht für Datenhändler)
- Action
- Fine
- Status of proceedings
- final
- Sector
- Other
- Published
- 8 Jan 2026
Original amount 45,000 USD, converted at the ECB reference rate of 30 Dec 2025.
- CalPrivacy Data Broker Enforcement Strike Force: enforcement actions Press release of an authority
- CPPA Order of Decision: Rickenbacher Data LLC d/b/a Datamasters (ENF25-172-D-DA) Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
11 Dec 2025 ZMLUK LimitedICO: £105,000 fine for ZMLUK over unsolicited marketing emails €119,986
The ICO fined ZMLUK Limited £105,000. The ICO found that the company had sent unsolicited marketing emails for energy-saving products; the notice gives the period as 1 January to 21 July 2023. The ICO found a serious breach of regulation 22 of PECR (electronic marketing without consent). Under the notice, timely payment reduces the amount by 20% to £84,000.
- Authority / court
- Information Commissioner's Office (ICO)
- Area of law
- Data protection · Marketing and consent
- Legal basis
- Regulation 22 PECR; section 55A DPA 1998
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Other
Original amount 105,000 GBP, converted at the ECB reference rate of 11 Dec 2025.
- ICO Enforcement: ZMLUK Limited. Enthält Informationen des Information Commissioner's Office, lizenziert unter der Open Government Licence v3.0. Enforcement database of an authority
- Monetary Penalty Notice: ZMLUK Ltd (11 December 2025) Decision of an authority
Checked against the official source on 28 Sep 2026 · Version 2 · Direct link
Report an error
18 Nov 2025 Callcenter mit Tätigkeitsschwerpunkt im Energiesektor (anonymisiert)BNetzA: €104,400 fine on call centre that posed as the customer's energy supplier €104,400
The Bundesnetzagentur (Federal Network Agency) fined a call centre focused on energy marketing 104,400 EUR for unlawful telephone advertising. Callers frequently posed falsely as the local energy provider or as the person's own supplier and tried to disguise the promotional nature of the calls.
Call centres need verifiable consent for every number they dial and must honour requests to stop calling immediately.
Consent and proof of consent for telephone marketing
- Authority / court
- Bundesnetzagentur (BNetzA)
- Area of law
- Data protection · Marketing and consent
- Legal basis
- UWG – Verbot unerlaubter Telefonwerbung gegenüber Verbraucherinnen und Verbrauchern
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Other
- BNetzA: Bußgelder Unerlaubte Telefonwerbung (laufende Liste mit Einzelmeldungen) Enforcement database of an authority
- BNetzA-Pressemitteilung 26.01.2026: Erneuter Anstieg der Beschwerdezahlen (Bußgelder 2025) Press release of an authority
Checked against the official source on 2 Oct 2026 · Direct link
Report an error
6 Nov 2025 Lead Pronto LtdICO: £30,000 fine for Lead Pronto over marketing texts about boiler grants €34,064
The ICO fined Lead Pronto Ltd £30,000 and issued an enforcement notice. The ICO found that the company had sent unsolicited text messages promoting government-funded boiler grants. The ICO found a serious breach of regulation 22 of PECR (electronic marketing without consent).
- Authority / court
- Information Commissioner's Office (ICO)
- Area of law
- Data protection · Marketing and consent
- Legal basis
- Regulation 22 PECR; section 55A DPA 1998
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Other
Original amount 30,000 GBP, converted at the ECB reference rate of 6 Nov 2025.
- ICO Enforcement: Lead Pronto Ltd (MPN). Enthält Informationen des Information Commissioner's Office, lizenziert unter der Open Government Licence v3.0. Enforcement database of an authority
- Monetary Penalty Notice: Lead Pronto Ltd (6 November 2025) Decision of an authority
Checked against the official source on 28 Sep 2026 · Version 2 · Direct link
Report an error
31 Oct 2025 Air Sino-Euro Associates Travel Pte. Ltd.Air Sino-Euro: 47,000 SGD – no data protection officer, no internal rules, data leak €31,252
After a cyberattack on the travel agency became public in December 2023, data on 336,759 individuals in its booking system was affected, in some cases including full images of identity cards, passports and birth certificates; part of the data was exfiltrated. The Personal Data Protection Commission (PDPC, Singapore's data protection authority) found negligent breaches of the Accountability Obligation – a data protection officer appointed only in April 2024, and apart from the customer-facing privacy policy no internal policies, no complaints process and no information to staff – and of the Protection Obligation, because there were no contracts with the IT vendors covering security tasks, no security reviews and no multi-factor authentication, and the server was still running the unsupported Windows Server 2012. It imposed 47,000 SGD, rejected objections based on COVID-19 losses and comparable cases, and directed among other things policies, security clauses in vendor contracts and a penetration test by a provider licensed by the Cyber Security Agency (CSA).
An outward-facing privacy policy is no substitute for a designated data protection officer or for internal rules that staff know and that apply in day-to-day work.
Internal data protection policies, communicating them to staff, and password rules
Missing or inadequate training played a role in the decision.
- Authority / court
- Personal Data Protection Commission (PDPC)
- Area of law
- Data protection · Data subject rights and transparency
- Legal basis
- Sections 11(3) und 12 PDPA 2012 (Accountability Obligation); Section 24 PDPA (Protection Obligation); Section 48J(1)(a) PDPA (Financial Penalty); Section 48I PDPA (Directions)
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Other
- Culpability
- negligent
- Mitigating circumstances
- Voluntary early admission of the breaches (treated as significantly mitigating) and prompt, effective remediation.
- Published
- 8 Jan 2026
Original amount 47,000 SGD, converted at the ECB reference rate of 31 Oct 2025.
- PDPC – Enforcement Decisions: Breach of the Accountability and Protection Obligations by Air Sino-Euro Associates Travel Pte Ltd (veröffentlicht 08.01.2026) Enforcement database of an authority
- PDPC – Decision [2025] SGPDPC [5], Air Sino-Euro Associates Travel Pte. Ltd., Case No. DP-2312-C1857 (31.10.2025), PDF Decision of an authority
Checked against the official source on 4 Oct 2026 · Direct link