GDPR Fines & Penalties 2026
Search published European fines, warnings, orders and court decisions with a confirmed EU GDPR legal basis. Cases whose applicable law has not yet been confirmed are excluded.
Selected coverage: Europe. Only published cases are included.
472 results · Showing 426–450
Ryanair DAC
DPA case 72/2020
Datatilsynet
DPA case 71/2020
DPA case PS/00120/2020
DPA case 2020010673
DPA case PS/00044/2020
DPA case PS/00143/2020
Debreceni Egyetem
DPA case 11.17.001.008.029
DPA case 2020010628
Xfera Móviles SA
Baby Palace S.L.
unknown (Complainant)
DPA case 61/2020
Dr. Markus A*** (Complainant)
Grúas Barea, S.L.U.
Íslandsbanki
DPA case 2020010610
DPA case 2020010550
DPA case Mál nr. 2020010601
ΚΕΟ PLC
DPA case 1809/452/18
DPA case 41/2020
DPA case 3846/157/2019
Frequently Asked Questions About GDPR Enforcement
Q:What types of GDPR enforcement actions exist?
GDPR enforcement actions include monetary fines (the most publicised), formal warnings, reprimands, processing bans, data erasure orders, and compliance orders. DPAs can also impose temporary or permanent limitations on data processing. Fines can reach up to EUR 20 million or 4% of annual worldwide turnover, whichever is higher, under Article 83(5) GDPR.
Q:How are GDPR fines calculated by data protection authorities?
DPAs consider factors listed in Article 83(2) GDPR: nature, gravity, and duration of the infringement; intentional or negligent character; actions taken to mitigate damage; degree of responsibility; previous infringements; degree of cooperation; categories of personal data affected; how the infringement became known; and adherence to approved codes of conduct or certification mechanisms.
Q:Can GDPR fines be appealed?
Yes, GDPR fines can be appealed through national courts. Many high-profile fines have been challenged. The appeals process varies by country. Some fines have been reduced on appeal (e.g., British Airways' fine was reduced from GBP 183 million to GBP 20 million), while others have been upheld or even increased.
Browse case links on this page
GDPR Enforcement Actions (472 total)
- Ryanair DAC (Ireland) – complaint upheld – Nov 2020
- DPA case 72/2020 (Belgium) – complaint upheld – Nov 2020
- Datatilsynet (Norway) – complaint upheld – Nov 2020
- DPA case 71/2020 (Belgium) – complaint upheld – Oct 2020
- DPA case PS/00120/2020 (Spain) – complaint upheld – Oct 2020
- DPA case 2020010673 (Iceland) – complaint upheld – Oct 2020
- DPA case PS/00044/2020 (Spain) – complaint upheld – Oct 2020
- DPA case PS/00143/2020 (Spain) – complaint upheld – Oct 2020
- Debreceni Egyetem (Hungary) – complaint upheld – Oct 2020
- DPA case 11.17.001.008.029 (Cyprus) – complaint upheld – Oct 2020
- DPA case 2020010628 (Iceland) – complaint upheld – Sept 2020
- Xfera Móviles SA (Spain) – complaint upheld – Sept 2020
- Baby Palace S.L. (Spain) – complaint upheld – Sept 2020
- unknown (Complainant) (Iceland) – complaint upheld – Sept 2020
- DPA case 61/2020 (Belgium) – complaint upheld – Sept 2020
- Dr. Markus A*** (Complainant) (Austria) – complaint upheld – Sept 2020
- Grúas Barea, S.L.U. (Spain) – complaint upheld – Sept 2020
- Íslandsbanki (Iceland) – complaint upheld – Sept 2020
- DPA case 2020010610 (Iceland) – complaint upheld – Aug 2020
- DPA case 2020010550 (Iceland) – complaint upheld – Aug 2020
- DPA case Mál nr. 2020010601 (Iceland) – complaint upheld – Aug 2020
- ΚΕΟ PLC (Cyprus) – complaint upheld – Aug 2020
- DPA case 1809/452/18 (Finland) – complaint upheld – Jul 2020
- DPA case 41/2020 (Belgium) – complaint upheld – Jul 2020
- DPA case 3846/157/2019 (Finland) – complaint upheld – Jul 2020