Compliance Radar
Who was sanctioned, and for what?
Fines, court rulings and incidents from Europe, North America, Latin America, Asia-Pacific, Middle East and Africa: 2,207 cases from 44 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.
Click a bar to drill down one level.
Where?
by regionAll jurisdictions
What for?
by topicWho?
by company- Komornik Sądowy przy Sądzie Rejonowym w S. (Gerichtsvollzieherkanzlei, im Bescheid pseudonymisiert) €4,938 100 % · 1 case
- Anonymised companies – 0 % · 4 cases
When?
per year, by date of decision| Period | Cases | Total |
|---|---|---|
| 2023 | 2 | – |
| 2024 | 2 | – |
| 2025 | 1 | €4,938 |
| 2026 | 0 | – |
5 cases
23 Oct 2025 Komornik Sądowy przy Sądzie Rejonowym w S. (Gerichtsvollzieherkanzlei, im Bescheid pseudonymisiert)Bailiff: 20,900 PLN – documents with PESEL number misdirected, not notified €4,938
In October 2023, an uninvolved person received a debtor’s enforcement documents containing name, address, date of birth, PESEL number, amount of the claim and employer. The bailiff’s office neither notified the supervisory authority nor informed the data subject; the UODO (Poland’s data protection authority) imposed 7,700 PLN for the failure to notify and 13,200 PLN for the failure to inform the data subject, and ordered the data subject to be informed within three days.
Where identification numbers such as the PESEL number are disclosed, a high risk can almost always be assumed – notification of the authority and of the data subject is then mandatory.
Checking postal mailings; notifying data breaches involving identification numbers
- Authority / court
- Prezes Urzędu Ochrony Danych Osobowych (UODO)
- Area of law
- Information security and cyber · Incident reporting obligations
- Legal basis
- Art. 33 Abs. 1, Art. 34 Abs. 1 und 2 DSGVO
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Public sector
Original amount 20,900 PLN, converted at the ECB reference rate of 23 Oct 2025.
- UODO, Decyzja DKN.5131.17.2024 vom 23.10.2025 (nicht rechtskräftig) Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
5 Jul 2024 a London borough councilICO: reprimand for London borough council after a ransomware attack Reprimand or warning
On 5 July 2024 the ICO issued an (updated) reprimand to a London borough council. According to the reprimand, it followed a ransomware attack that the council became aware of on 11 October 2020: the attacker was able to access and encrypt 440,000 files containing personal data, including special category data, relating to at least 280,000 residents and other people, including staff. According to the ICO's findings, patch management and user account management were inadequate, in breach of Articles 5(1)(f) and 32(1)(b) UK GDPR. The ICO had initially considered a fine but, taking into account its approach to the public sector and the circumstances of the case, decided on a reprimand.
- Authority / court
- Information Commissioner's Office (ICO)
- Area of law
- Information security and cyber · Security measures and risk management
- Legal basis
- Art. 5(1)(f) und 32(1)(b) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR
- Action
- Reprimand or warning
- Status of proceedings
- unknown
- Sector
- Public sector
- ICO, Übersicht der Durchsetzungsmaßnahmen (Entscheidung 2024) Enforcement database of an authority
Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 5 Jul 2026 · Direct link
Report an error
9 May 2024 a UK public bodyICO: reprimand for UK public body after an attack on its email server Reprimand or warning
The ICO issued a reprimand to a UK public body. According to the ICO's findings, unknown attackers got into the body's on-premises email server from 24 August 2021 via a chain of known vulnerabilities; the data affected came mainly from the electoral register, with the names and home addresses of around 40 million people. The security patches for these vulnerabilities had been released in April and May 2021 but had not been applied. In addition, an audit found that 178 active accounts could be cracked quickly because their passwords were identical or similar to the initial passwords issued by the service desk. The ICO found infringements of Articles 5(1)(f) and 32(1)(b) UK GDPR. The reprimand is undated; the date follows the ICO case page.
- Authority / court
- Information Commissioner's Office (ICO)
- Area of law
- Information security and cyber · Security measures and risk management
- Legal basis
- Art. 5(1)(f) und 32(1)(b) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR
- Action
- Reprimand or warning
- Status of proceedings
- unknown
- Sector
- Public sector
- ICO, Übersicht der Durchsetzungsmaßnahmen (Entscheidung 2024) Enforcement database of an authority
Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 9 May 2026 · Direct link
Report an error
7 Dec 2023 an English multi-academy trustICO: reprimand for multi-academy trust after an attack using compromised credentials Reprimand or warning
The ICO issued a reprimand to an English multi-academy trust, which runs schools. According to the ICO, an unauthorised third party used compromised credentials to access and encrypt the trust's systems. According to the ICO's findings, appropriate technical measures were missing: the account lockout policy was inadequate and reversible password encryption was enabled, contrary to National Cyber Security Centre recommendations. The ICO found infringements of Articles 5(1)(f) and 32(1)(b) UK GDPR. The reprimand is undated; the date follows the ICO case page.
- Authority / court
- Information Commissioner's Office (ICO)
- Area of law
- Information security and cyber · Security measures and risk management
- Legal basis
- Art. 5(1)(f) und 32(1)(b) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR
- Action
- Reprimand or warning
- Status of proceedings
- unknown
- Sector
- Public sector
- ICO, Übersicht der Durchsetzungsmaßnahmen (Entscheidung 2023) Enforcement database of an authority
Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 7 Dec 2025 · Direct link
Report an error
23 Aug 2023 an English city councilICO: reprimand for city council after a ransomware attack Reprimand or warning
On 23 August 2023 the ICO issued a reprimand to an English city council. According to the ICO's findings, before a ransomware attack the council had no centralised logging or SIEM system; the attacker was able to delete logs, which hampered detection and investigation. After the attack the council did not restore access to personal data in a timely manner, could not identify which individuals were at risk and relied on ad hoc processes to analyse the data, such as downloads over employees' home Wi-Fi networks. The ICO found infringements of Article 32(1)(b), 32(1)(c) and 32(1)(d) UK GDPR. The ICO enforcement list shows the case under 1 September 2023.
- Authority / court
- Information Commissioner's Office (ICO)
- Area of law
- Information security and cyber · Security measures and risk management
- Legal basis
- Art. 32(1)(b), 32(1)(c) und 32(1)(d) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR
- Action
- Reprimand or warning
- Status of proceedings
- unknown
- Sector
- Public sector
- ICO, Übersicht der Durchsetzungsmaßnahmen (Entscheidung 2023) Enforcement database of an authority
Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 23 Aug 2025 · Direct link