Compliance Radar
Who was sanctioned, and for what?
Fines, court rulings and incidents from Europe, North America, Latin America, Asia-Pacific, Middle East and Africa: 2,207 cases from 44 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.
Click a bar to drill down one level.
Where?
by countryWhat for?
by topicWho?
by sectorAll sectors
When?
per year, by date of decision| Period | Cases | Total |
|---|---|---|
| 2024 | 1 | €50,000 |
| 2025 | 1 | €870 |
| 2026 | 0 | – |
2 cases
4 Sep 2025 A*** GmbH (Werbeagentur, im Bescheid pseudonymisiert)Austrian advertising agency: 870 EUR – alert about security gap dismissed as spam €870
Customer data (including names, e-mail addresses, dates of birth, telephone numbers) could be retrieved via an unprotected development server of the advertising agency. An employee took the first alert from an external party in January 2025 to be spam; only a second alert in February reached management, which closed the gap but only notified the incident on 2 May 2025 after being requested to do so by the Datenschutzbehörde (Austrian Data Protection Authority, DSB). The authority attributed the employee’s conduct to the company.
External alerts about security gaps need a clear intake channel – what ends up in spam still counts as known.
Recognising and escalating alerts about security gaps
Missing or inadequate training played a role in the decision.
- Authority / court
- Datenschutzbehörde (DSB)
- Area of law
- Information security and cyber · Incident reporting obligations
- Legal basis
- Art. 33 Abs. 1 iVm Art. 83 Abs. 4 lit. a DSGVO
- Action
- Fine
- Status of proceedings
- final
- Sector
- Media and online platforms
- Culpability
- negligent
- Mitigating circumstances
- No previous infringements and cooperation in the proceedings; gap closed immediately after the second alert, employees trained subsequently.
- DSB, Straferkenntnis GZ 2025-0.699.550 vom 04.09.2025 (RIS) Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
8 Feb 2024 a German major bankBaFin fines a major bank €50,000 for flawed reporting of an IT security incident €50,000
BaFin (German Federal Financial Supervisory Authority) imposed a fine of 50,000 EUR on a German major bank because the bank had given it incorrect information about a major customer-relevant IT security incident affecting its payment services in 2023 and had informed it considerably late. The decision of 8 February 2024 is final.
IT incident reports must be fast and accurate; incorrect information given to the supervisor is sanctioned in its own right.
Reporting major IT security incidents correctly and on time
- Authority / court
- Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin)
- Area of law
- Information security and cyber · Incident reporting obligations
- Legal basis
- § 64 Abs. 3 Nr. 15 ZAG
- Action
- Fine
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Employees
- 10,000 or more
- Published
- 18 Mar 2024
- BaFin, Maßnahmen und Sanktionen (Übersicht) (Entscheidung 2024) Press release of an authority
Checked against the official source on 2 Oct 2026 · Company name anonymised since 8 Feb 2026 · Direct link