GDPR Fines & Penalties 2026
Search published European fines, warnings, orders and court decisions with a confirmed EU GDPR legal basis. Cases whose applicable law has not yet been confirmed are excluded.
Selected coverage: Europe. Only published cases are included.
472 results · Showing 351–375
DPA case 3592/152/2019
Alstrøm – Din Isenkræmmer ApS
No Reject Button · Reject Harder Than Accept +1
Falkonergården (High School)
DPA case 521.13874
DPA case 6132/151/19
DPA case ZSPR.440.331.2019.PR.PAM
Third-Party Cookies Without Consent · Unclear Cookie Information
Creditinfo
DPA case 2020010642
MAGNA Lögmenn (law firm)
Directorate of Labor of Iceland
DPA case NAIH-1743/2021
DPA case 41/2021
Party A (anonymized)
DPA case NAIH-4177-………./2021
Ajuntament de Tiana
Helsingor Municipality
Ex-employee (data subject)
DPA case 2020031242
Anonymous ( data subject vs insurance company)
Anonymous data subject
EMPRESA MUNICIPAL TRANSPORTES URBANOS, S.A. DE GIJÓN
DPA case NAIH-4447-6/2021
DPA case DPA 2021-0.415.529
DPA case 2368/182/20
DPA case 80/2021
Frequently Asked Questions About GDPR Enforcement
Q:What types of GDPR enforcement actions exist?
GDPR enforcement actions include monetary fines (the most publicised), formal warnings, reprimands, processing bans, data erasure orders, and compliance orders. DPAs can also impose temporary or permanent limitations on data processing. Fines can reach up to EUR 20 million or 4% of annual worldwide turnover, whichever is higher, under Article 83(5) GDPR.
Q:How are GDPR fines calculated by data protection authorities?
DPAs consider factors listed in Article 83(2) GDPR: nature, gravity, and duration of the infringement; intentional or negligent character; actions taken to mitigate damage; degree of responsibility; previous infringements; degree of cooperation; categories of personal data affected; how the infringement became known; and adherence to approved codes of conduct or certification mechanisms.
Q:Can GDPR fines be appealed?
Yes, GDPR fines can be appealed through national courts. Many high-profile fines have been challenged. The appeals process varies by country. Some fines have been reduced on appeal (e.g., British Airways' fine was reduced from GBP 183 million to GBP 20 million), while others have been upheld or even increased.
Browse case links on this page
GDPR Enforcement Actions (472 total)
- DPA case 3592/152/2019 (Finland) – complaint upheld – Oct 2021
- Alstrøm – Din Isenkræmmer ApS (Denmark) – complaint upheld – Oct 2021 | No Reject Button, Reject Harder Than Accept, Cookies Placed Before Consent
- Falkonergården (High School) (Denmark) – complaint upheld – Oct 2021
- DPA case 521.13874 (Germany) – complaint upheld – Oct 2021
- DPA case 6132/151/19 (Finland) – complaint upheld – Oct 2021
- DPA case ZSPR.440.331.2019.PR.PAM (Poland) – complaint upheld – Oct 2021 | Third-Party Cookies Without Consent, Unclear Cookie Information
- Creditinfo (Iceland) – complaint upheld – Oct 2021
- DPA case 2020010642 (Iceland) – complaint upheld – Sept 2021
- MAGNA Lögmenn (law firm) (Iceland) – complaint upheld – Sept 2021
- Directorate of Labor of Iceland (Iceland) – complaint upheld – Sept 2021
- DPA case NAIH-1743/2021 (Hungary) – complaint upheld – Sept 2021
- DPA case 41/2021 (Greece) – complaint upheld – Sept 2021
- Party A (anonymized) (Greece) – complaint upheld – Sept 2021
- DPA case NAIH-4177-………./2021 (Hungary) – complaint upheld – Sept 2021
- Ajuntament de Tiana (Spain) – complaint upheld – Sept 2021
- Helsingor Municipality (Denmark) – complaint upheld – Sept 2021
- Ex-employee (data subject) (Austria) – complaint upheld – Sept 2021
- DPA case 2020031242 (Iceland) – complaint upheld – Sept 2021
- Anonymous ( data subject vs insurance company) (Denmark) – complaint upheld – Sept 2021
- Anonymous data subject (Greece) – complaint upheld – Sept 2021
- EMPRESA MUNICIPAL TRANSPORTES URBANOS, S.A. DE GIJÓN (Spain) – complaint upheld – Sept 2021
- DPA case NAIH-4447-6/2021 (Hungary) – complaint upheld – Aug 2021
- DPA case DPA 2021-0.415.529 (Austria) – complaint upheld – Aug 2021
- DPA case 2368/182/20 (Finland) – complaint upheld – Aug 2021
- DPA case 80/2021 (Belgium) – complaint upheld – Jul 2021