GDPR Fines Tracker — EU/EEA Enforcement Database

Structured feed of 3,340 GDPR fines (count at the source on 13 October 2026) imposed by EU/EEA data protection authorities (DPAs), sourced from the public GDPR Enforcement Tracker by CMS Hasche Sigle (enforcementtracker.com, licensed CC BY-NC-SA 4.0).

Filterable by country, DPA, sector, GDPR article, fine amount, and year. Designed for compliance bots, legaltech pipelines, and regulatory dashboards.

Data source

The Enforcement Tracker embeds all records as a JSON bootstrap blob inside the homepage HTML (<script type="application/json" id="et-cases" data-purpose="filter-bootstrap">), making the full dataset available in a single unauthenticated HTTP request. No undocumented API is used.

Source URL : https://www.enforcementtracker.com/
License    : Creative Commons BY-NC-SA 4.0
Creator    : CMS Hasche Sigle (cms.law)
Records    : 3,340 enforcement actions as of 2026-10-13

Attribution & ShareAlike required — this data is licensed CC BY-NC-SA 4.0. Any redistribution must credit "GDPR Enforcement Tracker — CMS Hasche Sigle (cms.law)" and remain under the same CC BY-NC-SA 4.0 license. Each output record carries an attribution field for this purpose; any derived dataset stays CC BY-NC-SA 4.0.

Who needs this

• Legaltech / compliance bots — automated monitoring of fines by article, sector, or jurisdiction.
• DPOs and privacy counsel — track precedents from target DPAs without manual site scraping.
• Risk analytics — benchmark fine amounts by country, sector, or violation type.
• Pairs naturally with EDPB Article 65 decisions and Garante Privacy RSS for Italian-specific coverage.

Input filters

Parameter	Type	Description
country	string	ISO code (IT, DE, FR) or partial name (Italy). Empty = all.
authority	string	DPA name partial match, e.g. Garante, CNIL.
sector	string	Sector partial match, e.g. Telecommunications, Health.
articleFilter	string	GDPR article partial match, e.g. Art. 5, Art. 83.
violationTypeContains	string	Violation description partial match.
fineMin	integer	Minimum fine in EUR (0 = no limit).
fineMax	integer	Maximum fine in EUR (0 = no limit).
yearFrom	integer	Earliest year (inclusive).
yearTo	integer	Latest year (inclusive).
maxResults	integer	Cap results (default 1000, max 10000).

Output schema (per record)

Field	Type	Description
etId	number	Enforcement Tracker internal ID
countryCode	string	ISO-style country code, e.g. IT
country	string	Country full name, e.g. Italy
authority	string	Full DPA name
party	string	Entity or company fined
sector	string	Business sector
fineAmountEur	number	Fine amount in EUR
date	string	Date of decision (YYYY-MM-DD or YYYY)
year	number	Year of decision
gdprArticles	string	Cited GDPR articles, comma-separated
violationType	string	Short violation category
sourceUrl	string	Official authority decision URL
trackerUrl	string	Direct link on enforcementtracker.com
attribution	string	Source credit + license notice, per CC BY-NC-SA 4.0: GDPR Enforcement Tracker — CMS Hasche Sigle, cms.law, CC BY-NC-SA 4.0

Real sample record (ETid-1, Austria, 2018)

Fetched live from the bootstrap blob on 2026-07-13:

{
  "etId": 1,
  "countryCode": "AUSTRIA",
  "country": "Austria",
  "authority": "Austrian Data Protection Authority (dsb)",
  "party": "Betting place",
  "sector": "Industry and Commerce",
  "fineAmountEur": 4800,
  "date": "2018-12-09",
  "year": 2018,
  "gdprArticles": "Art. 13 GDPR",
  "violationType": "Insufficient fulfilment of information obligations",
  "sourceUrl": "https://www.dsb.gv.at/documents/22758/116802/Straferkenntnis+DSB-D550.038+0003-DSB+2018.pdf/fb0bb313-8651-44ac-a713-c286d83e3f19",
  "trackerUrl": "https://www.enforcementtracker.com/ETid-1",
  "attribution": "GDPR Enforcement Tracker — CMS Hasche Sigle, cms.law, CC BY-NC-SA 4.0"
}

Raw data extracted directly from homepage bootstrap JSON (verified 2026-07-13):

{"e":1,"c":"AUSTRIA","C":"Austria","F":"/flags/flag_austria.png","a":"Austrian Data Protection Authority (dsb)","d":"2018-12-09","y":2018,"f":4800,"p":"Betting place","s":"Industry and Commerce","r":"Art. 13 GDPR","t":"Insufficient fulfilment of information obligations","u":"https://www.dsb.gv.at/..."}

How it works

1. Fetch https://www.enforcementtracker.com/ with a browser User-Agent.
2. Extract the <script id="et-cases"> JSON blob (single HTTP request, ~1–2 MB).
3. Parse, filter, expand compact field names, sort newest first.
4. Push to Apify dataset in batches.

No streaming needed — the full dataset fits comfortably in memory.
Proxy rotation is used defensively in case of transient IP-level blocks.

ToS / robots compliance

enforcementtracker.com allows indexing (robots.txt permits /).
The dataset is published under CC BY-NC-SA 4.0 for non-commercial reuse with attribution. The source license restricts commercial reuse; the existing license notice is retained.

License and price

The data comes from the GDPR Enforcement Tracker by CMS Hasche Sigle (enforcementtracker.com, cms.law), published under Creative Commons BY-NC-SA 4.0. Every record carries the attribution GDPR Enforcement Tracker — CMS Hasche Sigle, cms.law, CC BY-NC-SA 4.0: keep it when you reuse the data, use the data for non-commercial purposes only, and share any derived dataset under the same license.

We at Promptica are making this Actor free, so that its use respects the non-commercial (NC) condition of the source license. Apify lets us change the pricing of this Actor again on 28 October 2026: until the change takes effect, the price shown in the Apify Store before each run is the one that applies.

Notes

• The date field may be year-only ("2018") when the exact date is not public.
• fineAmountEur is null for fines listed as "unknown amount" in the source.
• Source: GDPR Enforcement Tracker by CMS Hasche Sigle.

Reliable runs and monitoring

Prefill: {"maxResults":5}. Existing fields and filter names remain unchanged. New optional input: soloNuove: true, monitorNome: "my-gdpr-monitor". Reuse that name in a daily Apify Task schedule; do not overlap runs. The first matching window is emitted once, then unchanged rows are suppressed. maxResults counts matching rows scanned, including unchanged rows. State persists after dataset delivery; interruption can replay a row.

Memory defaults to 1 GB. Only the platform deadline (timeoutAt minus 30 seconds) limits duration. Input errors and source outages finish with explanatory status and OUTPUT.error, hint, partial; check these fields even when the run is SUCCEEDED. Requests retry with backoff and new valid proxy sessions.

Italiano

Input e campi precedenti invariati. Prefill 5 sanzioni; memoria 1 GB. soloNuove e monitorNome attivano la memoria fra esecuzioni: riusare il nome nelle schedule, senza sovrapposizioni. Input errato o fonte giù producono uno stato esplicativo e diagnostica in OUTPUT; verificare error e partial. La licenza NC della fonte resta indicata sopra.

Licenza della fonte: CC BY-NC-SA 4.0, con attribuzione a «GDPR Enforcement Tracker — CMS Hasche Sigle, cms.law». Noi di Promptica rendiamo questo actor gratuito per rispettare il vincolo non commerciale (NC) della licenza: Apify ci permette di cambiare il prezzo dal 28 ottobre 2026; fino ad allora vale il prezzo mostrato nello Store.