Compliance Radar
Who was sanctioned, and for what?
Fines, court rulings and incidents from Europe and North America: 718 cases from 32 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.
Click a bar to drill down one level.
Where?
by authority- Commission nationale pour la protection des données (CNPD) – formation restreinte €182,000 100 % · 2 cases
- Cour administrative (Luxemburg); Verfahren der CNPD — 0 % · 1 case
What for?
by topic- Data subject rights and transparency €175,000 96 % · 1 case
- no topic €7,000 4 % · 1 case
- Marketing and consent — 0 % · 1 case
Who?
by sectorAll sectors
When?
per quarter, by date of decision| Period | Cases | Total |
|---|---|---|
| Q3 2023 | 0 | — |
| Q4 2023 | 0 | — |
| Q1 2024 | 0 | — |
| Q2 2024 | 0 | — |
| Q3 2024 | 0 | — |
| Q4 2024 | 0 | — |
| Q1 2025 | 1 | €175,000 |
| Q2 2025 | 1 | €7,000 |
| Q3 2025 | 0 | — |
| Q4 2025 | 0 | — |
| Q1 2026 | 1 | — |
| Q2 2026 | 0 | — |
| Q3 2026 | 0 | — |
3 cases
12 Mar 2026 Amazon Europe Core S.à r.l.Luxembourg: Cour administrative annuls 746 million EUR fine against Amazon but confirms infringements overturned
In 2021, the Luxembourg data protection authority (CNPD) had imposed 746 million EUR and an order to bring processing into compliance on account of behavioural online advertising; the Administrative Tribunal (Tribunal administratif) confirmed this on 18 March 2025. On 12 March 2026, the Administrative Court (Cour administrative) confirmed that legitimate interest was not a sound legal basis and that the information was insufficient, but annulled the fine on the basis of more recent CJEU case law on the requirement of culpability; the CNPD is re-examining the sanction.
Personalised advertising cannot be based on legitimate interest – and courts now scrutinise culpability closely when it comes to fines.
- Authority / court
- Cour administrative (Luxemburg); Verfahren der CNPD
- Area of law
- Data protection · Marketing and consent
- Legal basis
- Art. 6 Abs. 1 lit. f, Art. 12 ff. DSGVO
- Action
- Order
- Status of proceedings
- overturned
- Sector
- Retail and e-commerce
- Employees
- 10,000 or more
- Mitigating circumstances
- Amazon had implemented the compliance order before the hearing.
- La CNPD obtient la mise en conformité effective des traitements d'Amazon (Arrêt de la Cour administrative du 12 mars 2026) Press release of an authority
- Décision concernant Amazon Europe Core S.À R.L. (Tribunal administratif, 18 mars 2025) Press release of an authority
- Justice Luxembourg – Arrêt de la Cour administrative du 12 mars 2026 (n° 52757C du rôle), Amazon/CNPD Court press release
- Justice Luxembourg – Jugement du tribunal administratif du 18 mars 2025, Amazon/CNPD Court press release
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
30 Apr 2025 Luxembourg engineering firm: 7,000 EUR for incomplete record of processing activities €7,000
In an audit campaign on records of processing activities, the Commission nationale pour la protection des données (Luxembourg data protection authority, CNPD) found that an engineering and design consultancy (pseudonymised as ‘Société A’) had omitted mandatory information such as name and contact details, categories of data subjects and data, and retention periods. It imposed 7,000 EUR.
The record of processing activities is the first thing supervisory authorities request – it must be complete, including retention periods.
- Authority / court
- Commission nationale pour la protection des données (CNPD) – formation restreinte
- Area of law
- Data protection
- Legal basis
- DSGVO Art. 30 Abs. 1 lit. a, c, f
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Manufacturing and mechanical engineering
- CNPD – Délibération n° 3FR/2025 du 30 avril 2025 (Société A) Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
6 Jan 2025 Luxembourg credit institution: 175,000 EUR for late responses to data subject requests €175,000
Following 47 complaints, the Commission nationale pour la protection des données (Luxembourg data protection authority, CNPD) found that a Luxembourg credit institution (pseudonymised in the decision as ‘Société A’) had not responded to data subjects’ requests on time; the CNPD did not accept the reference to the COVID-19 pandemic. It issued a reprimand (rappel à l’ordre) and imposed 175,000 EUR.
Data subject requests require deadline tracking and a monitored DPO mailbox – staff shortages are no excuse.
Deadlines for data subject requests
- Authority / court
- Commission nationale pour la protection des données (CNPD) – formation restreinte
- Area of law
- Data protection · Data subject rights and transparency
- Legal basis
- DSGVO Art. 12 Abs. 3 und 4
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Financial services and insurance
- CNPD – Délibération n° 1FR/2025 du 6 janvier 2025 (Société A) Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link