GDPR Fines & Penalties 2026
Search published European fines, warnings, orders and court decisions with a confirmed EU GDPR legal basis. Cases whose applicable law has not yet been confirmed are excluded.
Selected coverage: Europe. Only published cases are included.
67 results · Showing 26–50
DPA case 49/2023
DPA case 41/2023
A care home (the controller)
DPA case 14/2023
DPA case 147/2022
DPA case 146/2022
DPA case Decision 138-2022
DPA case 115/2022
DPA case DOS-2022-01864
Ambuce Rescue Team
DPA case 41/2022
DPA case 130/2021
DPA case 125/2021
DPA case 124/2021
Gegevensbeschermingsautoriteit (Data Protection Authority)
DPA case 85/2021
Mircom International Content Management & Consulting (M.I.C.M.) Limited
DPA case 54/2021
DPA case 55/2021
A private individual (plaintiff)
Mrs Y (The Complainant)
School
Gegevensbeschermingsautoriteit
Family Service / N.D.P.K. nv.
Anonymous (Complainant)
Frequently Asked Questions About GDPR Enforcement
Q:What types of GDPR enforcement actions exist?
GDPR enforcement actions include monetary fines (the most publicised), formal warnings, reprimands, processing bans, data erasure orders, and compliance orders. DPAs can also impose temporary or permanent limitations on data processing. Fines can reach up to EUR 20 million or 4% of annual worldwide turnover, whichever is higher, under Article 83(5) GDPR.
Q:How are GDPR fines calculated by data protection authorities?
DPAs consider factors listed in Article 83(2) GDPR: nature, gravity, and duration of the infringement; intentional or negligent character; actions taken to mitigate damage; degree of responsibility; previous infringements; degree of cooperation; categories of personal data affected; how the infringement became known; and adherence to approved codes of conduct or certification mechanisms.
Q:Can GDPR fines be appealed?
Yes, GDPR fines can be appealed through national courts. Many high-profile fines have been challenged. The appeals process varies by country. Some fines have been reduced on appeal (e.g., British Airways' fine was reduced from GBP 183 million to GBP 20 million), while others have been upheld or even increased.
Browse case links on this page
GDPR Enforcement Actions (67 total)
- DPA case 49/2023 (Belgium) – complaint upheld – Apr 2023
- DPA case 41/2023 (Belgium) – dismissed – Apr 2023
- A care home (the controller) (Belgium) – complaint upheld – Mar 2023
- DPA case 14/2023 (Belgium) – complaint upheld – Feb 2023
- DPA case 147/2022 (Belgium) – complaint upheld – Oct 2022
- DPA case 146/2022 (Belgium) – order – Oct 2022
- DPA case Decision 138-2022 (Belgium) – complaint upheld – Sept 2022
- DPA case 115/2022 (Belgium) – complaint upheld – Jul 2022
- DPA case DOS-2022-01864 (Belgium) – complaint upheld – May 2022
- Ambuce Rescue Team (Belgium) – €20K – Apr 2022
- DPA case 41/2022 (Belgium) – dismissed – Mar 2022
- DPA case 130/2021 (Belgium) – complaint upheld – Nov 2021
- DPA case 125/2021 (Belgium) – complaint upheld – Nov 2021
- DPA case 124/2021 (Belgium) – dismissed – Nov 2021
- Gegevensbeschermingsautoriteit (Data Protection Authority) (Belgium) – court ruling – Oct 2021
- DPA case 85/2021 (Belgium) – order – Jul 2021
- Mircom International Content Management & Consulting (M.I.C.M.) Limited (Belgium) – cjeu ruling – Jun 2021
- DPA case 54/2021 (Belgium) – complaint upheld – Apr 2021
- DPA case 55/2021 (Belgium) – complaint upheld – Apr 2021
- A private individual (plaintiff) (Belgium) – complaint upheld – Apr 2021
- Mrs Y (The Complainant) (Belgium) – complaint upheld – Mar 2021
- School (Belgium) – €1K – Mar 2021
- Gegevensbeschermingsautoriteit (Belgium) – court ruling – Feb 2021
- Family Service / N.D.P.K. nv. (Belgium) – €50K – Jan 2021
- Anonymous (Complainant) (Belgium) – €50K – Jan 2021