Compliance Radar
Who was sanctioned, and for what?
Fines, court rulings and incidents from Europe, North America, Latin America, Asia-Pacific, Middle East and Africa: 2,207 cases from 44 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.
Click a bar to drill down one level.
Where?
by regionAll jurisdictions
What for?
by action- Fine €2.13bn 100 % · 10 cases
- Order – 0 % · 3 cases
- Reprimand or warning – 0 % · 1 case
Who?
by sectorAll sectors
- Media and online platforms €1.73bn 81 % · 3 cases
- Transport, logistics and shipping €390m 18 % · 2 cases
- Telecoms, IT and software €5.52m 0 % · 2 cases
- Public sector €4.3m 0 % · 2 cases
- Financial services and insurance €3.99m 0 % · 1 case
- Retail and e-commerce €25,412 0 % · 3 cases
- Other €4,000 0 % · 1 case
When?
per year, by date of decision| Period | Cases | Total |
|---|---|---|
| 2022 | 2 | €4.3m |
| 2023 | 6 | €1.2bn |
| 2024 | 2 | €290m |
| 2025 | 3 | €538.5m |
| 2026 | 1 | €100m |
14 cases
1 Apr 2026 MLU B.V. (Rechtsnachfolgerin der Ridetech International B.V., Anbieterin der Yango-App)Yango taxi app: 100 million EUR for transferring data to Russia €100m
Amsterdam-based Ridetech offered the ride-hailing app Yango in Finland and Norway and transferred data of drivers and customers to the group companies Yandex.Taxi LLC and Yandex LLC in Russia without demonstrating appropriate safeguards. The Autoriteit Persoonsgegevens (Dutch Data Protection Authority, AP) imposed 100 million EUR on the legal successor and prohibited further transfers to Russia.
Transfers to states without legal protection against access by authorities can hardly be safeguarded – group structures with such locations need data localisation in the EU.
- Authority / court
- Autoriteit Persoonsgegevens (AP)
- Area of law
- Data protection · International data transfers
- Legal basis
- Art. 44, Art. 46 iVm Art. 5 Abs. 1 lit. a und Abs. 2 DSGVO
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Transport, logistics and shipping
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
14 Nov 2025 Betreiber elektronischer Kommunikationsnetze und -dienste (in der Mitteilung nicht namentlich genannt)Croatian telecoms provider: 4.5 million EUR – customer data sent to Serbia without clauses €4.5m
The telecommunications provider allowed a software service provider belonging to the group in Serbia to access the entire SAP CRM customer database with administrator rights, from the end of 2022 without standard contractual clauses and without clear information to customers. The Agencija za zaštitu osobnih podataka (Croatian Personal Data Protection Agency, AZOP) also sanctioned the copying of employees’ identity cards and criminal records certificates and the failure to vet a telemarketing service provider; 4.5 million EUR in total.
Expiring or never-renewed standard contractual clauses with group companies only come to light during an inspection – transfer agreements need a deadline register.
- Authority / court
- Agencija za zaštitu osobnih podataka (AZOP)
- Area of law
- Data protection · International data transfers
- Legal basis
- Art. 44, 46, 12 Abs. 1, 13 Abs. 1 lit. f, 5, 6 Abs. 1, 28 Abs. 1 DSGVO
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Telecoms, IT and software
- Published
- 14 Nov 2025
- AZOP: Administrative Fine of EUR 4.5 Million Imposed on a Telecommunications Operator (14.11.2025) Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
2 May 2025 TikTok Technology LimitedDPC: 530 million EUR against TikTok over data access from China €530m
TikTok allowed employees in China to access European users' data remotely without assessing and demonstrating that standard contractual clauses and supplementary measures ensured an equivalent level of protection against access by Chinese authorities; it also informed users inadequately. Ireland's Data Protection Commission (DPC) imposed 530 million EUR and ordered that the transfers be brought into compliance or suspended within six months.
Even mere remote access from a third country is a transfer – without a documented transfer impact assessment, fines and a suspension order loom.
- Authority / court
- Data Protection Commission (DPC)
- Area of law
- Data protection · International data transfers
- Legal basis
- Art. 46 Abs. 1, Art. 13 DSGVO
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Media and online platforms
- Employees
- 10,000 or more
- Published
- 2 May 2025
- Irish Data Protection Commission fines TikTok €530 million and orders corrective measures Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
22 Jan 2025 Kakaopay Corp.Kakao Pay: 5.968 billion KRW for transferring user data to Alipay without consent €3.99m
Kakaopay Corp. transferred data on all users three times in 2018 and, from June 2019 to May 2024, data on around 40 million users every day without consent to Alipay in Singapore, which used it to calculate for Apple a score for the likelihood of insufficient funds on bundled App Store payments (NSF score). The authority treated this as an unlawful transfer abroad, imposed a penalty surcharge of 5,968,000,000 KRW and ordered remediation and publication of the decision on the company’s website. In separate decisions on the same day Apple received a penalty surcharge of 2,405,000,000 KRW and an administrative fine of 2,200,000 KRW, and Alipay was ordered to delete the scoring model.
Anyone passing customer data to a partner’s foreign service provider must check whether this is a transfer requiring consent and limit the data to what is necessary.
Data sharing with partners’ foreign service providers
- Authority / court
- Personal Information Protection Commission (PIPC, 개인정보보호위원회)
- Area of law
- Data protection · International data transfers
- Legal basis
- Personal Information Protection Act (개인정보 보호법) Art. 28-8(1); Sanktion nach Art. 64-2(1) Nr. 9
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Financial services and insurance
- Mitigating circumstances
- Reduction of 30% for completed remediation, cooperation and ISMS-P certification; increase of 50% because the infringement lasted more than two years (June 2019 to May 2024).
- Published
- 23 Jan 2025
Original amount 5,968,000,000 KRW, converted at the ECB reference rate of 22 Jan 2025.
- PIPC, 심의·의결서 제2025-001-002호 (㈜카카오페이), 22.01.2025 Decision of an authority
- PIPC, Entscheidungsdatenbank (위원회 결정문), Eintrag 2024조삼0005 등 3건 Enforcement database of an authority
- PIPC-Pressemitteilung vom 23.01.2025: 개인정보 무단 국외 이전한 카카오페이·애플에 과징금·과태료 부과 Press release of an authority
- PIPC press release (English), 31.01.2025: The PIPC Sanctions Kakao Pay and Apple Press release of an authority
Checked against the official source on 4 Oct 2026 · Direct link
Report an error
26 Nov 2024 CMC Certus Management Consultants LtdCyprus: 4,000 EUR against visa service provider CMC Certus – client documents on Scribd €4,000
Without informing them, the residence permit consultancy sent a client couple’s marriage certificate and proof of salary to a sister company in Georgia for translation; the documents subsequently appeared publicly on the Scribd platform. The Επίτροπος Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Commissioner for Personal Data Protection) imposed 2,000 EUR each for an impermissible transfer to a third country and for lack of security measures, as well as a reprimand for insufficient cooperation.
Translation by a group company in a third country is also a data transfer – requiring safeguards, information and confidentiality rules.
Passing client documents on to translators and group companies
- Authority / court
- Επίτροπος Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Commissioner for Personal Data Protection)
- Area of law
- Data protection · International data transfers
- Legal basis
- Art. 5 Abs. 1 lit. f, Art. 31, Art. 44 DSGVO
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Other
- Decision – Complaint against CMC Certus Management Consultants Ltd (26.11.2024) Decision of an authority
- 28/03/2025 Αποφάσεις: Οκτώβριος – Δεκέμβριος 2024 Press release of an authority
Checked against the official source on 28 Sep 2026 · Version 2 · Direct link
Report an error
22 Jul 2024 a US ride-hailing company and its Dutch subsidiaryRide-hailing company: 290 million EUR – driver data sent to the USA for two years without a transfer tool €290m
The company stored sensitive data of European drivers – including location, payment and identity document data, and in some cases criminal and health data – on servers in the USA and from August 2021 no longer used any transfer tool. Following complaints from more than 170 French drivers, the Autoriteit Persoonsgegevens (Dutch Data Protection Authority, AP) imposed 290 million EUR; it was the AP’s third fine against the company.
Intra-group transfers to headquarters are third-country transfers – anyone who lets a transfer tool lapse transfers data without a legal basis.
- Authority / court
- Autoriteit Persoonsgegevens (AP)
- Area of law
- Data protection · International data transfers
- Legal basis
- Art. 44 DSGVO
- Action
- Fine
- Status of proceedings
- under appeal
- Sector
- Transport, logistics and shipping
- Employees
- 10,000 or more
- Repeat case
- yes
- Published
- 26 Aug 2024
- Autoriteit Persoonsgegevens, Bußgelder und Sanktionen (Übersicht) (Entscheidung 2024) Press release of an authority
Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 22 Jul 2026 · Direct link
Report an error
26 Oct 2023 a UK police serviceICO: reprimand for police service over unlawful sharing of data with the US Department of Homeland Security Reprimand or warning
The ICO issued a reprimand to a UK police service. According to the ICO's findings, from 2016 until 15 October 2020 the force's extradition unit shared personal data of 174 people with the US Department of Homeland Security (DHS) outside the established procedures, including identifiers, information from ESTA (US electronic travel authorisation) and visa applications, information on missing persons, criminal conviction data and biometric data. The ICO criticised the lack of managerial oversight and insufficiently regulated access to systems. It found infringements of sections 34(3), 35(1), 40, 42(1) and 73(1) DPA 2018 (Part 3). The reprimand is undated; the date follows the ICO case page.
- Authority / court
- Information Commissioner's Office (ICO)
- Area of law
- Data protection · International data transfers
- Legal basis
- Section 34(3), 35(1), 40, 42(1) und 73(1) DPA 2018; Verwarnung nach Schedule 13(2)(c) DPA 2018
- Action
- Reprimand or warning
- Status of proceedings
- unknown
- Sector
- Public sector
- ICO, Übersicht der Durchsetzungsmaßnahmen (Entscheidung 2023) Enforcement database of an authority
Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 26 Oct 2025 · Direct link
Report an error
30 Jun 2023 a Swedish telecommunications providerSwedish telecoms provider: 12 million SEK for transferring data to the USA via Google Analytics €1.02m
The provider transferred personal data of website visitors to the USA via Google Analytics. In the view of the Swedish Authority for Privacy Protection (IMY), the supplementary technical safeguards in addition to the standard contractual clauses were insufficient; the provider had meanwhile switched off the tool on its own initiative.
Include web analytics tools with a third-country connection in the transfer assessment – pseudonymising IP addresses alone is not enough.
- Authority / court
- Integritetsskyddsmyndigheten (IMY)
- Area of law
- Data protection · International data transfers
- Legal basis
- Art. 44 DSGVO
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Telecoms, IT and software
- Mitigating circumstances
- Use of Google Analytics already discontinued on its own initiative.
- Published
- 3 Jul 2023
Original amount 12,000,000 SEK, converted at the ECB reference rate of 30 Jun 2023.
- IMY, Aufsichtsverfahren (Übersicht) (Entscheidung 2023) Press release of an authority
Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 30 Jun 2025 · Direct link
Report an error
30 Jun 2023 a Swedish online retailerSwedish online retailer: 300,000 SEK and ban on using Google Analytics €25,412
The online retailer transferred visitor data to the USA via Google Analytics without sufficient supplementary measures to the standard contractual clauses. The Swedish Authority for Privacy Protection (IMY) imposed an administrative fine and ordered the company to stop using the tool in this form.
Medium-sized online retailers must also check tracking service providers for third-country transfers before integrating them.
- Authority / court
- Integritetsskyddsmyndigheten (IMY)
- Area of law
- Data protection · International data transfers
- Legal basis
- Art. 44 DSGVO; Art. 58 Abs. 2 lit. d DSGVO
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Retail and e-commerce
- Published
- 3 Jul 2023
Original amount 300,000 SEK, converted at the ECB reference rate of 30 Jun 2023.
- IMY, Aufsichtsverfahren (Übersicht) (Entscheidung 2023) Press release of an authority
Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 30 Jun 2025 · Direct link
Report an error
30 Jun 2023 a Swedish grocery retailerSwedish grocery retailer: order to stop using Google Analytics owing to US transfer Order
At the retailer too, the Swedish Authority for Privacy Protection (IMY) found that the transfer of visitor data to the USA via Google Analytics was not sufficiently safeguarded. Because the retailer had taken more extensive protective measures than two other companies examined (a telecommunications provider and an online retailer), the authority confined itself to an order to stop the use.
Supplementary safeguards reduce the sanction but do not cure an impermissible transfer – what matters is whether access by authorities in the third country is actually ruled out.
- Authority / court
- Integritetsskyddsmyndigheten (IMY)
- Area of law
- Data protection · International data transfers
- Legal basis
- Art. 44 DSGVO; Art. 58 Abs. 2 lit. d DSGVO
- Action
- Order
- Status of proceedings
- unknown
- Sector
- Retail and e-commerce
- Mitigating circumstances
- More extensive supplementary technical measures than at other companies examined.
- Published
- 3 Jul 2023
- IMY, Aufsichtsverfahren (Übersicht) (Entscheidung 2023) Press release of an authority
Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 30 Jun 2025 · Direct link
Report an error
30 Jun 2023 a Swedish business newspaperSwedish business newspaper: order over Google Analytics transfers to the USA Order
The business newspaper transferred data of its website visitors to the USA via Google Analytics. The Swedish Authority for Privacy Protection (IMY) considered the supplementary safeguards insufficient and ordered the newspaper to stop using the tool in this form.
Publishers and media houses with extensive tracking should regularly check their analytics services for third-country connections and legal basis.
- Authority / court
- Integritetsskyddsmyndigheten (IMY)
- Area of law
- Data protection · International data transfers
- Legal basis
- Art. 44 DSGVO; Art. 58 Abs. 2 lit. d DSGVO
- Action
- Order
- Status of proceedings
- unknown
- Sector
- Media and online platforms
- Published
- 3 Jul 2023
- IMY, Aufsichtsverfahren (Übersicht) (Entscheidung 2023) Press release of an authority
Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 30 Jun 2025 · Direct link
Report an error
12 May 2023 an Irish subsidiary of a US platform groupPlatform group: 1.2 billion EUR – user data still transferred to the USA after Schrems II €1.2bn
Following the Schrems II judgment, the company continued to transfer data of users of its social network from the EU/EEA to the USA on the basis of standard contractual clauses without effectively addressing the risks identified by the CJEU. On the instruction of the EDPB, the Data Protection Commission (DPC) imposed 1.2 billion EUR and ordered the company to suspend future transfers and to cease processing the data unlawfully stored in the USA.
Standard contractual clauses alone are not enough – every third-country transfer requires a robust transfer impact assessment with effective supplementary measures.
- Authority / court
- Data Protection Commission (DPC)
- Area of law
- Data protection · International data transfers
- Legal basis
- Art. 46 Abs. 1 DSGVO; Art. 58 Abs. 2 lit. d und j DSGVO
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Media and online platforms
- Employees
- 10,000 or more
- Published
- 22 May 2023
- DPC, Pressemitteilungen (Übersicht) (Entscheidung 2023) Press release of an authority
Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 12 May 2025 · Direct link
Report an error
2 Nov 2022 a Portuguese statistics authorityPortuguese statistics authority: 4.3 million EUR – census data sent to the USA via a US CDN provider €4.3m
The Portuguese statistics office had the online collection for the 2021 census handled via a US CDN provider; the contract allowed processing on servers worldwide and relied on standard contractual clauses without supplementary measures against access by authorities in the USA. The Comissão Nacional de Proteção de Dados (Portuguese data protection authority, CNPD) sanctioned five infringements – including impermissible third-country transfer, deficient selection of the processor, unclear voluntary nature of questions on health and religion, missing DPIA – with a total fine of 4.3 million EUR.
Public authorities must also check where data are actually processed when using cloud and CDN services – a contract with the US parent company is a third-country transfer.
- Authority / court
- Comissão Nacional de Proteção de Dados (CNPD)
- Area of law
- Data protection · International data transfers
- Legal basis
- Art. 44, Art. 46 Abs. 2, Art. 28 Abs. 1 und 3, Art. 9, Art. 35 DSGVO
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Public sector
- CNPD, Nachrichten (Übersicht) (Entscheidung 2022) Press release of an authority
Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 2 Nov 2024 · Direct link
Report an error
6 Oct 2022 the Singapore entity of an e-commerce platform group and a Singaporean online retailerE-commerce platform and online retailer in Singapore: directions over unsecured data transfers Order
After two contractors of the platform operator's foreign parent company extracted customer data from its systems in 2020 – data on numerous individuals was affected, including customers of the online retailer – the Personal Data Protection Commission (PDPC, Singapore's data protection authority) examined the transfers from Singapore abroad. The online retailer, as controller, had not obtained contractual commitments securing a standard of protection comparable to the PDPA for data transferred via its data intermediary, and the Singapore platform entity lacked binding contracts or binding corporate rules for passing its own platform data to the foreign parent company within the group. The PDPC directed both to put in place processes to comply with the Transfer Limitation Obligation – the platform entity within 60 days, the online retailer as an SME within six months – and pointed to the ASEAN Model Contractual Clauses.
Anyone transferring data abroad through a service provider or within a group must secure a comparable standard of protection themselves, by contract or binding corporate rules.
- Authority / court
- Personal Data Protection Commission (PDPC)
- Area of law
- Data protection · International data transfers
- Legal basis
- Section 26(1) PDPA 2012 (Transfer Limitation Obligation) i. V. m. Regulations 9(1)(b) und 10(1) Personal Data Protection Regulations 2014; Section 4(3) PDPA; Section 48I PDPA (Directions)
- Action
- Order
- Status of proceedings
- unknown
- Sector
- Retail and e-commerce
- Mitigating circumstances
- According to the PDPC, both companies were highly cooperative.
- Published
- 18 Nov 2022
- PDPC, Enforcement Decisions (Übersicht) (Entscheidung 2022) Enforcement database of an authority
Checked against the official source on 7 Oct 2026 · Company name anonymised since 6 Oct 2024 · Direct link