GDPR Fines

A public record of GDPR enforcement across Europe — compiled by INPLP members

312 GDPR fines

Enforcement decisions from 21 jurisdictions, reported by INPLP member firms. Each entry links to the authority’s own publication where one is on record.

48 of 312 fines

Filtered byTurkey Clear all

Newspaper
Turkey·2019-12-09
125,000 TRY
Art. 12Unlawful processing of sensitive data
Bank
Turkey·2019-11-26
100,000 TRY
Art. 12Illegal use of customer data
Insurance Company
Turkey·2019-11-07
100,000 TRY
Art. 12Unlawful use of public data
Doctor
Turkey·2019-11-07
50,000 TRY
Art. 12Sending commercial messages to mobile phone
An airline company
Turkey·2019-10-01
100,000 TRY
Art. 4Failure to comply with duties related to ensuring information security + Insufficient legal basis for sensitive data processing
A mobile network operator company
Turkey·2019-10-01
NON
Art. 11NON
Facebook Inc
Turkey·2019-09-18
1,600,000 TRY
Art. 12Insufficient technical and organisational measures to ensure information security + Failure to notify the DPA within the necessary timelimit
A bank
Turkey·2019-09-18
100,000 TRY
Art. 4Insufficient technical and organisational measures to ensure information security + Non-compliance with general data processing principles
Sevinç Eğitim Kurumları (Education Insitution)
Turkey·2019-09-18
50,000 TRY
Art. 3Insufficient technical and organisational measures to ensure information security + Failure to comply witj duty of data controller to prevent unlawful data processing
S Şans Oyunları A.Ş
Turkey·2019-08-27
180,000 TRY
Art. 12Insufficient technical and organisational measures to ensure information security + Failure to notify the data subjects in the shortest time possible
A tourism company
Turkey·2019-08-27
500,000 TRY
Art. 12Insufficient technical and organisational measures to ensure information security + Failure to notify the DPA and the data subjects in the compulsory deadline
NON
Turkey·2019-07-23
NON
Art. 4NON
Dubmash Inc
Turkey·2019-07-17
730,000 TRY
Art. 12Insufficient technical and organisational measures to ensure information security + Failure to notify the DPA within the necessary timelimit
An investment company
Turkey·2019-07-08
75,000 TRY
Art. 12Non-compliance with general data processing principles
Mimar Sinan Üniversitesi
Turkey·2019-07-01
NON
Art. 15Failure to comply with duties related to ensuring information security + Insufficient legal basis for sensitive data processing
Unknown
Turkey·2019-05-31
NON
Art. 9Crossborder Data Transfer Requirements
An asset management company
Turkey·2019-05-31
20,000 TRY
Art. 5Insufficient technical and organisational measures to ensure information security + Non-compliance with general data processing principles
A joint-stock company
Turkey·2019-05-31
50,000 TRY
Art. 5Insufficient technical and organisational measures to ensure information security + Non-compliance with general data processing principles
A gym owner company
Turkey·2019-05-31
Unknown
Art. 6Art. 4Insufficient technical and organisational measures to ensure information security + Insufficient legal basis for data processing
Unknown
Turkey·2019-05-31
50,000 TRY
Art. 12Insufficient technical and organisational measures to ensure information security
Clickbus Seyahat Hizmetleri A.Ş.
Turkey·2019-05-16
1,000,000 TRY
Art. 12Insufficient technical and organisational measures to ensure information security + Failure to notify the DPA within the necessary timelimit
Marriott International Inc.
Turkey·2019-05-16
1,450,000 TRY
Art. 12Insufficient technical and organisational measures to ensure information security + Failure to notify the DPA within the necessary timelimit
Cathay Pasific Airway Limited
Turkey·2019-05-16
550,000 TRY
Art. 12Insufficient technical and organisational measures to ensure information security + Failure to notify the DPA within the necessary timelimit
T.C. Ziraat Bankası A.Ş
Turkey·2019-05-02
NON
Art. 5Non-compliance with the notification obligation + Insufficient legal basis for data processing
Facebook
Turkey·2019-04-11
550,000 TRY
Art. 12Failure to implement sufficient measures to ensure information security, and to fulfill information obligations
An energy company
Turkey·2019-03-25
NON
Art. 4Explanation of legitimate interest for as a legal basis for Data Processing
A supermarket (Full name dislosed)
Turkey·2019-03-25
NON
Art. 13Insufficient legal basis for data processing
Unknown
Turkey·2018-12-24
NON
Art. 17Criminal Proceeding Conditions
Pharmacy
Turkey·2018-12-05
Unknown
Art. 6Non-compliance with general data processing principles
A bank
Turkey·2018-12-05
NON
Art. 4Maximum data storage time limits
A legal entity
Turkey·2018-11-19
NON
Art. 2Scope of the Law
Public Institution
Turkey·2018-10-16
Instructed the Data Controller
Art. 11Insufficient fulfilment of data subjects rights
Unknown
Turkey·2018-09-13
N/A
Art. 3Definition of Data Controller
Unknown
Turkey·2018-08-02
Unknown
Art. 12Failure to implement sufficient measures to ensure information security
Unknown
Turkey·2018-08-02
Unknown
Art. 4Non-compliance with the principle of data minimization
Unknown
Turkey·2018-08-02
NON
Art. 28Unknown
Unknown
Turkey·2018-08-02
Unknown
Art. 12Non-compliance with the right of consent
Unknown
Turkey·2018-08-02
Unknown
Art. 12Insufficient fulfilment of information obligations
Unknown
Turkey·2018-08-02
Unknown
Art. 4Insufficient technical and organisational measures to ensure information security
Unknown
Turkey·2018-08-02
Instructed the Data Controller
Art. 11Non-compliance with information obligations
Unknown
Turkey·2018-08-02
Instructed the Data Controller
Art. 4Insufficient fulfilment of data subjects rights
Unknown
Turkey·2018-08-02
Unknown
Art. 12Insufficient technical and organisational measures to ensure information security
Unknown
Turkey·2018-08-02
Unknown
Art. 4Non-compliance with general data processing principles
Unknown
Turkey·2018-08-02
Unknown
Art. 5Failure to implement sufficient measures to ensure information security
Unknown
Turkey·2018-07-26
Instructed the Data Controller
Art. 7Non-compliance with the right of consent, and information obligations
Public Institution
Turkey·2018-06-28
N/A
Art. 7Insufficient technical and organisational measures to ensure information security
Unknown
Turkey
NON
NON
Ready-wear Company
Turkey
Unknown, also Instructed the Data Controller
Insufficient technical and organisational measures to ensure information security