GDPR Fines & Penalties 2026
Search published European fines, warnings, orders and court decisions with a confirmed EU GDPR legal basis. Cases whose applicable law has not yet been confirmed are excluded.
Selected coverage: Europe. Only published cases are included.
31 results · Showing 1–25
Myndoor S.r.l.
Lepus Asset Management Oy
CNIL
Amazon Italia Logistica s.r.l.
Dream Land S.r.l.
Squeezemind S.r.l.
Misleading Banner Messaging
Norsk Helseinformatikk AS
Reject Harder Than Accept · Third-Party Cookies Without Consent +2
Centralcar S.p.a.
No Reject Button · No Granular Cookie Choice +1
Confalonieri S.r.l.
No Reject Button · Unclear Cookie Information +1
DPA case 10139147
Unclear Cookie Information
State Education Development Agency
Cookies Placed Before Consent · Unclear Cookie Information
F.C. Copenhagen
Freedelity
Aosom Italy S.r.l.
Unclear Cookie Information · No Granular Cookie Choice
Società Onlinestore s.r.l.
No Reject Button · Pre-ticked Consent Boxes +3
Telerama News
SIA GZ AUTO
No Reject Button · Cookies Placed Before Consent +1
Azienda Ospedaliero Universitaria Città della Salute e della Scienza di Torino
Mrs XX - natural person
Azienda Ospedaliera Universitaria Careggi
Istituto Nazionale di Statistica
Ilmatieteenlaitos
City of Helsinki
Cookies Placed Before Consent · Third-Party Cookies Without Consent +1
Toerisme Vlaanderen
No Reject Button · Unclear Cookie Information
JP/Politikens Hus A/S
Misleading Banner Messaging · Unclear Cookie Information
Frequently Asked Questions About GDPR Enforcement
Q:What types of GDPR enforcement actions exist?
GDPR enforcement actions include monetary fines (the most publicised), formal warnings, reprimands, processing bans, data erasure orders, and compliance orders. DPAs can also impose temporary or permanent limitations on data processing. Fines can reach up to EUR 20 million or 4% of annual worldwide turnover, whichever is higher, under Article 83(5) GDPR.
Q:How are GDPR fines calculated by data protection authorities?
DPAs consider factors listed in Article 83(2) GDPR: nature, gravity, and duration of the infringement; intentional or negligent character; actions taken to mitigate damage; degree of responsibility; previous infringements; degree of cooperation; categories of personal data affected; how the infringement became known; and adherence to approved codes of conduct or certification mechanisms.
Q:Can GDPR fines be appealed?
Yes, GDPR fines can be appealed through national courts. Many high-profile fines have been challenged. The appeals process varies by country. Some fines have been reduced on appeal (e.g., British Airways' fine was reduced from GBP 183 million to GBP 20 million), while others have been upheld or even increased.
Browse case links on this page
GDPR Enforcement Actions (31 total)
- Myndoor S.r.l. (Italy) – violation found – May 2026
- Lepus Asset Management Oy (Finland) – violation found – Mar 2026
- CNIL (France) – violation found – Mar 2026
- Amazon Italia Logistica s.r.l. (Italy) – violation found – Feb 2026
- Dream Land S.r.l. (Italy) – violation found – Dec 2025
- Squeezemind S.r.l. (Italy) – violation found – Oct 2025 | Misleading Banner Messaging
- Norsk Helseinformatikk AS (Norway) – violation found – Jun 2025 | Reject Harder Than Accept, Third-Party Cookies Without Consent, Misleading Banner Messaging, Unclear Cookie Information
- Centralcar S.p.a. (Italy) – violation found – Jun 2025 | No Reject Button, No Granular Cookie Choice, Unclear Cookie Information
- Confalonieri S.r.l. (Italy) – violation found – Jun 2025 | No Reject Button, Unclear Cookie Information, Misleading Banner Messaging
- DPA case 10139147 (Italy) – violation found – Apr 2025 | Unclear Cookie Information
- State Education Development Agency (Latvia) – violation found – Feb 2025 | Cookies Placed Before Consent, Unclear Cookie Information
- F.C. Copenhagen (Denmark) – violation found – Dec 2024
- Freedelity (Belgium) – violation found – Nov 2024
- Aosom Italy S.r.l. (Italy) – violation found – Nov 2024 | Unclear Cookie Information, No Granular Cookie Choice
- Società Onlinestore s.r.l. (Italy) – violation found – Oct 2024 | No Reject Button, Pre-ticked Consent Boxes, Cookies Persist After Rejection, Unclear Cookie Information, No Granular Cookie Choice
- Telerama News (Italy) – violation found – Sept 2024
- SIA GZ AUTO (Latvia) – violation found – Jan 2024 | No Reject Button, Cookies Placed Before Consent, Third-Party Cookies Without Consent
- Azienda Ospedaliero Universitaria Città della Salute e della Scienza di Torino (Italy) – violation found – Oct 2023
- Mrs XX - natural person (Italy) – violation found – Oct 2023
- Azienda Ospedaliera Universitaria Careggi (Italy) – violation found – Jul 2023
- Istituto Nazionale di Statistica (Italy) – violation found – Jun 2023
- Ilmatieteenlaitos (Finland) – violation found – Apr 2023
- City of Helsinki (Finland) – violation found – Dec 2022 | Cookies Placed Before Consent, Third-Party Cookies Without Consent, Unclear Cookie Information
- Toerisme Vlaanderen (Belgium) – violation found – Nov 2022 | No Reject Button, Unclear Cookie Information
- JP/Politikens Hus A/S (Denmark) – violation found – Oct 2022 | Misleading Banner Messaging, Unclear Cookie Information