Compliance Radar
Who was sanctioned, and for what?
Fines, court rulings and incidents from Europe, North America, Latin America, Asia-Pacific, Middle East and Africa: 2,207 cases from 44 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.
Click a bar to drill down one level.
Where?
by regionAll jurisdictions
What for?
by topicWho?
by company- Meta Platforms €3,396 80 % · 1 case
- A*** GmbH (Werbeagentur, im Bescheid pseudonymisiert) €870 20 % · 1 case
- Anonymised companies – 0 % · 1 case
When?
per year, by date of decision| Period | Cases | Total |
|---|---|---|
| 2023 | 1 | – |
| 2024 | 1 | €3,396 |
| 2025 | 1 | €870 |
| 2026 | 0 | – |
3 cases
4 Sep 2025 A*** GmbH (Werbeagentur, im Bescheid pseudonymisiert)Austrian advertising agency: 870 EUR – alert about security gap dismissed as spam €870
Customer data (including names, e-mail addresses, dates of birth, telephone numbers) could be retrieved via an unprotected development server of the advertising agency. An employee took the first alert from an external party in January 2025 to be spam; only a second alert in February reached management, which closed the gap but only notified the incident on 2 May 2025 after being requested to do so by the Datenschutzbehörde (Austrian Data Protection Authority, DSB). The authority attributed the employee’s conduct to the company.
External alerts about security gaps need a clear intake channel – what ends up in spam still counts as known.
Recognising and escalating alerts about security gaps
Missing or inadequate training played a role in the decision.
- Authority / court
- Datenschutzbehörde (DSB)
- Area of law
- Information security and cyber · Incident reporting obligations
- Legal basis
- Art. 33 Abs. 1 iVm Art. 83 Abs. 4 lit. a DSGVO
- Action
- Fine
- Status of proceedings
- final
- Sector
- Media and online platforms
- Culpability
- negligent
- Mitigating circumstances
- No previous infringements and cooperation in the proceedings; gap closed immediately after the second alert, employees trained subsequently.
- DSB, Straferkenntnis GZ 2025-0.699.550 vom 04.09.2025 (RIS) Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
28 Nov 2024 Meta PlatformsMeta: 5 million KRW for reporting an Instagram outage late €3,396
After a login outage of around 75 minutes on Instagram on 22 March 2024 that affected some 3.35 million users in Korea, Meta Platforms reported the incident only 24 hours and 19 minutes after it began, despite three requests from the Ministry. A report within 10 minutes and a written report within two hours are required; the Ministry imposed an administrative fine of 5,000,000 KRW under the Framework Act on Broadcasting and Communications Development (방송통신발전 기본법). The amount and the facts have not been confirmed against the primary source.
Large platform operators need a rehearsed reporting process so that outages reach the regulator within the statutory deadlines measured in minutes.
Reporting and escalation routes for IT outages
- Authority / court
- Ministry of Science and ICT (MSIT, 과학기술정보통신부)
- Area of law
- Information security and cyber · Incident reporting obligations
- Legal basis
- Framework Act on Broadcasting and Communications Development (방송통신발전 기본법) Art. 38; Basisplan zum Management von Kommunikationsstörungen 2024
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Media and online platforms
- Employees
- 10,000 or more
- Published
- 28 Nov 2024
Original amount 5,000,000 KRW, converted at the ECB reference rate of 28 Nov 2024.
- MSIT-Pressemitteilung vom 28.11.2024: ‘통신재난 보고의무 미준수’ 메타에 과태료 처분 Press release of an authority
- MSIT-Pressemitteilung vom 28.11.2024 (Anhang, HWPX) Press release of an authority
Checked against the official source on 4 Oct 2026 · Direct link
Report an error
25 Jul 2023 a UK video platform operatorICO: reprimand for video platform operator after data on 345,000 users was taken Reprimand or warning
The ICO issued a reprimand to a UK company operating a video platform; its case page lists the reprimand as issued. The published document, however, is worded as a provisional decision, referring to provisional findings and alleged infringements; the ICO has not published a version in final wording. As described by the ICO, around 14 August 2022 an unauthorised person got into the company's systems and copied the names, email addresses and passwords of 345,000 UK users; the company could not say exactly how this happened. The ICO provisionally criticised the company for being unable to show which security measures were in place at the time, or that it carried out regular penetration tests or vulnerability scans, and for relying on assurances from service providers without showing contracts or oversight. It considered that Article 32(1) and 32(1)(d) UK GDPR had been infringed. The reprimand is undated; the date follows the ICO case page.
- Authority / court
- Information Commissioner's Office (ICO)
- Area of law
- Information security and cyber · Security measures and risk management
- Legal basis
- Art. 32(1) und 32(1)(d) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR
- Action
- Reprimand or warning
- Status of proceedings
- unknown
- Sector
- Media and online platforms
- ICO, Übersicht der Durchsetzungsmaßnahmen (Entscheidung 2023) Enforcement database of an authority
Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 25 Jul 2025 · Direct link