Compliance Radar
Who was sanctioned, and for what?
Fines, court rulings and incidents from Europe, North America, Latin America, Asia-Pacific, Middle East and Africa: 2,207 cases from 44 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.
Click a bar to drill down one level.
Where?
by authority- Datatilsynet €133,684 100 % · 1 case
What for?
by area of lawAll areas of law
Who?
by company- Anonymised companies €133,684 100 % · 1 case
When?
per year, by date of decision| Period | Cases | Total |
|---|---|---|
| 2023 | 1 | €133,684 |
| 2024 | 0 | – |
| 2025 | 0 | – |
| 2026 | 0 | – |
1 case
8 Mar 2023 a US medical device manufacturerUS medical device manufacturer: fine for late notification of a data breach €133,684
Datatilsynet (Norwegian Data Protection Authority) fined a US medical device manufacturer NOK 2,500,000 because it notified a cyber incident affecting the data of all its European employees (including one person in Norway) only 67 days after becoming aware of it instead of within 72 hours (Art. 33(1) GDPR). Under its internal rules, the manufacturer intended to notify only once the incident had been fully investigated. Following the company's appeal, the fine was reduced to NOK 1,500,000 because of the long case-handling time before the matter was dealt with by the Personvernnemnda (Privacy Appeals Board); the Personvernnemnda upheld the decision at that amount.
The 72-hour deadline for data breaches starts when the controller becomes aware of the incident; internal rules that postpone notification until the investigation is complete are unlawful.
Notifying data breaches within 72 hours
- Authority / court
- Datatilsynet
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- Art. 33 Abs. 1, Art. 58 Abs. 2 lit. i, Art. 83 Abs. 4 lit. a DSGVO
- Action
- Fine
- Status of proceedings
- reduced
- Sector
- Healthcare
- Culpability
- negligent
- Mitigating circumstances
- Reduction to NOK 1,500,000 because of the long case-handling time before the matter was dealt with by the Personvernnemnda.
- Published
- 16 Mar 2023
Original amount 1,500,000 NOK, converted at the ECB reference rate of 8 Mar 2023.
- Datatilsynet (NO), zentrale Entscheidungen (Übersicht) (Entscheidung 2023) Decision of an authority
Checked against the official source on 28 Sep 2026 · Company name anonymised since 8 Mar 2025 · Direct link