---
title: "Vodafone GmbH fined EUR 45,000,000 (Germany, 2025)"
canonical: "https://dposchool.com/gdpr/fine/bfdi-vodafone-2025-03"
source: "https://www.edpb.europa.eu/news/german-federal-sa-administrative-fines-in-the-amount-of-eu15-000-000-and-eu30-000-000-as-well_en"
source_note: "Only the authority's decision is authoritative."
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en"
publisher: "DPO School"
---

Fine · Germany

# Vodafone GmbH: EUR 45,000,000

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/gdpr/about#review)

- **Authority:** Federal Commissioner for Data Protection and Freedom of Information (BfDI)
- **Country:** Germany
- **Date:** Decision of 10 March 2025
- **Amount:** EUR 45,000,000, as imposed (not converted)
- **Appeal status:** Unknown
- **Provisions cited:** [Article 28(1)](https://dposchool.com/gdpr/article/28#1), [Article 32(1)](https://dposchool.com/gdpr/article/32#1)

## What the fine was for (summary, not the official text)

Two fines: EUR 15 million for poor supervision and auditing of partner shops acting as processors (staff misused customer data for fraud) and EUR 30 million for weak authentication in the online portal and hotline that allowed eSIM misuse.

## Official source

- [Decision or announcement of the authority](https://www.edpb.europa.eu/news/german-federal-sa-administrative-fines-in-the-amount-of-eu15-000-000-and-eu30-000-000-as-well_en)

Checked against the official source on 28 October 2026.

Only the authority's decision is authoritative. This is reference material, not legal advice.

## Navigation

[GDPR Navigator](https://dposchool.com/gdpr) / [Fines](https://dposchool.com/gdpr/fines) / Vodafone GmbH

[All fines](https://dposchool.com/gdpr/fines)

Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/gdpr/llms.txt
- JSON API: https://dposchool.com/gdpr/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents