Compliance Radar
Who was sanctioned, and for what?
Fines, court rulings and incidents from Europe, North America, Latin America, Asia-Pacific, Middle East and Africa: 2,207 cases from 44 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.
Click a bar to drill down one level.
Where?
by regionAll jurisdictions
What for?
by topic- Data subject rights and transparency €100,000 97 % · 1 case
- no topic €2,784 3 % · 1 case
- Video surveillance – 0 % · 1 case
Who?
by company- Anonymised companies €100,000 97 % · 1 case
- Unternehmen für private Sicherheitsdienste (anonymisiert) €2,784 3 % · 1 case
- Securitas Sverige Aktiebolag – 0 % · 1 case
When?
per year, by date of decision| Period | Cases | Total |
|---|---|---|
| 2023 | 1 | €100,000 |
| 2024 | 0 | – |
| 2025 | 1 | €2,784 |
| 2026 | 1 | – |
3 cases
16 Jun 2026 Securitas Sverige AktiebolagSecuritas Sverige: reprimand over cameras in company vehicles without legal basis Reprimand or warning
The security services provider used cameras in vehicles through which personal data was processed without any legal basis for doing so. The Swedish data protection authority (Integritetsskyddsmyndigheten, IMY) issued a reprimand under Art. 58 GDPR; no fine was imposed.
Dashcams in company cars also need a verified legal basis and a balancing against the interests of employees and passers-by.
Use of cameras in vehicles
- Authority / court
- Integritetsskyddsmyndigheten (IMY)
- Area of law
- Data protection · Video surveillance
- Legal basis
- DSGVO Art. 6 Abs. 1
- Action
- Reprimand or warning
- Status of proceedings
- final
- Sector
- Defence and security
- IMY – Tillsyn Securitas Sverige Aktiebolag Decision of an authority
- IMY – Beslut Securitas Sverige AB Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
16 Dec 2025 Unternehmen für private Sicherheitsdienste (anonymisiert)Luxembourg security services firm: EUR 2,784 for incomplete record of processing €2,784
The CNPD (Luxembourg data protection authority) imposed a fine of EUR 2,784, a reprimand and an order on a Luxembourg private security services company with more than 250 employees because its record of processing activities did not fully contain the information required by Art. 30(1) GDPR. Within one month it had to describe the security measures for its whistleblowing report handling, or state expressly that there were none.
The record of processing must contain, for every processing operation – including the handling of whistleblower reports – complete information on purposes, recipients, erasure periods and security measures.
- Authority / court
- Commission nationale pour la protection des données (CNPD), formation restreinte
- Area of law
- Data protection
- Legal basis
- Art. 30(1)(a), (c), (d), (e), (f) und (g) DSGVO; Art. 58(2) und 83 DSGVO
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Defence and security
- CNPD, Délibération n° 4FR/2025 du 16 décembre 2025 (version pseudonymisée) Decision of an authority
- CNPD, Décisions – Délibération n° 4FR/2025 Enforcement database of an authority
Checked against the official source on 2 Oct 2026 · Direct link
Report an error
1 Feb 2023 an alarm system provider in SpainAlarm system provider in Spain: 100,000 EUR because data subject rights could only be exercised via a 902 number €100,000
On the video surveillance signs that the alarm system provider supplies to its customers, only a chargeable 902 telephone number was given for access and objection requests. The Spanish data protection authority (Agencia Española de Protección de Datos, AEPD) considered this to obstruct the exercise of rights, imposed 100,000 EUR and ordered the signs to be replaced within twelve months; the European Data Protection Board (EDPB) published the decision in September 2026.
The route for exercising data subject rights must be free of charge and easily accessible, including on signs at customers' premises.
- Authority / court
- Agencia Española de Protección de Datos (AEPD)
- Area of law
- Data protection · Data subject rights and transparency
- Legal basis
- DSGVO Art. 12 Abs. 2, Art. 83 Abs. 5 lit. b
- Action
- Fine
- Status of proceedings
- final
- Sector
- Defence and security
- Published
- 22 Sep 2026
- AEPD, Resoluciones (Übersicht) (Entscheidung 2023) Decision of an authority
- EDSA (EDPB), Nachrichten (Übersicht) (Entscheidung 2023) Press release of an authority
Checked against the official source on 28 Sep 2026 · Version 5 · Company name anonymised since 1 Feb 2025 · Direct link