2 min read

Writen by Zlatko Delev

Posted on: March 31, 2022

GDPR Fines Q4 2021

The Fourth quarter of 2021, really confirmed that 2021 is the year of fines. We did an overview of the following period so kindly find information about the fines issue at the end of the year.

GDPR fines in total

In the last quarter of 2021, data protection authorities have steadily continued dishing out fines. These fines across the EEA amounted to 17.2 million euros (93 fines in total).

Fines by Violation Type

#1 The by far leading violation type in terms of fines continues to be the insufficient legal basis for data processing amounting to 12.4 million euros.

#2 Non-compliance with general data processing principles (2.1 million euros)

#3 Insufficient technical and organisational measures to ensure information security (1.7 million euros).

Most active data protection authorities

The Norwegian authorities have stepped up their fines game and are leading the fines ranking in terms of the fine sum total (6.8 million euros). This is due to the 6.3 million euros fine imposed on the dating app Grindr for the unlawful sharing of personal data with third parties for marketing purposes.

In second place we see the Spanish authorities with issued fines amounting to 3.4 million euros. Again, this number is heavily influenced by a single fine – namely, a 3 million euros fine against Caixabank based on insufficient legal basis for data processing.

And in third place we have the Netherlands with fines issued amounting to 3.15 million euros. The Dutch authorities issued two prominent fines: 2.75 million euros against the Ministry of Finance (insufficient legal basis for data processing) and 400 000 euros against the airline Transavia (insufficient technical and organisational measures to ensure information security).

We suggest every company to be careful and really to follow the GDPR and other relevant Data Protection legislation in order to avoid this fines, and to make their life easier.

Contact Us

Hope you find this useful. If you need an EU Rep, have any GDPR questions, or have received a SAR or Regulator request and need help then please contact us anytime. We are always happy to help...
Zlatko, Adam, Hristina, Marin.

Contact Us

Recent blogs

Accountability Tracker

As your Article 27 Representative we will always help if you receive a SAR, RTE, or other data prot

How to handle a Subject Access Request

We have said this previously but we are still seeing a huge number of Subject Access Requests [

Right to Erasure and how to handle it

Summary: The Right to Be Forgotten is one of the fundamental rights defined in GDPR.  Also

Get Your Account Now

Setup in just 5 minutes. Enter your company details and choose the EU Representative services you need.

Give Us a Call

Not sure whether EU Representative applies to you or which option to choose? Call, email, chat to us anytime.


Stay Up-To-Date

Leave your details here and we’ll send you updates and information on all aspects of GDPR and EU Representative. We won’t bombard you with emails and you will be able to tell us to stop anytime.