GDPR Fines & Penalties 2026
Search published European fines, warnings, orders and court decisions with a confirmed EU GDPR legal basis. Cases whose applicable law has not yet been confirmed are excluded.
Selected coverage: Europe. Only published cases are included.
298 results · Showing 276–298
DPA case 34/2020
DPA case 20/02058 - Smittestopp
DPA case 2020010373
DPA case 9356568
DPA case Délibération 2020-056
DPA case 07120-1/2020/358
DPA case 07120-1/2020/345
Italian National Social Security Institute (“INPS”) vs. anonymous
DPA case 22/2020
Hellenic Bank PLC
DPA case 16/2020
Supreme Council For Civil Personnel Selection (ASEP)
DPA case 07121-1/2020/428
The Norwegian DPA Datatilsynet
Udine City Council
DPA case 9296257
DPA case 2019-441-3399
Bankernes EDB Central (BEC)
DPA case 2020-0.083.190
General Labour Union (GCT)
French Ministry of Internal Affairs
BOUTIQUE.AERO
DPA case Employee Insurance Agency (UWV)
Frequently Asked Questions About GDPR Enforcement
Q:What types of GDPR enforcement actions exist?
GDPR enforcement actions include monetary fines (the most publicised), formal warnings, reprimands, processing bans, data erasure orders, and compliance orders. DPAs can also impose temporary or permanent limitations on data processing. Fines can reach up to EUR 20 million or 4% of annual worldwide turnover, whichever is higher, under Article 83(5) GDPR.
Q:How are GDPR fines calculated by data protection authorities?
DPAs consider factors listed in Article 83(2) GDPR: nature, gravity, and duration of the infringement; intentional or negligent character; actions taken to mitigate damage; degree of responsibility; previous infringements; degree of cooperation; categories of personal data affected; how the infringement became known; and adherence to approved codes of conduct or certification mechanisms.
Q:Can GDPR fines be appealed?
Yes, GDPR fines can be appealed through national courts. Many high-profile fines have been challenged. The appeals process varies by country. Some fines have been reduced on appeal (e.g., British Airways' fine was reduced from GBP 183 million to GBP 20 million), while others have been upheld or even increased.
Browse case links on this page
GDPR Enforcement Actions (298 total)
- DPA case 34/2020 (Belgium) – violation found – Jun 2020
- DPA case 20/02058 - Smittestopp (Norway) – violation found – Jun 2020
- DPA case 2020010373 (Iceland) – violation found – Jun 2020
- DPA case 9356568 (Italy) – violation found – Jun 2020
- DPA case Délibération 2020-056 (France) – violation found – May 2020
- DPA case 07120-1/2020/358 (Slovenia) – violation found – May 2020
- DPA case 07120-1/2020/345 (Slovenia) – violation found – May 2020
- Italian National Social Security Institute (“INPS”) vs. anonymous (Italy) – violation found – May 2020
- DPA case 22/2020 (Belgium) – violation found – May 2020
- Hellenic Bank PLC (Cyprus) – violation found – May 2020
- DPA case 16/2020 (Belgium) – violation found – Apr 2020
- Supreme Council For Civil Personnel Selection (ASEP) (Greece) – violation found – Apr 2020
- DPA case 07121-1/2020/428 (Slovenia) – violation found – Mar 2020
- The Norwegian DPA Datatilsynet (Norway) – violation found – Mar 2020
- Udine City Council (Italy) – violation found – Mar 2020
- DPA case 9296257 (Italy) – violation found – Mar 2020
- DPA case 2019-441-3399 (Denmark) – violation found – Mar 2020
- Bankernes EDB Central (BEC) (Denmark) – violation found – Feb 2020
- DPA case 2020-0.083.190 (Austria) – violation found – Feb 2020
- General Labour Union (GCT) (Spain) – violation found – Nov 2019
- French Ministry of Internal Affairs (France) – violation found – Nov 2019
- BOUTIQUE.AERO (France) – violation found – Nov 2019
- DPA case Employee Insurance Agency (UWV) (Netherlands) – violation found – Jul 2018