GDPR Fines & Penalties 2026
Search published European fines, warnings, orders and court decisions with a confirmed EU GDPR legal basis. Cases whose applicable law has not yet been confirmed are excluded.
Selected coverage: Europe. Only published cases are included.
33 results · Showing 1–25
DPA case 2025020471
Danish Municipalities
Meta Platforms Ireland
Worldcoin Foundation
Meta Platfroms Ireland Ltd
DPA case 95/2023
Meta Ireland Limited
DPA case 2022-0.876.190
German Whatsapp user (represented by noyb - European Centre for Digital Rights)
Belgian Instagram user (represented by noyb - European Centre for Digital Rights)
Austrian Facebook user (represented by noyb - European Centre for Digital Rights)
DPA case 146/2022
DPA case 0612-23/2019/19
Supreme Court of Finland
FysioDanmark
DPA case 85/2021
DPA case UOOU-05284/19-47
DPA case 07121-1/2020/2281
Odin Flissenter AS
Aquateknikk AS
DPA case 07121-1/2020/701
DPA case 07121-1/2020/693
DPA case 07121-1/2020/519
DPA case 07120-1/2020/290
DPA case 07121-1/2020/527
Frequently Asked Questions About GDPR Enforcement
Q:What types of GDPR enforcement actions exist?
GDPR enforcement actions include monetary fines (the most publicised), formal warnings, reprimands, processing bans, data erasure orders, and compliance orders. DPAs can also impose temporary or permanent limitations on data processing. Fines can reach up to EUR 20 million or 4% of annual worldwide turnover, whichever is higher, under Article 83(5) GDPR.
Q:How are GDPR fines calculated by data protection authorities?
DPAs consider factors listed in Article 83(2) GDPR: nature, gravity, and duration of the infringement; intentional or negligent character; actions taken to mitigate damage; degree of responsibility; previous infringements; degree of cooperation; categories of personal data affected; how the infringement became known; and adherence to approved codes of conduct or certification mechanisms.
Q:Can GDPR fines be appealed?
Yes, GDPR fines can be appealed through national courts. Many high-profile fines have been challenged. The appeals process varies by country. Some fines have been reduced on appeal (e.g., British Airways' fine was reduced from GBP 183 million to GBP 20 million), while others have been upheld or even increased.
Browse case links on this page
GDPR Enforcement Actions (33 total)
- DPA case 2025020471 (Iceland) – order – May 2026
- Danish Municipalities (Denmark) – order – Jan 2026
- Meta Platforms Ireland (Poland) – order – Aug 2024
- Worldcoin Foundation (Italy) – order – Mar 2024
- Meta Platfroms Ireland Ltd (European Union) – order – Oct 2023
- DPA case 95/2023 (Belgium) – order – Jul 2023
- Meta Ireland Limited (Italy) – order – Dec 2022
- DPA case 2022-0.876.190 (Austria) – order – Dec 2022
- German Whatsapp user (represented by noyb - European Centre for Digital Rights) (European Union) – order – Dec 2022
- Belgian Instagram user (represented by noyb - European Centre for Digital Rights) (European Union) – order – Dec 2022
- Austrian Facebook user (represented by noyb - European Centre for Digital Rights) (European Union) – order – Dec 2022
- DPA case 146/2022 (Belgium) – order – Oct 2022
- DPA case 0612-23/2019/19 (Slovenia) – order – Jun 2022
- Supreme Court of Finland (Finland) – order – May 2022
- FysioDanmark (Denmark) – order – Mar 2022
- DPA case 85/2021 (Belgium) – order – Jul 2021
- DPA case UOOU-05284/19-47 (Czech Republic) – order – May 2021
- DPA case 07121-1/2020/2281 (Slovenia) – order – Dec 2020
- Odin Flissenter AS (Norway) – order – Jul 2020
- Aquateknikk AS (Norway) – order – Jun 2020
- DPA case 07121-1/2020/701 (Slovenia) – order – Apr 2020
- DPA case 07121-1/2020/693 (Slovenia) – order – Apr 2020
- DPA case 07121-1/2020/519 (Slovenia) – order – Apr 2020
- DPA case 07120-1/2020/290 (Slovenia) – order – Apr 2020
- DPA case 07121-1/2020/527 (Slovenia) – order – Apr 2020