Compliance Radar
Who was sanctioned, and for what?
Fines, court rulings and incidents from Europe, North America, Latin America, Asia-Pacific, Middle East and Africa: 2,207 cases from 44 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.
Click a bar to drill down one level.
Where?
by countryWhat for?
by topicWho?
by sectorAll sectors
When?
per year, by date of decision| Period | Cases | Total |
|---|---|---|
| 2022 | 1 | €3.15m |
| 2023 | 4 | €75.8m |
| 2024 | 4 | €2.65m |
| 2025 | 6 | €9.27m |
| 2026 | 1 | €1,135 |
16 cases
7 Apr 2026 Wspólnota Mieszkaniowa K. (Wohnungseigentümergemeinschaft, im Bescheid pseudonymisiert)Homeowners’ association: 4,852 PLN – misdirected statement not notified €1,135
Acting as processor, the property management company sent an owner’s statement of service charges to an unauthorised person. The association considered notification unnecessary because only ‘ordinary’ data of one member were affected, and maintained this position in the proceedings; the UODO (Poland’s data protection authority) imposed 4,852 PLN.
Small controllers must also assess and notify data breaches by their service providers – ‘only one data subject’ is no ground for exemption.
Recognising misdirected mail as a data breach – including at service providers
- Authority / court
- Prezes Urzędu Ochrony Danych Osobowych (UODO)
- Area of law
- Information security and cyber · Incident reporting obligations
- Legal basis
- Art. 33 Abs. 1 DSGVO
- Action
- Fine
- Status of proceedings
- final
- Sector
- Construction and real estate
Original amount 4,852 PLN, converted at the ECB reference rate of 7 Apr 2026.
- UODO, Decyzja DKN.5131.16.2025 vom 07.04.2026 (rechtskräftig) Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
23 Oct 2025 Komornik Sądowy przy Sądzie Rejonowym w S. (Gerichtsvollzieherkanzlei, im Bescheid pseudonymisiert)Bailiff: 20,900 PLN – documents with PESEL number misdirected, not notified €4,938
In October 2023, an uninvolved person received a debtor’s enforcement documents containing name, address, date of birth, PESEL number, amount of the claim and employer. The bailiff’s office neither notified the supervisory authority nor informed the data subject; the UODO (Poland’s data protection authority) imposed 7,700 PLN for the failure to notify and 13,200 PLN for the failure to inform the data subject, and ordered the data subject to be informed within three days.
Where identification numbers such as the PESEL number are disclosed, a high risk can almost always be assumed – notification of the authority and of the data subject is then mandatory.
Checking postal mailings; notifying data breaches involving identification numbers
- Authority / court
- Prezes Urzędu Ochrony Danych Osobowych (UODO)
- Area of law
- Information security and cyber · Incident reporting obligations
- Legal basis
- Art. 33 Abs. 1, Art. 34 Abs. 1 und 2 DSGVO
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Public sector
Original amount 20,900 PLN, converted at the ECB reference rate of 23 Oct 2025.
- UODO, Decyzja DKN.5131.17.2024 vom 23.10.2025 (nicht rechtskräftig) Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
17 Oct 2025 Odido Netherlands B.V.Netherlands: 1.52 million EUR against Odido – interception system without security plan and staff screening €1.52m
In inspections in 2021/22, the RDI (Rijksinspectie Digitale Infrastructuur, the Dutch Authority for Digital Infrastructure) found that the mobile operator had no mandatory security plan for its system for lawful interception of telecommunications, that employees with access had not been adequately screened (missing job descriptions, confidentiality declarations, certificates of conduct), that unauthorised persons had access to interception data and that suppliers could access the system digitally. The RDI imposed 1,518,750 EUR; Odido has since renewed the system.
Treat the security plan, staff screening and strictly limited supplier access for highly sensitive systems as the core of the obligation, not a formality.
Access rights, staff screening and supplier access for sensitive systems
- Authority / court
- Rijksinspectie Digitale Infrastructuur (RDI)
- Area of law
- Information security and cyber · Critical infrastructure
- Legal basis
- Telecommunicatiewet Art. 15.4; Besluit beveiliging gegevens telecommunicatie (Bbgt) Art. 2, 3, 4
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Telecoms, IT and software
- Mitigating circumstances
- System renewed, risk of unauthorised access eliminated.
- Published
- 17 Oct 2025
- RDI legt Odido boete op van ruim 1,5 miljoen vanwege onvoldoende beveiligd aftapsysteem Press release of an authority
- Beschikking tot oplegging bestuurlijke boete Odido (Publieksversie) Decision of an authority
Checked against the official source on 28 Sep 2026 · Direct link
Report an error
22 Sep 2025 Nova Ljubljanska banka d. d.NLB: reprimand because PSD2 interface exposed 57 account numbers Reprimand or warning
After an update of the PSD2 interface for third-party providers in July 2023, the confidentiality of 57 IBAN accounts of bank customers was not ensured. The banking supervisor, Banka Slovenije (Bank of Slovenia), issued a reprimand to the bank for breaching the obligation to protect confidential data (final).
Every change to customer interfaces requires testing for data leakage before go-live.
Security testing for software releases of interfaces
- Authority / court
- Banka Slovenije
- Area of law
- Information security and cyber · Security measures and risk management
- Legal basis
- Art. 146, Art. 396 Abs. 1 Nr. 18 ZBan-3 (slowenisches Bankengesetz)
- Action
- Reprimand or warning
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Liability of senior managers
- Measures against individuals are not reported here.
- Banka Slovenije, Veröffentlichung der Sanktion gegen Nova Ljubljanska banka d. d. (Entscheidung 2025) Decision of an authority
- Banka Slovenije – Informacije o izrečenih ukrepih Enforcement database of an authority
Checked against the official source on 28 Sep 2026 · Version 3 · Direct link
Report an error
4 Sep 2025 A*** GmbH (Werbeagentur, im Bescheid pseudonymisiert)Austrian advertising agency: 870 EUR – alert about security gap dismissed as spam €870
Customer data (including names, e-mail addresses, dates of birth, telephone numbers) could be retrieved via an unprotected development server of the advertising agency. An employee took the first alert from an external party in January 2025 to be spam; only a second alert in February reached management, which closed the gap but only notified the incident on 2 May 2025 after being requested to do so by the Datenschutzbehörde (Austrian Data Protection Authority, DSB). The authority attributed the employee’s conduct to the company.
External alerts about security gaps need a clear intake channel – what ends up in spam still counts as known.
Recognising and escalating alerts about security gaps
Missing or inadequate training played a role in the decision.
- Authority / court
- Datenschutzbehörde (DSB)
- Area of law
- Information security and cyber · Incident reporting obligations
- Legal basis
- Art. 33 Abs. 1 iVm Art. 83 Abs. 4 lit. a DSGVO
- Action
- Fine
- Status of proceedings
- final
- Sector
- Media and online platforms
- Culpability
- negligent
- Mitigating circumstances
- No previous infringements and cooperation in the proceedings; gap closed immediately after the second alert, employees trained subsequently.
- DSB, Straferkenntnis GZ 2025-0.699.550 vom 04.09.2025 (RIS) Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
10 Jul 2025 Poste Vita S.p.A.Poste Vita: 80,000 EUR – data breach notified only four months after customer’s alert €80,000
A fraudster impersonated a customer by e-mail and, between 2021 and 2023, obtained information and documents on three policies from the life insurer’s case handlers without his identity being verified. Although the customer alerted the company to the false e-mail address in September 2024, Poste Vita only notified the breach to the supervisory authority in January 2025.
Customer alerts about possible data leaks must go into the incident assessment immediately – not only after internal checks are completed.
Identity verification for customer requests by e-mail (social engineering)
- Authority / court
- Garante per la protezione dei dati personali
- Area of law
- Information security and cyber · Incident reporting obligations
- Legal basis
- Art. 5 Abs. 1 lit. a und f, Art. 33 Abs. 1 DSGVO
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Financial services and insurance
- Culpability
- negligent
- Mitigating circumstances
- Immediate blocking of further communication, internal investigation, criminal complaint and stricter identity verification.
- Garante privacy, Provvedimento del 10 luglio 2025 [10154110] Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
23 May 2025 S-Pankki OyjS-Pankki: EUR 7.67m and public warning over faulty banking software €7.67m
The Finanssivalvonta (FIN-FSA, Finnish Financial Supervisory Authority) imposed a joint penalty payment of 7,670,000 EUR on S-Pankki Oyj for failings in operational risk management and additionally issued a public warning. A programming error that was live in a bank system from 20 April to 5 August 2022 had not been adequately tested beforehand; the bank lacked a sufficiently secure system and effective incident management and was insufficiently prepared for outsourcing risks. The warning concerns the failure to apply the required strong customer authentication and payments executed without the payers' consent from 6 May to 5 August 2022; earlier penalty payments imposed on the bank by the supervisor (2019 and 2021) increased the amount. The decision is not final.
Changes to authentication and payment processing need documented testing before going live – even when a service provider develops the software.
Testing and change management for security-critical banking software
- Authority / court
- Finanssivalvonta (FIN-FSA)
- Area of law
- Information security and cyber · Security measures and risk management
- Legal basis
- Luottolaitostoiminnasta annettu laki 9 luku 16 § (1, 2 und 4 mom.) mit MOK 8/2014; FivaL 40 §, 41 §, 41 b §; öffentliche Verwarnung nach FivaL 39 § wegen Maksupalvelulaki 85 c § 1 mom. und 38 § 1 mom.
- Action
- Fine
- Status of proceedings
- under appeal
- Sector
- Financial services and insurance
- Repeat case
- yes
- Mitigating circumstances
- Measures to prevent recurrence and cooperation with the supervisor in the investigation reduced the amount.
- Published
- 23 May 2025
- Finanssivalvonta: S-Pankki Oyj:lle 7 670 000 euron yhteinen seuraamusmaksu ja julkinen varoitus (23./26.05.2025) Press release of an authority
- Finanssivalvonta: Toimituskirja johtokunnan päätöksestä 23.5.2025, FIVA/2024/1181 Decision of an authority
- Finanssivalvonta: Finanssivalvonnan päätökset (Lainvoimaisuus: S-Pankki hat beim Verwaltungsgericht Helsinki Beschwerde eingelegt) Enforcement database of an authority
Checked against the official source on 28 Sep 2026 · Direct link
Report an error
21 May 2024 a Dutch telecommunications providerNetherlands: 2.25 million EUR against a telecommunications provider over inadequately secured interception system €2.25m
According to the Dutch Authority for Digital Infrastructure (RDI), a Dutch telecommunications provider did not take the necessary measures from October 2021 to December 2022 to protect data from lawful interception of telecommunications against unauthorised persons: the security plan was inadequate, staff with access had not been sufficiently screened (missing job descriptions, confidentiality declarations, certificates of conduct), and logical and physical access controls were deficient. No actual unauthorised access was found; the fine amounts to 2.25 million EUR.
Treat interfaces for access by authorities as high-risk systems; document access controls and staff screening completely.
Access control and staff screening for interception interfaces
- Authority / court
- Rijksinspectie Digitale Infrastructuur (RDI)
- Area of law
- Information security and cyber · Critical infrastructure
- Legal basis
- Telecommunicatiewet Art. 15.4; Besluit beveiliging gegevens telecommunicatie (Bbgt) Art. 2, 3, 4, 8
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Telecoms, IT and software
- Mitigating circumstances
- Deficiencies remedied after they were identified; no actual unauthorised access found.
- Published
- 22 Oct 2024
- RDI, Nachrichten (Übersicht) (Entscheidung 2024) Press release of an authority
Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 21 May 2026 · Direct link
Report an error
12 Mar 2024 a Polish major bankPolish major bank: 1.44 million PLN – stolen customer documents not reported €336,066
A courier consignment containing bank documents (including PESEL numbers, account numbers, login credentials) was stolen and discarded on a housing estate; the supervisory authority learned of it from the media. The bank had informed neither the authority nor the data subjects because it rated the risk as low – it had already been sanctioned in 2022 for failing to notify data subjects.
Assess the risk of a data breach from the data subjects’ perspective – failing to notify the loss of sensitive documents risks a higher penalty than the breach itself.
Risk assessment and notification of data breaches
- Authority / court
- Prezes Urzędu Ochrony Danych Osobowych (UODO)
- Area of law
- Information security and cyber · Incident reporting obligations
- Legal basis
- Art. 33 Abs. 1, Art. 34 Abs. 1 DSGVO
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Financial services and insurance
- Employees
- 10,000 or more
- Repeat case
- yes
- Published
- 2 Apr 2024
Original amount 1,440,549 PLN, converted at the ECB reference rate of 12 Mar 2024.
- UODO, Nachrichten (Übersicht) (Entscheidung 2024) Press release of an authority
- UODO, Entscheidungsdatenbank (Suche) (Entscheidung 2024) Decision of an authority
Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 12 Mar 2026 · Direct link
Report an error
12 Mar 2024 a Polish bank belonging to a car manufacturerPolish bank: 78,575 PLN – misdirected mailing reported only after 1.5 years €18,331
The bank sent a customer’s contract data to the wrong recipient and only reported the breach one and a half years later, when the supervisory authority made enquiries following a complaint. Given the risk of identity theft, the authority considered that there had been an obligation to notify within 72 hours.
Even a single misdirected mailing containing identity data is notifiable – misdirected mail cases need a documented risk assessment.
Recognising misdirected mail and reporting it internally
- Authority / court
- Prezes Urzędu Ochrony Danych Osobowych (UODO)
- Area of law
- Information security and cyber · Incident reporting obligations
- Legal basis
- Art. 33 Abs. 1 DSGVO
- Action
- Fine
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Published
- 2 Apr 2024
Original amount 78,575.4 PLN, converted at the ECB reference rate of 12 Mar 2024.
- UODO, Nachrichten (Übersicht) (Entscheidung 2024) Press release of an authority
- UODO, Entscheidungsdatenbank (Suche) (Entscheidung 2024) Decision of an authority
Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 12 Mar 2026 · Direct link
Report an error
8 Feb 2024 a German major bankBaFin fines a major bank €50,000 for flawed reporting of an IT security incident €50,000
BaFin (German Federal Financial Supervisory Authority) imposed a fine of 50,000 EUR on a German major bank because the bank had given it incorrect information about a major customer-relevant IT security incident affecting its payment services in 2023 and had informed it considerably late. The decision of 8 February 2024 is final.
IT incident reports must be fast and accurate; incorrect information given to the supervisor is sanctioned in its own right.
Reporting major IT security incidents correctly and on time
- Authority / court
- Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin)
- Area of law
- Information security and cyber · Incident reporting obligations
- Legal basis
- § 64 Abs. 3 Nr. 15 ZAG
- Action
- Fine
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Employees
- 10,000 or more
- Published
- 18 Mar 2024
- BaFin, Maßnahmen und Sanktionen (Übersicht) (Entscheidung 2024) Press release of an authority
Checked against the official source on 2 Oct 2026 · Company name anonymised since 8 Feb 2026 · Direct link
Report an error
17 Nov 2023 a Luxembourg credit institutionLuxembourg credit institution: EUR 444,400 for IT governance failings €444,400
The CSSF imposed an administrative fine (amende d'ordre) of EUR 444,400 on the credit institution because its internal governance and control over ICT and security risks fell short of the requirements. The fine followed an on-site inspection from October 2022 to June 2023 concerning Art. 5(1bis) LSF (Luxembourg Law on the Financial Sector) and CSSF Circulars 20/750 and 12/552.
IT and security risks need their own documented governance and control framework; the supervisor sanctions gaps in it as a breach in their own right.
ICT governance and control of IT and security risks
- Authority / court
- Commission de Surveillance du Secteur Financier (CSSF)
- Area of law
- Information security and cyber · Security measures and risk management
- Legal basis
- Art. 63-2(1)(d) und (2)(e) Loi modifiée du 5 avril 1993 relative au secteur financier (LSF); verletzt Art. 5(1bis) LSF; Circulaires CSSF 20/750 und 12/552
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Financial services and insurance
- Mitigating circumstances
- The institution accepted all findings, submitted a detailed action plan and started remediation immediately.
- Published
- 20 Feb 2024
- CSSF, Sanction administrative du 17 novembre 2023 (Mizuho Trust & Banking (Luxembourg) S.A.) Decision of an authority
Checked against the official source on 2 Oct 2026 · Company name anonymised since 17 Nov 2025 · Direct link
Report an error
18 Oct 2023 a Polish insurerPolish insurer: 103,752 PLN – misdirected e-mail not reported after using a risk calculator €23,362
The insurer sent a claims settlement confirmation containing name, address, vehicle and claim data by e-mail to an unauthorised person. After an assessment using an online calculator, it rated the risk as low and did not notify; the supervisory authority found that the notification obligation had been breached and treated, among other things, intent and lack of cooperation as aggravating factors.
Risk assessment tools do not replace judgement – anyone sending out information covered by insurance secrecy should notify if in doubt.
Avoiding misdirected e-mails; reporting data breaches
- Authority / court
- Prezes Urzędu Ochrony Danych Osobowych (UODO)
- Area of law
- Information security and cyber · Incident reporting obligations
- Legal basis
- Art. 33 Abs. 1 DSGVO
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Financial services and insurance
- Culpability
- intentional
- Repeat case
- yes
- Published
- 23 Nov 2023
Original amount 103,752 PLN, converted at the ECB reference rate of 18 Oct 2023.
- UODO, Nachrichten (Übersicht) (Entscheidung 2023) Press release of an authority
- UODO, Entscheidungsdatenbank (Suche) (Entscheidung 2023) Decision of an authority
Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 18 Oct 2025 · Direct link
Report an error
14 Mar 2023 a Swedish major bankMajor bank: 850 million SEK – unapproved IT change led to wrong balances and blocked payments €75.3m
Finansinspektionen (Swedish Financial Supervisory Authority) issued a Swedish major bank with a remark (anmärkning) and an administrative fine of 850,000,000 SEK because on 28 April 2022 the bank made a change to a business-critical IT system – to implement new EU sanctions – without following its internal change management process: without approval by the Change Advisory Board, without a risk assessment and without a rollback plan. The resulting error stopped around 1.7 million transactions to about 1.1 million accounts, showed incorrect balances for almost 960,000 customers and prevented around 160,000 customers from making payments; because none of the bank's controls had detected that the process was bypassed, the supervisor found the internal control of this systemically important bank to be inadequate. It treated an earlier sanction from 2020 (oversight of anti-money laundering measures in subsidiary banks) as aggravating and, in the bank's favour, the fact that the breach was neither long-lasting nor systematic.
Even urgent changes to critical IT systems prompted by regulation must go through the regular change process, and controls must detect when individuals bypass it.
Change management: no change to critical IT systems without approval, risk assessment and a rollback plan
- Authority / court
- Finansinspektionen (FI)
- Area of law
- Information security and cyber · Critical infrastructure
- Legal basis
- 6 kap. 2 § lagen (2004:297) om bank- och finansieringsrörelse (LBF) i. V. m. 2 kap. 1 § första stycket 5 FFFS 2014:1; Anmärkning nach 15 kap. 1 § LBF, Sanktionsavgift nach 15 kap. 7 § LBF
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Financial services and insurance
- Employees
- 10,000 or more
- Repeat case
- yes
- Mitigating circumstances
- Not a long-lasting or systematic breach; the bank has taken, and announced further, measures to strengthen internal control.
- Published
- 15 Mar 2023
Original amount 850,000,000 SEK, converted at the ECB reference rate of 14 Mar 2023.
- Finansinspektionen, Sanktionen (Übersicht) (Entscheidung 2023) Decision of an authority
Checked against the official source on 28 Sep 2026 · Company name anonymised since 14 Mar 2025 · Direct link
Report an error
20 Feb 2023 a Greek telecommunications providerGreek telecoms provider: 40,000 EUR – other customer’s call recordings sent out, not notified €40,000
In response to her access request, a customer received a CD containing call centre conversations of another customer. The provider did not investigate the alert itself but relied on the service provider and asked for the CD to be returned; the authority sanctioned the failure to notify and the failure to comply with the access request.
If a data subject reports a breach at a service provider, the controller must investigate and notify itself – this obligation cannot be delegated.
Taking data subjects’ alerts about data breaches seriously
- Authority / court
- Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic DPA)
- Area of law
- Information security and cyber · Incident reporting obligations
- Legal basis
- Art. 15, Art. 33 DSGVO
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Telecoms, IT and software
- Published
- 30 Mar 2023
- Hellenic DPA, Entscheidungen (Übersicht) (Entscheidung 2023) Press release of an authority
Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 20 Feb 2025 · Direct link
Report an error
7 Dec 2022 a Spanish bankSpanish bank: €3.145m ECB penalty for late reporting of a cyber incident €3.15m
The bank reported a significant cyber incident from February 2019 to the ECB not within the prescribed two hours but only 46 hours after the deadline, although it knew of the reporting obligation and the seriousness of the incident; it thereby breached an ECB decision of 23 May 2017. The ECB classified the breach as severe, imposed 3,145,000 EUR and took into account the very active cooperation and the bank's own remedial action as mitigating.
Reporting deadlines for significant cyber incidents also apply while the crisis is being handled; notifying the supervisor belongs firmly in the incident response plan.
Cyber incident reporting obligations
- Authority / court
- Europäische Zentralbank (EZB), Bankenaufsicht
- Area of law
- Information security and cyber · Incident reporting obligations
- Legal basis
- Art. 18 Abs. 7 VO (EU) Nr. 1024/2013; EZB-Beschluss vom 23. Mai 2017 (Meldung erheblicher Cybervorfälle)
- Action
- Fine
- Status of proceedings
- final
- Sector
- Financial services and insurance
- Culpability
- intentional
- Mitigating circumstances
- Very active cooperation with the ECB, own remedial action and prompt handling of the effects of the incident.
- Published
- 16 Dec 2022
- EZB-Bankenaufsicht, veröffentlichte Sanktionen (Übersicht) (Entscheidung 2022) Official register or notice
Checked against the official source on 28 Sep 2026 · Company name anonymised since 7 Dec 2024 · Direct link