GDPR Fines & Penalties 2026
Search published European fines, warnings, orders and court decisions with a confirmed EU GDPR legal basis. Cases whose applicable law has not yet been confirmed are excluded.
Selected coverage: Europe. Only published cases are included.
472 results · Showing 326–350
DPA case 18.02.2097
noyb
TV 2
Company X
DPA case 24-191 II#4781
DPA case 9747505
DPA case 11/2022
No Granular Cookie Choice · Cookies Persist After Rejection +2
DPA case 2.1.-1/21/129
Redacted
DPA case 2/2022
DPA case 2020-1013
Unclear Cookie Information
website visitor and Google user (data subject and complainant)
DPA case 2021-0.816.492
DPA case 130/2021
Silkeborg Municipality
Disziplinarrat der Österreichischen Ärztekammer
DPA case 62334 (IMI Case)
Komplett Bank ASA
DPA case 125/2021
Oikeusrekisterikeskus
Bisnode Finland Oy
Suomen Asiakastieto Oy
DPA case 2021010073
DPA case 9024/181/19
DPA case 6745/163/18
Frequently Asked Questions About GDPR Enforcement
Q:What types of GDPR enforcement actions exist?
GDPR enforcement actions include monetary fines (the most publicised), formal warnings, reprimands, processing bans, data erasure orders, and compliance orders. DPAs can also impose temporary or permanent limitations on data processing. Fines can reach up to EUR 20 million or 4% of annual worldwide turnover, whichever is higher, under Article 83(5) GDPR.
Q:How are GDPR fines calculated by data protection authorities?
DPAs consider factors listed in Article 83(2) GDPR: nature, gravity, and duration of the infringement; intentional or negligent character; actions taken to mitigate damage; degree of responsibility; previous infringements; degree of cooperation; categories of personal data affected; how the infringement became known; and adherence to approved codes of conduct or certification mechanisms.
Q:Can GDPR fines be appealed?
Yes, GDPR fines can be appealed through national courts. Many high-profile fines have been challenged. The appeals process varies by country. Some fines have been reduced on appeal (e.g., British Airways' fine was reduced from GBP 183 million to GBP 20 million), while others have been upheld or even increased.
Browse case links on this page
GDPR Enforcement Actions (472 total)
- DPA case 18.02.2097 (Estonia) – complaint upheld – Feb 2022
- noyb (France) – complaint upheld – Feb 2022
- TV 2 (Denmark) – complaint upheld – Feb 2022
- Company X (Finland) – complaint upheld – Feb 2022
- DPA case 24-191 II#4781 (Germany) – complaint upheld – Jan 2022
- DPA case 9747505 (Italy) – complaint upheld – Jan 2022
- DPA case 11/2022 (Belgium) – complaint upheld – Jan 2022 | No Granular Cookie Choice, Cookies Persist After Rejection, No Reject Button, Third-Party Cookies Without Consent
- DPA case 2.1.-1/21/129 (Estonia) – complaint upheld – Jan 2022
- Redacted (Belgium) – complaint upheld – Jan 2022
- DPA case 2/2022 (Greece) – complaint upheld – Jan 2022
- DPA case 2020-1013 (European Union) – complaint upheld – Jan 2022 | Unclear Cookie Information
- website visitor and Google user (data subject and complainant) (Austria) – complaint upheld – Dec 2021
- DPA case 2021-0.816.492 (Austria) – complaint upheld – Dec 2021
- DPA case 130/2021 (Belgium) – complaint upheld – Nov 2021
- Silkeborg Municipality (Denmark) – complaint upheld – Nov 2021
- Disziplinarrat der Österreichischen Ärztekammer (Austria) – complaint upheld – Nov 2021
- DPA case 62334 (IMI Case) (Germany) – complaint upheld – Nov 2021
- Komplett Bank ASA (Norway) – complaint upheld – Nov 2021
- DPA case 125/2021 (Belgium) – complaint upheld – Nov 2021
- Oikeusrekisterikeskus (Finland) – complaint upheld – Nov 2021
- Bisnode Finland Oy (Finland) – complaint upheld – Nov 2021
- Suomen Asiakastieto Oy (Finland) – complaint upheld – Nov 2021
- DPA case 2021010073 (Iceland) – complaint upheld – Nov 2021
- DPA case 9024/181/19 (Finland) – complaint upheld – Oct 2021
- DPA case 6745/163/18 (Finland) – complaint upheld – Oct 2021