Compliance Radar
Who was sanctioned, and for what?
Fines, court rulings and incidents from Europe, North America, Latin America, Asia-Pacific, Middle East and Africa: 2,033 cases from 44 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.
Click a bar to drill down one level.
Where?
by regionAll jurisdictions
What for?
by area of lawAll areas of law
Who?
by company- McKinsey and Company Africa (Pty) Ltd €116.6m 37 % · 1 case
- Anonymised companies €31m 10 % · 29 cases
- SURYS SAS (Gruppe Imprimerie Nationale) €18.4m 6 % · 1 case
- Capita plc und Capita Pension Solutions Limited €16.1m 5 % · 1 case
- Ö Aktiengesellschaft (in der Entscheidung abgekürzt; Adressverlag und Direktwerbeunternehmen) €13m 4 % · 1 case
- Platinum Gaming Limited €11.5m 4 % · 1 case
- BIT Mining Ltd. (vormals 500.com) €9.48m 3 % · 1 case
- Stericycle, Inc. €9.23m 3 % · 1 case
- Philip Morris Italia S.r.l. €7m 2 % · 1 case
- Società Cooperativa Culture (CoopCulture) €7m 2 % · 1 case
- 115 more€75.6m
When?
per quarter, by date of decision| Period | Cases | Total |
|---|---|---|
| Q4 2023 | 0 | – |
| Q1 2024 | 0 | – |
| Q2 2024 | 0 | – |
| Q3 2024 | 0 | – |
| Q4 2024 | 0 | – |
| Q1 2025 | 0 | – |
| Q2 2025 | 0 | – |
| Q3 2025 | 0 | – |
| Q4 2025 | 1 | €31,252 |
| Q1 2026 | 0 | – |
| Q2 2026 | 0 | – |
| Q3 2026 | 0 | – |
| Q4 2026 | 0 | – |
1 case
31 Oct 2025 Air Sino-Euro Associates Travel Pte. Ltd.Air Sino-Euro: 47,000 SGD – no data protection officer, no internal rules, data leak €31,252
After a cyberattack on the travel agency became public in December 2023, data on 336,759 individuals in its booking system was affected, in some cases including full images of identity cards, passports and birth certificates; part of the data was exfiltrated. The Personal Data Protection Commission (PDPC, Singapore's data protection authority) found negligent breaches of the Accountability Obligation – a data protection officer appointed only in April 2024, and apart from the customer-facing privacy policy no internal policies, no complaints process and no information to staff – and of the Protection Obligation, because there were no contracts with the IT vendors covering security tasks, no security reviews and no multi-factor authentication, and the server was still running the unsupported Windows Server 2012. It imposed 47,000 SGD, rejected objections based on COVID-19 losses and comparable cases, and directed among other things policies, security clauses in vendor contracts and a penetration test by a provider licensed by the Cyber Security Agency (CSA).
An outward-facing privacy policy is no substitute for a designated data protection officer or for internal rules that staff know and that apply in day-to-day work.
Internal data protection policies, communicating them to staff, and password rules
Missing or inadequate training played a role in the decision.
- Authority / court
- Personal Data Protection Commission (PDPC)
- Area of law
- Data protection · Data subject rights and transparency
- Legal basis
- Sections 11(3) und 12 PDPA 2012 (Accountability Obligation); Section 24 PDPA (Protection Obligation); Section 48J(1)(a) PDPA (Financial Penalty); Section 48I PDPA (Directions)
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Other
- Culpability
- negligent
- Mitigating circumstances
- Voluntary early admission of the breaches (treated as significantly mitigating) and prompt, effective remediation.
- Published
- 8 Jan 2026
Original amount 47,000 SGD, converted at the ECB reference rate of 31 Oct 2025.
- PDPC – Enforcement Decisions: Breach of the Accountability and Protection Obligations by Air Sino-Euro Associates Travel Pte Ltd (veröffentlicht 08.01.2026) Enforcement database of an authority
- PDPC – Decision [2025] SGPDPC [5], Air Sino-Euro Associates Travel Pte. Ltd., Case No. DP-2312-C1857 (31.10.2025), PDF Decision of an authority
Checked against the official source on 4 Oct 2026 · Direct link