GDPR Fines & Penalties 2026
Search published European fines, warnings, orders and court decisions with a confirmed EU GDPR legal basis. Cases whose applicable law has not yet been confirmed are excluded.
Selected coverage: Europe. Only published cases are included.
17 results · Showing 1–17
GGNet
Nederlands Instituut voor Forensische Psychiatrie en Psychologie (Netherlands Institute for Forensic Psychiatry and Psychology)
Plaintiff 1, Plaintiff 2, and Clara Wichmann Bureau Foundation
Belastingdienst
Mollie (data controller)
Court case C/05/404834 / HA ZA 22-245
Court case 21/00910
Autoriteit Persoonsgegevens
Stichting Bureau Krediet Registratie
Zakelijk Energie Beheer B.V.
Stichting Bureau Krediet Registratie
Personal Data Authority
NederWoon Verhuurmakelaars B.V.
STICHTING RECLASSERING NEDERLAND
Court case C/05/368427 / KG ZA 20-106
ABN AMRO Bank NV
Court case AWB - 18 _ 3073
Frequently Asked Questions About GDPR Enforcement
Q:What types of GDPR enforcement actions exist?
GDPR enforcement actions include monetary fines (the most publicised), formal warnings, reprimands, processing bans, data erasure orders, and compliance orders. DPAs can also impose temporary or permanent limitations on data processing. Fines can reach up to EUR 20 million or 4% of annual worldwide turnover, whichever is higher, under Article 83(5) GDPR.
Q:How are GDPR fines calculated by data protection authorities?
DPAs consider factors listed in Article 83(2) GDPR: nature, gravity, and duration of the infringement; intentional or negligent character; actions taken to mitigate damage; degree of responsibility; previous infringements; degree of cooperation; categories of personal data affected; how the infringement became known; and adherence to approved codes of conduct or certification mechanisms.
Q:Can GDPR fines be appealed?
Yes, GDPR fines can be appealed through national courts. Many high-profile fines have been challenged. The appeals process varies by country. Some fines have been reduced on appeal (e.g., British Airways' fine was reduced from GBP 183 million to GBP 20 million), while others have been upheld or even increased.
Browse case links on this page
GDPR Enforcement Actions (17 total)
- GGNet (Netherlands) – court ruling – Aug 2025
- Nederlands Instituut voor Forensische Psychiatrie en Psychologie (Netherlands Institute for Forensic Psychiatry and Psychology) (Netherlands) – court ruling – Oct 2024
- Plaintiff 1, Plaintiff 2, and Clara Wichmann Bureau Foundation (Netherlands) – court ruling – Jun 2024
- Belastingdienst (Netherlands) – court ruling – Aug 2023
- Mollie (data controller) (Netherlands) – court ruling – Nov 2022
- Court case C/05/404834 / HA ZA 22-245 (Netherlands) – court ruling – Oct 2022
- Court case 21/00910 (Netherlands) – court ruling – Jul 2022
- Autoriteit Persoonsgegevens (Netherlands) – court ruling – May 2022
- Stichting Bureau Krediet Registratie (Netherlands) – court ruling – Apr 2022
- Zakelijk Energie Beheer B.V. (Netherlands) – court ruling – Jan 2022
- Stichting Bureau Krediet Registratie (Netherlands) – court ruling – Jan 2022
- Personal Data Authority (Netherlands) – court ruling – Nov 2021
- NederWoon Verhuurmakelaars B.V. (Netherlands) – court ruling – Apr 2021
- STICHTING RECLASSERING NEDERLAND (Netherlands) – court ruling – Aug 2020
- Court case C/05/368427 / KG ZA 20-106 (Netherlands) – court ruling – May 2020
- ABN AMRO Bank NV (Netherlands) – court ruling – Apr 2020
- Court case AWB - 18 _ 3073 (Netherlands) – court ruling – Dec 2018