Compliance Radar

Who was sanctioned, and for what?

Fines, court rulings and incidents from Europe, North America, Latin America, Asia-Pacific, Middle East and Africa: 2,207 cases from 44 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.

85cases from 29 jurisdictions
€1.17bnTotal of monetary amounts (67 cases with an amount)
€1.33mMedian per case with an amount

Click a bar to drill down one level.

Where?

by region

All jurisdictions

  1. EU 44 cases 52 % · €979.7m
  2. United Kingdom 12 cases 14 % · €2.04m
  3. USA 10 cases 12 % · €140.2m
  4. Canada 4 cases 5 % · €1.42m
  5. Singapore 3 cases 4 % · €2.07m
  6. South Africa 3 cases 4 % · €1.94m
  7. Brazil 2 cases 2 % · €29m
  8. Switzerland 2 cases 2 % · €98,722
  9. New Zealand 2 cases 2 % · €1.49m
  10. Australia 1 case 1 % · €755,668
  11. 2 more2 cases

What for?

by area of law

All areas of law

  1. Data protection 26 cases 31 % · €437.7m
  2. Competition law 15 cases 18 % · €349.6m
  3. Environment and sustainability 11 cases 13 % · €26.4m
  4. Consumer protection and online retail 9 cases 11 % · €181.5m
  5. Sanctions and export control 7 cases 8 % · €4.42m
  6. Capital markets and financial supervision 6 cases 7 % · €43.8m
  7. Health and safety and employment law 5 cases 6 % · €1.09m
  8. Bribery and corruption 3 cases 4 % · €82.5m
  9. Money laundering and terrorist financing 1 case 1 % · €35.6m
  10. Whistleblower protection 1 case 1 % · €8,222
  11. 1 more1 case

Who?

by company
  1. Anonymised companies 26 cases 31 % · €384m
  2. A.P. Møller-Mærsk A/S 1 case 1 % · €1.34m
  3. AAR Corp. 1 case 1 % · €53.5m
  4. AENA, S.M.E., S.A. 1 case 1 % · €10m
  5. Air Caraïbes (mit Groupe Dubreuil Aéro, Groupe Dubreuil); K Finance (Mutter von Air Antilles/CAIRE); Miles Plus 1 case 1 % · €14.6m
  6. Amazon France Logistique SAS 1 case 1 % · €15m
  7. Amazon Italia Logistica S.r.l. 1 case 1 % ·
  8. Aramex New Zealand Holdings Limited 1 case 1 % · €355,800
  9. Avis 1 case 1 % · €1m
  10. Ayzo Pte Ltd 1 case 1 % · €24,218
  11. 49 more49 cases

When?

per year, by date of decision
Trend
PeriodCasesTotal
20224€9.31m
20239€14.1m
202423€682.8m
202529€346.7m
202620€116.6m

85 cases

28 Aug 2026 MSC Shipmanagement Limited; Hong Kong Spirit Shipping and Trading LimitedMSC Shipmanagement: 1.75 million USD fine for secretly discharging oily bilge water USAWaste and hazardous substances €1.5m

On board the MSC Samira III, oily bilge water was pumped overboard via the sewage tank, bypassing the oily water separator, in 2024/2025; the oil content monitoring was manipulated and the oil record book, which was presented to the Coast Guard in Philadelphia, was falsified. The operator and the owner each pleaded guilty to two counts under the Act to Prevent Pollution from Ships (APPS) and are paying a combined 1.75 million USD; in addition, there are four years of probation.

What organisations can take from it

Shipping companies must actively monitor practice on board and the oil record book, because instructions given by individual officers are attributed to the company under criminal law.

Relevance to training and awareness

MARPOL obligations on board, oil record book and reporting channels for crews

Authority / court
U.S. District Court for the Eastern District of Pennsylvania (Anklage: DOJ Environment and Natural Resources Division)
Area of law
Environment and sustainability · Waste and hazardous substances
Legal basis
Act to Prevent Pollution from Ships (APPS), 33 U.S.C. § 1908
Action
Fine
Status of proceedings
unknown
Sector
Transport, logistics and shipping
Employees
10,000 or more
Culpability
intentional
Published
28 Aug 2026

Original amount 1,750,000 USD, converted at the ECB reference rate of 28 Aug 2026.

Checked against the official source on 28 Sep 2026 · Version 3 · Direct link

Report an error

Anonymous: we store only your text, no contact details and no IP address.

11 Aug 2026 Volga-Dnepr Airlines LLCFederal Court: cargo airline Volga-Dnepr remains on Canadian sanctions list CanadaBreaches of sanctions and embargoes Order

The Russian cargo airline had been added to the list of the Special Economic Measures (Russia) Regulations in April 2023; the Minister of Foreign Affairs rejected the application for delisting. The Federal Court (2026 FC 1048) dismissed the application for judicial review: the Minister had not exercised her broad discretion unreasonably, and there was no procedural error.

What organisations can take from it

Listed logistics partners often remain listed for years – anyone buying air freight must continuously screen carriers and parent companies against sanctions lists.

Relevance to training and awareness

Listings of transport service providers in partner screening

Authority / court
Federal Court (2026 FC 1048); Minister of Foreign Affairs
Area of law
Sanctions and export control · Breaches of sanctions and embargoes
Legal basis
Special Economic Measures Act; Special Economic Measures (Russia) Regulations, SOR/2014-58, ss. 2(a), 8
Action
Order
Status of proceedings
unknown
Sector
Transport, logistics and shipping

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Anonymous: we store only your text, no contact details and no IP address.

4 Aug 2026 Lime Technology S.r.l., EmTransit S.r.l. (Dott), Bird Rides Italy S.r.l.Rome: 2.675 million EUR against e-scooter and e-bike sharing providers over blocked free rides ItalyInformation duties in online retail €2.68m

The three sharing providers made it difficult for holders of a Metrebus annual pass to access the free-ride passes promised when the concessions were awarded, through inadequate organisation, cumbersome activation and long waiting times, which shortened the usable time; Bird also deactivated accounts without prior notice. The AGCM imposed fines totalling 2.675 million EUR in three proceedings (Lime 1.4 million, Dott 525,000, Bird 750,000 EUR).

What organisations can take from it

Promised benefits must also be redeemable in organisational terms – sluggish processing can itself be unfair.

Relevance to training and awareness

Customer service and redemption of promised services

Authority / court
Autorità Garante della Concorrenza e del Mercato (AGCM)
Area of law
Consumer protection and online retail · Information duties in online retail
Legal basis
Codice del Consumo (pratiche commerciali scorrette), Verfahren PS13028, PS13029, PS13030
Action
Fine
Status of proceedings
unknown
Sector
Transport, logistics and shipping
Published
6 Aug 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Anonymous: we store only your text, no contact details and no IP address.

29 Jul 2026 AvisAvis: maximum fine of 1 million EUR for handling fee on traffic fines SpainInformation duties in online retail €1m

The car rental company charged customers an "administration fee" of 33.88 to 45 EUR when a rental car incurred a traffic offence – even though naming the driver is a statutory obligation of the rental company. Spain's Ministry of Social Rights, Consumer Affairs and 2030 Agenda classified this as a very serious infringement and imposed the maximum fine of 1 million EUR; a court had already declared the clause void in 2020.

What organisations can take from it

No additional fee may be charged for fulfilling statutory obligations – least of all after a court has prohibited the clause.

Authority / court
Ministerio de Derechos Sociales, Consumo y Agenda 2030
Area of law
Consumer protection and online retail · Information duties in online retail
Legal basis
Artt. 82, 87.5 y 87.6 TRLGDCU (Real Decreto Legislativo 1/2007)
Action
Fine
Status of proceedings
unknown
Sector
Transport, logistics and shipping
Repeat case
yes
Published
29 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Anonymous: we store only your text, no contact details and no IP address.

28 Jul 2026 TrenitaliaTrenitalia removes hurdles to refunds for delays following AGCM proceedings ItalyInformation duties in online retail Order

For refunds in the event of delays of 60 minutes or more or cancellations, Trenitalia required prior written confirmation from the call centre or ticket office. The AGCM accepted binding commitments: abolition of the confirmation requirement, strengthened refund channels, an information page on disruptions and an implementation report within three months; no infringement was found.

What organisations can take from it

Additional formalities before statutory refunds act as a hurdle and lead to proceedings.

Authority / court
Autorità Garante della Concorrenza e del Mercato (AGCM)
Area of law
Consumer protection and online retail · Information duties in online retail
Legal basis
Codice del Consumo (impegni); EU-Fahrgastrechte im Eisenbahnverkehr
Action
Order
Status of proceedings
final
Sector
Transport, logistics and shipping
Mitigating circumstances
Binding commitments, no finding of an infringement.
Published
30 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Anonymous: we store only your text, no contact details and no IP address.

16 Jul 2026 Royal Mail Group LtdTribunal: Royal Mail subjected whistleblower to detriment – £6,978 compensation United KingdomRetaliation against whistleblowers €8,222

The Employment Tribunal in Manchester found that the claimant had been subjected to detriment because of a protected disclosure and awarded her the agreed amount of £6,978.20. The claims for disability discrimination and constructive dismissal were dismissed.

What organisations can take from it

Large organisations, too, must ensure that whistleblowers do not suffer disadvantages in their day-to-day work.

Relevance to training and awareness

How managers handle internal reports

Authority / court
Employment Tribunal
Area of law
Whistleblower protection · Retaliation against whistleblowers
Legal basis
Employment Rights Act 1996, s. 47B (Benachteiligung wegen geschützter Offenlegung)
Action
Other
Status of proceedings
unknown
Sector
Transport, logistics and shipping
Employees
10,000 or more
Published
7 Sep 2026

Original amount 6,978.2 GBP, converted at the ECB reference rate of 16 Jul 2026.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

Report an error

Anonymous: we store only your text, no contact details and no IP address.

7 Jul 2026 Unternehmen mit drei Dienstfahrzeugen (in der Mitteilung nicht namentlich genannt)Administrative Court upholds ban on continuous GPS tracking of three company vehicles SloveniaEmployee data Order

The data protection authority had prohibited a company from tracking its three company vehicles continuously by GPS and ordered the data to be erased; narrow purposes such as theft protection while parked remained permitted. The Upravno sodišče Republike Slovenije (Administrative Court of the Republic of Slovenia) upheld this and clarified that employee consent bundled with other declarations is invalid.

What organisations can take from it

Employee consent rarely supports monitoring – and never when it is bundled with other declarations in the form.

Relevance to training and awareness

Consent and proportionality in employee monitoring

Authority / court
Upravno sodišče Republike Slovenije (bekanntgemacht durch den Informacijski pooblaščenec)
Area of law
Data protection · Employee data
Legal basis
Art. 6 Abs. 1 lit. f, Art. 7 Abs. 2 DSGVO
Action
Order
Status of proceedings
unknown
Sector
Transport, logistics and shipping
Published
7 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Anonymous: we store only your text, no contact details and no IP address.

3 Jul 2026 TMA Haulage LtdTMA Haulage: operator licence curtailed from five to four vehicles, revocation from 6 October 2026 United KingdomWorking time Other

Following an investigation by the Driver and Vehicle Standards Agency (DVSA), the Traffic Commissioner (regulator of commercial vehicle operators) found that the sole director of TMA Haulage Ltd had driven using the driver card of a former employee, thereby falsifying the records, three times in June and July 2025 and – after being interviewed by the DVSA – twice in April 2026; on one of those days he continued driving in this way without taking the break that was due. The operator's licence was curtailed immediately from five to four vehicles and revoked with effect from 6 October 2026. Measures against individuals are not set out here.

What organisations can take from it

Driver cards are strictly personal – regularly comparing vehicle unit data with the cards of the drivers deployed uncovers misuse before the authority does.

Relevance to training and awareness

Drivers' hours and misuse of driver cards

Authority / court
Traffic Commissioner (Western Traffic Area); Ermittlung: Driver and Vehicle Standards Agency (DVSA)
Area of law
Health and safety and employment law · Working time
Legal basis
Goods Vehicles (Licensing of Operators) Act 1995, ss. 26(1)(f), 27(1)(a) und (b); Road Traffic Act 1988, ss. 115, 117; Tachografen- und Lenkzeitvorschriften
Action
Other
Status of proceedings
unknown
Sector
Transport, logistics and shipping
Culpability
intentional
Mitigating circumstances
According to the decision, points in the company's favour were: most compliance systems in place, drivers properly employed, an MOT pass rate in line with the national average, and the re-engagement of a consultant and legal representation.
Liability of senior managers
Measures against individuals are not set out here.
Published
22 Jul 2026

Checked against the official source on 3 Oct 2026 · Direct link

Report an error

Anonymous: we store only your text, no contact details and no IP address.

24 Jun 2026 Exmar NVExmar: €350,000 for late disclosure of inside information BelgiumDisclosure and reporting obligations €350,000

The Sanctions Committee of the FSMA (Belgian Financial Services and Markets Authority) found that the shipping company Exmar NV, listed on Euronext Brussels, had not disclosed as soon as possible inside information it held on 19 May and 18 June 2020; the information related to a customer's missing payments for the charter of a floating LNG facility. It imposed a fine of 350,000 EUR and ordered publication by name for one year. Exmar has lodged an appeal with the Market Court.

What organisations can take from it

Payment problems of a major customer can be inside information; the ad hoc assessment must be carried out immediately and documented.

Relevance to training and awareness

Ad hoc disclosure: identifying and promptly publishing inside information

Authority / court
Autoriteit voor Financiële Diensten en Markten / Autorité des services et marchés financiers (FSMA) – Sanctiecommissie
Area of law
Capital markets and financial supervision · Disclosure and reporting obligations
Legal basis
Art. 17 Verordnung (EU) Nr. 596/2014 (MAR); Art. 36 § 2 und Art. 72 § 3 Gesetz vom 2. August 2002 über die Aufsicht über den Finanzsektor
Action
Fine
Status of proceedings
under appeal
Sector
Transport, logistics and shipping

Checked against the official source on 2 Oct 2026 · Direct link

Report an error

Anonymous: we store only your text, no contact details and no IP address.

22 May 2026 Streamline Shipping Agencies LimitedAberdeen port agency: £146,700 after forklift accident without traffic separation United KingdomWorkplace safety and accidents €169,756

At the Port of Aberdeen, an employee loosening a lorry curtain was struck by a reversing forklift truck and suffered multiple fractures and a degloving injury. Pedestrians and vehicles were not separated during simultaneous loading and unloading. Fine of £146,700. According to the annual accounts filed with the UK companies register for financial year 2025, the company had around 236 employees.

What organisations can take from it

Loading and manoeuvring areas need firm rules on who may be where and when if forklifts and pedestrians are working at the same time.

Authority / court
Aberdeen Sheriff Court (Ermittlung: Health and Safety Executive)
Area of law
Health and safety and employment law · Workplace safety and accidents
Legal basis
Regulation 17(1) Workplace (Health, Safety and Welfare) Regulations 1992; Section 33(1)(c) Health and Safety at Work etc. Act 1974
Action
Fine
Status of proceedings
final
Sector
Transport, logistics and shipping
Employees
50 to 249
Published
28 May 2026

Original amount 146,700 GBP, converted at the ECB reference rate of 22 May 2026.

Checked against the official source on 28 Sep 2026 · Version 3 · Direct link

Report an error

Anonymous: we store only your text, no contact details and no IP address.

8 May 2026 Transport Desgagnés Inc.Transport Desgagnés: 40,000 CAD because a tanker entered an Arctic protected area without a permit Canada, NUEnvironment and sustainability €24,902

The tanker M/T Sarah Desgagnés, operated by the company, entered the Akpait National Wildlife Area in Nunavut on 29 September and 6 October 2024 without the required access permit. The Nunavut Court of Justice imposed 40,000 CAD for the Environmental Damages Fund; the company must publish a notice in a local newspaper and is listed in the Environmental Offenders Registry.

What organisations can take from it

Protected area boundaries belong in every vessel's voyage planning; missing access permits are prosecuted even in remote areas.

Relevance to training and awareness

Protected areas in voyage planning and bridge practice

Authority / court
Nunavut Court of Justice (Ermittlungen: Environment and Climate Change Canada)
Area of law
Environment and sustainability
Legal basis
Wildlife Area Regulations (Canada Wildlife Act), Paragraph 3.3(1)(h)
Action
Fine
Status of proceedings
unknown
Sector
Transport, logistics and shipping
Published
8 May 2026

Original amount 40,000 CAD, converted at the ECB reference rate of 8 May 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Anonymous: we store only your text, no contact details and no IP address.

4 May 2026 Berliner Verkehrsbetriebe (BVG) AöRBlnBDI reprimands BVG: deletion at service provider not checked, data breach reported too late GermanyData processors Reprimand or warning

A processor of Berlin's public transport operator BVG, which had sent customer letters in early 2025, was hacked; around 180,000 customer records were affected, although they should long since have been deleted after the end of the contract. BVG had never checked the deletion, had not agreed any procedure for data breaches in the data processing agreement and reported the incident only after the 72-hour deadline had expired; the Berlin Commissioner for Data Protection and Freedom of Information (BlnBDI) issued a reprimand.

What organisations can take from it

Have service providers prove deletion after the end of the contract, and have an internal procedure that immediately turns indications of a breach into a 72-hour notification.

Relevance to training and awareness

Reporting process for data breaches and management of service providers

Authority / court
Berliner Beauftragte für Datenschutz und Informationsfreiheit (BlnBDI)
Area of law
Data protection · Data processors
Legal basis
Art. 5 Abs. 2 i. V. m. Abs. 1 lit. c, e, f, Art. 28 Abs. 3 S. 2 lit. f, Art. 32 Abs. 1, Art. 33 DSGVO
Action
Reprimand or warning
Status of proceedings
unknown
Sector
Transport, logistics and shipping
Mitigating circumstances
BVG has announced measures against similar incidents.
Published
4 May 2026
Sources

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Anonymous: we store only your text, no contact details and no IP address.

10 Apr 2026 Koninklijke PostNL B.V.ACM: €6.9m fine for PostNL over late letter delivery in 2023 NetherlandsOther €6.92m

In 2023 PostNL delivered only 89.48% of letters with a five-day delivery obligation under the universal postal service on time, instead of the statutory 95%. The ACM (Autoriteit Consument & Markt, Dutch competition and consumer authority) rejected the force majeure argument based on the tight labour market and imposed a fine of 6,923,000 EUR.

What organisations can take from it

A company bearing a statutory service obligation must compensate for foreseeable staff shortages in good time; labour market conditions alone are not force majeure.

Authority / court
Autoriteit Consument & Markt (ACM)
Area of law
Other
Legal basis
Art. 16 Abs. 6 Postwet 2009 i. V. m. Art. 4a Postbesluit 2009
Action
Fine
Status of proceedings
unknown
Sector
Transport, logistics and shipping
Published
12 May 2026

Checked against the official source on 2 Oct 2026 · Direct link

Report an error

Anonymous: we store only your text, no contact details and no IP address.

1 Apr 2026 MLU B.V. (Rechtsnachfolgerin der Ridetech International B.V., Anbieterin der Yango-App)Yango taxi app: 100 million EUR for transferring data to Russia NetherlandsInternational data transfers €100m

Amsterdam-based Ridetech offered the ride-hailing app Yango in Finland and Norway and transferred data of drivers and customers to the group companies Yandex.Taxi LLC and Yandex LLC in Russia without demonstrating appropriate safeguards. The Autoriteit Persoonsgegevens (Dutch Data Protection Authority, AP) imposed 100 million EUR on the legal successor and prohibited further transfers to Russia.

What organisations can take from it

Transfers to states without legal protection against access by authorities can hardly be safeguarded – group structures with such locations need data localisation in the EU.

Authority / court
Autoriteit Persoonsgegevens (AP)
Area of law
Data protection · International data transfers
Legal basis
Art. 44, Art. 46 iVm Art. 5 Abs. 1 lit. a und Abs. 2 DSGVO
Action
Fine
Status of proceedings
unknown
Sector
Transport, logistics and shipping

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Anonymous: we store only your text, no contact details and no IP address.

11 Mar 2026 Iberia Líneas Aéreas de España, S.A. OperadoraAEPD: €650,000 fine for Iberia after unauthorised access at service provider SpainData breaches and data security €650,000

In February 2023 there was external, unauthorised access to a system operated by a processor containing data on users and employees. As lead authority, the AEPD imposed 650,000 EUR for breaching Art. 5(1)(f) GDPR, dropped the charges under Art. 32 and 34 and ordered appropriate security measures within six months. The amount and the facts have not been confirmed against the primary source.

What organisations can take from it

Even where a service provider runs the system, the company remains responsible for the confidentiality of the data and must ensure adequate security.

Authority / court
Agencia Española de Protección de Datos (AEPD)
Area of law
Data protection · Data breaches and data security
Legal basis
Art. 5 Abs. 1 lit. f DSGVO
Action
Fine
Status of proceedings
unknown
Sector
Transport, logistics and shipping

Checked against the official source on 7 Oct 2026 · Version 2 · Direct link

Report an error

Anonymous: we store only your text, no contact details and no IP address.

4 Mar 2026 Aramex New Zealand Holdings LimitedAramex: 700,000 NZD for customer allocation in a reseller agreement New ZealandCartels and collusion €355,800

In 2021 the courier company concluded an agreement with a competitor acting as reseller that allocated customers and fixed prices, and gave effect to the non-compete clause on one occasion; the wording had been copied from an older Fastway template. In civil proceedings brought by the Commerce Commission (ComCom, New Zealand's competition authority), the High Court on 4 March 2026 approved the jointly proposed penalty, allegedly of 700,000 NZD (starting point 1 million NZD, 30% reduction).

What organisations can take from it

Contract templates should be reviewed regularly for competition law risks before they are copied for new partners.

Relevance to training and awareness

Competition law review of contract templates

Authority / court
High Court Auckland (Klage: Commerce Commission)
Area of law
Competition law · Cartels and collusion
Legal basis
Commerce Act 1986, s 30
Action
Fine
Status of proceedings
final
Sector
Transport, logistics and shipping
Culpability
negligent
Repeat case
no
Mitigating circumstances
No previous warnings or contraventions, voluntary provision of documents and interviews, early admission and remorse, new agreements without the clause and a new competition law compliance programme in New Zealand and Australia.
Liability of senior managers
The agreement was prepared from a template by the national sales manager; a more senior employee signed it without reviewing its content.
Published
4 Mar 2026

Original amount 700,000 NZD, converted at the ECB reference rate of 4 Mar 2026.

Checked against the official source on 3 Oct 2026 · Direct link

Report an error

Anonymous: we store only your text, no contact details and no IP address.

24 Feb 2026 Amazon Italia Logistica S.r.l.Garante halts records on illness and strikes at Amazon Italia Logistica ItalyEmployee data Order

During an inspection at the Passo Corese logistics centre (around 1,800 employees), the Garante (Italian data protection authority) found that, after return-to-work interviews, information on illnesses, participation in strikes, trade union activities and family circumstances of employees – irrelevant to their professional aptitude – was recorded in free-text fields of a platform linked to time recording and accessible to many managers. With immediate effect it ordered the definitive restriction of processing of these entries – also at all other sites using the platform – and of four cameras at the entrances to toilets and break areas; the investigation was continuing.

What organisations can take from it

Notes from staff interviews may only contain job-relevant information – health, strike participation and private life do not belong in HR systems.

Relevance to training and awareness

Documenting staff interviews and sensitive employee data

Authority / court
Garante per la protezione dei dati personali
Area of law
Data protection · Employee data
Legal basis
Art. 5 Abs. 1 lit. a, c und e, Art. 6, 9 und 88 DSGVO; Art. 113 Codice privacy (D.Lgs. 196/2003); Maßnahme nach Art. 58 Abs. 2 lit. f DSGVO
Action
Order
Status of proceedings
unknown
Sector
Transport, logistics and shipping
Employees
10,000 or more
Published
24 Feb 2026

Checked against the official source on 28 Sep 2026 · Direct link

Report an error

Anonymous: we store only your text, no contact details and no IP address.

5 Feb 2026 DPD Polska sp. z o.o.DPD Polska: PLN 11.46m in fines, including for missing data processing agreements PolandData processors €2.72m

The UODO (Urząd Ochrony Danych Osobowych, Polish data protection authority) fined the parcel carrier DPD Polska sp. z o.o. a total of PLN 11,461,030. PLN 6,251,471 relates to the company using external hauliers for shipments between its depots without a data processing agreement under Art. 28(3) GDPR, although they had access to the address labels during loading and unloading; PLN 5,209,559 relates to staff not being given effective authorisations to process data and the company's own data protection policy not being implemented (Art. 24, 29, 32 GDPR). The authority classed both infringements as intentional and treated earlier reprimands against the company as aggravating. The decision is not final.

What organisations can take from it

Even pure transport providers can be processors if they have access to personal data such as address labels – an Art. 28 GDPR contract is then mandatory.

Relevance to training and awareness

Recognising data processing by logistics and transport providers

Authority / court
Prezes Urzędu Ochrony Danych Osobowych (UODO)
Area of law
Data protection · Data processors
Legal basis
Art. 28 Abs. 3 i. V. m. Art. 5 Abs. 1 lit. a und Abs. 2 DSGVO; Art. 24 Abs. 1 und 2, Art. 29, Art. 32 Abs. 1 und 4 i. V. m. Art. 5 Abs. 1 lit. f und Abs. 2 DSGVO; Art. 83 Abs. 4 lit. a und Abs. 5 lit. a DSGVO
Action
Fine
Status of proceedings
unknown
Sector
Transport, logistics and shipping
Culpability
intentional
Repeat case
yes
Mitigating circumstances
It was treated as mitigating that, after the proceedings were opened, DPD amended its contracts with the hauliers to include data processing terms and changed its procedure for granting authorisations.
Liability of senior managers
No personal liability was established.
Published
23 Feb 2026

Original amount 11,461,030 PLN, converted at the ECB reference rate of 5 Feb 2026.

Checked against the official source on 28 Sep 2026 · Direct link

Report an error

Anonymous: we store only your text, no contact details and no IP address.

22 Jan 2026 Logistics business: fines for minimum wage, reporting and foreign employment violations GermanyMinimum wage and undeclared work €13,731

Between June and December 2023, a logistics and transport business withheld a total of around 2,000 EUR in minimum wages from several employees, breached reporting and immediate notification obligations, and in July/August 2023 employed a foreign national without a residence permit. The fines: 5,231 EUR (minimum wage), 750 EUR each (reporting obligations) and 7,000 EUR (unauthorised employment of foreign nationals), totalling 13,731 EUR (date = publication).

What organisations can take from it

Even small wage arrears are penalised individually alongside reporting and residence violations – HR processes for new hires need a fixed checklist.

Relevance to training and awareness

Immediate notification and checking of work permits when hiring

Authority / court
Hauptzollamt Karlsruhe (Finanzkontrolle Schwarzarbeit)
Area of law
Health and safety and employment law · Minimum wage and undeclared work
Legal basis
§ 21 Abs. 1 Nr. 11 MiLoG; § 111 Abs. 1 Nr. 2 SGB IV; § 404 Abs. 2 Nr. 3 SGB III
Action
Fine
Status of proceedings
unknown
Sector
Transport, logistics and shipping
Published
22 Jan 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Anonymous: we store only your text, no contact details and no IP address.

2 Jan 2026 Poczta Polska S.A.Poczta Polska: 978,128 PLN because the data protection officer was not independent PolandData protection €232,208

The function of data protection officer was performed by a manager who was at the same time responsible for security and protection of classified information and thus monitored their own activities; there was no conflict analysis. Poland’s data protection authority (UODO) imposed 978,128 PLN and referred to numerous previous reprimands and orders against the company.

What organisations can take from it

Data protection officers must not be responsible for the processes they monitor – check dual roles for conflicts of interest in advance.

Authority / court
Prezes Urzędu Ochrony Danych Osobowych (UODO)
Area of law
Data protection
Legal basis
Art. 38 Abs. 3 und 6 DSGVO (DKN.5131.4.2025)
Action
Fine
Status of proceedings
unknown
Sector
Transport, logistics and shipping
Employees
10,000 or more
Repeat case
yes
Mitigating circumstances
During the proceedings the function was made independent and placed directly under the management board.
Published
26 Jan 2026

Original amount 978,128 PLN, converted at the ECB reference rate of 2 Jan 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Anonymous: we store only your text, no contact details and no IP address.

Load 20 more of 65

Ready for training that actually lands?

Try the combination for free: automated administration for you, learning formats that fit your team, with no minimum or credit card.

Start 14-day free trial