Compliance Radar
Who was sanctioned, and for what?
Fines, court rulings and incidents from Europe, North America, Latin America, Asia-Pacific, Middle East and Africa: 2,207 cases from 44 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.
Click a bar to drill down one level.
Where?
by regionAll jurisdictions
What for?
by topicWho?
by company- Anonymised companies €5.06m 100 % · 2 cases
- Wspólnota Mieszkaniowa K. (Wohnungseigentümergemeinschaft, im Bescheid pseudonymisiert) €1,135 0 % · 1 case
When?
per year, by date of decision| Period | Cases | Total |
|---|---|---|
| 2022 | 1 | €5.06m |
| 2023 | 1 | – |
| 2024 | 0 | – |
| 2025 | 0 | – |
| 2026 | 1 | €1,135 |
3 cases
7 Apr 2026 Wspólnota Mieszkaniowa K. (Wohnungseigentümergemeinschaft, im Bescheid pseudonymisiert)Homeowners’ association: 4,852 PLN – misdirected statement not notified €1,135
Acting as processor, the property management company sent an owner’s statement of service charges to an unauthorised person. The association considered notification unnecessary because only ‘ordinary’ data of one member were affected, and maintained this position in the proceedings; the UODO (Poland’s data protection authority) imposed 4,852 PLN.
Small controllers must also assess and notify data breaches by their service providers – ‘only one data subject’ is no ground for exemption.
Recognising misdirected mail as a data breach – including at service providers
- Authority / court
- Prezes Urzędu Ochrony Danych Osobowych (UODO)
- Area of law
- Information security and cyber · Incident reporting obligations
- Legal basis
- Art. 33 Abs. 1 DSGVO
- Action
- Fine
- Status of proceedings
- final
- Sector
- Construction and real estate
Original amount 4,852 PLN, converted at the ECB reference rate of 7 Apr 2026.
- UODO, Decyzja DKN.5131.16.2025 vom 07.04.2026 (rechtskräftig) Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
14 Nov 2023 a UK construction materials supplierICO: reprimand for construction materials supplier after a ransomware attack via remote access without MFA Reprimand or warning
The ICO issued a reprimand to a UK supplier of construction materials. According to the ICO, on 11 March 2022 a threat actor gained access to the network, deployed ransomware and exfiltrated data, including personal data of 2,022 current and former UK employees (among other things identity documents, bank details and HR records). According to the ICO's findings, access was gained through a subsidiary's remote desktop service that had no multi-factor authentication; in addition, the company had carried out no formal security testing such as vulnerability scanning or penetration testing before the incident, and the attacker exploited a vulnerability that had been public for more than two years. The ICO found infringements of Article 32(1), 32(1)(b) and 32(1)(d) UK GDPR. The reprimand is undated; the date follows the ICO case page.
- Authority / court
- Information Commissioner's Office (ICO)
- Area of law
- Information security and cyber · Security measures and risk management
- Legal basis
- Art. 32(1), 32(1)(b) und 32(1)(d) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR
- Action
- Reprimand or warning
- Status of proceedings
- unknown
- Sector
- Construction and real estate
- ICO, Übersicht der Durchsetzungsmaßnahmen (Entscheidung 2023) Enforcement database of an authority
Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 14 Nov 2025 · Direct link
Report an error
19 Oct 2022 the parent company of a UK construction and services groupICO: GBP 4.4 million fine for UK construction group after a cyber attack on employee data €5.06m
On 19 October 2022 the ICO fined the parent company of a UK construction group GBP 4,400,000. According to the ICO's findings, after a phishing email received on 30 March 2020 was forwarded internally, malware was installed on a workstation on 1 April 2020. The attacker went on to compromise 283 systems and 16 accounts, 12 of them privileged, uninstalled the anti-virus software and encrypted, among other things, four HR databases holding data of up to 113,000 employees, including special category data; according to the ICO, the company identified the incident as a ransomware attack on 2 May 2020. The ICO criticised, among other things, unsupported operating systems, outdated protocols, inadequate endpoint protection, a lack of regular vulnerability scanning and penetration testing, and gaps in training, incident response and privileged account management. It found infringements of Articles 5(1)(f) and 32 GDPR for the period from 18 March 2019 to 1 December 2020. The ICO published the case on 24 October 2022.
- Authority / court
- Information Commissioner's Office (ICO)
- Area of law
- Information security and cyber · Security measures and risk management
- Legal basis
- Art. 5(1)(f) und 32 GDPR; Geldbuße nach section 155 DPA 2018 und Art. 83 GDPR
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Construction and real estate
Original amount 4,400,000 GBP, converted at the ECB reference rate of 19 Oct 2022.
- ICO, Übersicht der Durchsetzungsmaßnahmen (Entscheidung 2022) Decision of an authority
Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 19 Oct 2024 · Direct link