Compliance Radar
Who was sanctioned, and for what?
Fines, court rulings and incidents from Europe, North America, Latin America, Asia-Pacific and Middle East: 1,929 cases from 40 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.
Click a bar to drill down one level.
Where?
by regionAll jurisdictions
What for?
by area of lawAll areas of law
Who?
by company- Anonymised companies €342.6m 31 % · 12 cases
- Ryanair DAC, Ryanair Holdings plc €255.8m 23 % · 1 case
- Ryanair €107.8m 10 % · 1 case
- MLU B.V. (Rechtsnachfolgerin der Ridetech International B.V., Anbieterin der Yango-App) €100m 9 % · 1 case
- AAR Corp. €53.5m 5 % · 1 case
- České dráhy (ČD) und Österreichische Bundesbahnen (ÖBB) €48.7m 4 % · 1 case
- United Parcel Service Inc. (UPS) €43.2m 4 % · 1 case
- Vueling €39.3m 4 % · 1 case
- Brink’s Global Services USA, Inc. €35.6m 3 % · 1 case
- Amazon France Logistique SAS €15m 1 % · 1 case
- 44 more€76m
When?
per quarter, by date of decision| Period | Cases | Total |
|---|---|---|
| Q4 2023 | 0 | – |
| Q1 2024 | 0 | – |
| Q2 2024 | 0 | – |
| Q3 2024 | 0 | – |
| Q4 2024 | 0 | – |
| Q1 2025 | 0 | – |
| Q2 2025 | 0 | – |
| Q3 2025 | 0 | – |
| Q4 2025 | 0 | – |
| Q1 2026 | 1 | €2.72m |
| Q2 2026 | 0 | – |
| Q3 2026 | 0 | – |
| Q4 2026 | 0 | – |
1 case
5 Feb 2026 DPD Polska sp. z o.o.DPD Polska: PLN 11.46m in fines, including for missing data processing agreements €2.72m
The UODO (Urząd Ochrony Danych Osobowych, Polish data protection authority) fined the parcel carrier DPD Polska sp. z o.o. a total of PLN 11,461,030. PLN 6,251,471 relates to the company using external hauliers for shipments between its depots without a data processing agreement under Art. 28(3) GDPR, although they had access to the address labels during loading and unloading; PLN 5,209,559 relates to staff not being given effective authorisations to process data and the company's own data protection policy not being implemented (Art. 24, 29, 32 GDPR). The authority classed both infringements as intentional and treated earlier reprimands against the company as aggravating. The decision is not final.
Even pure transport providers can be processors if they have access to personal data such as address labels – an Art. 28 GDPR contract is then mandatory.
Recognising data processing by logistics and transport providers
- Authority / court
- Prezes Urzędu Ochrony Danych Osobowych (UODO)
- Area of law
- Data protection · Data processors
- Legal basis
- Art. 28 Abs. 3 i. V. m. Art. 5 Abs. 1 lit. a und Abs. 2 DSGVO; Art. 24 Abs. 1 und 2, Art. 29, Art. 32 Abs. 1 und 4 i. V. m. Art. 5 Abs. 1 lit. f und Abs. 2 DSGVO; Art. 83 Abs. 4 lit. a und Abs. 5 lit. a DSGVO
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Transport, logistics and shipping
- Culpability
- intentional
- Repeat case
- yes
- Mitigating circumstances
- It was treated as mitigating that, after the proceedings were opened, DPD amended its contracts with the hauliers to include data processing terms and changed its procedure for granting authorisations.
- Liability of senior managers
- No personal liability was established.
- Published
- 23 Feb 2026
Original amount 11,461,030 PLN, converted at the ECB reference rate of 5 Feb 2026.
- UODO: Naruszenie przepisów RODO przez firmę kurierską (23.02.2026) Press release of an authority
- Decyzja Prezesa UODO DKN.5112.1.2023 vom 5. Februar 2026 (Portal Orzeczeń UODO) Decision of an authority
Checked against the official source on 28 Sep 2026 · Direct link