GDPR fines published in September and October 2026: security, processors and people's rights
Seven GDPR decisions from Norway, Ireland, France, Sweden, Greece and Italy: weak security, missing processor contracts and ignored requests.
Between early September and mid-October 2026, the European Data Protection Board (EDPB) relayed a series of GDPR fines from national authorities. Apart from the large Uber and Google cases we covered in GDPR enforcement in 2026, two themes stand out: weak security, and consent and requests that were not respected.
Security and processors
- HSE, EUR 645,000, Ireland (28 August 2026). Intruders reached medical paper records kept in former psychiatric hospitals. Fines, a reprimand and compliance orders.
- Hôpital Privé de la Loire, EUR 500,000, France (3 September 2026). An attacker reached the data of 524,867 patients: no multi-factor authentication for outside users, access not limited to the care team, no real-time detection, and the 202,246 "trusted third parties" whose data were also taken were not informed.
- Miljödata, SEK 1.8 million, Sweden (22 September 2026). A cyberattack on an IT provider affected 2.2 million people; no adequate checks when installing new software and no real-time monitoring.
- Greek Ministry of Social Cohesion and Family Affairs, EUR 200,000, and its processor E.E.T.A.A., EUR 150,000 (28 July 2026). Outdated systems despite known risks, and shortcomings under Article 28; both were ordered to sign a processor agreement.
Consent and people's rights
- Xandr, NOK 92 million (about EUR 8.6 million), Norway (2 October 2026). The advertising company processed data of users of a dating app for gay, bi, trans and queer people in real-time bidding without a valid legal basis. It relied on the app's consent, which was invalid: each joint controller must verify consent itself. It is the Norwegian authority's highest fine to date and is final.
- EXTIA, EUR 300,000, France (21 July 2026). Of 265 erasure requests in 2024, 12 were never handled and 166 people were never told the outcome.
- BBVA, EUR 5,508,000, Italy (3 July 2026). A customer objected to marketing in the bank's app, yet received promotional notifications for seven months because of a synchronisation failure between internal systems.
What to do now
Check multi-factor authentication and monitoring for systems with sensitive data, a signed processor agreement with every vendor, and that a request or objection reaches the system that acts on it.
Dazr Compliance keeps GDPR security controls, a vendor register with DPA links and review dates, the Article 30 record and a breach register with a 72-hour clock in one place, with reminders when a review is due.
Sources
- Datatilsynet: Microsoft company fined NOK 92 million (updated 3 November 2026)
- EDPB: Norwegian DPA fines Xandr EUR 8 600 000 for unlawful processing of personal data (16 October 2026)
- Data Protection Commission: Final decision following inquiry into the Health Service Executive (HSE)
- CNIL: Health data breach, EUR 500,000 fine against Hôpital Privé de la Loire
- IMY: Administrative fine against Miljödata
- EDPB: Hellenic DPA decision on a data breach involving E.E.T.A.A. S.A. as processor (8 October 2026)
- CNIL: Failure to respect the rights of individuals, EUR 300,000 fine against EXTIA
- EDPB: News, national news from data protection authorities
- EDPB: Italian DPA fines BBVA EUR 5 508 000 for failing to respect a customer's objection to direct marketing (9 October 2026)
For information only, not legal advice. Last updated 7 November 2026.
Also available in: Nederlands, Italiano, Deutsch, Français, Español, Polski, Português, Română, Čeština, Slovenčina, Dansk, Svenska, Norsk bokmål