GDPR Fines & Penalties 2026
Search published European fines, warnings, orders and court decisions with a confirmed EU GDPR legal basis. Cases whose applicable law has not yet been confirmed are excluded.
Selected coverage: Europe. Only published cases are included.
144 results · Showing 51–75
Court case 3 C 112/24
Court case 27 O 60/24
CJEU case C‑21/23 Lindenapotheke
Court case 10 O 4/24
Court case 13 O 220/23
HTB Neunte Immobilien Portfolio geschlossene Investment UG & Co. KG
Court case 3 Ca 77/24
Telecom provider (Controller)
Court case IX R 6/23
Employee versus Employer
Court case 1 O 64/24
Court case 14 K 870/22
Court case 24 O 1624/23
Court case VI ZR 370/22
Person pretending to be the data subject
Court case 3 Bs 146/23
VG Mainz
Court case 5 BV 20.2104
Court case 2-24 O 156/21
Energie AG
Court case 8 U 94/22
Court case 33 O 5976/22
Election Commitee of the Workers Council of SuperVista AG
Court case 2 A 111/22
Data Protection Authority of Lower Saxony
Frequently Asked Questions About GDPR Enforcement
Q:What types of GDPR enforcement actions exist?
GDPR enforcement actions include monetary fines (the most publicised), formal warnings, reprimands, processing bans, data erasure orders, and compliance orders. DPAs can also impose temporary or permanent limitations on data processing. Fines can reach up to EUR 20 million or 4% of annual worldwide turnover, whichever is higher, under Article 83(5) GDPR.
Q:How are GDPR fines calculated by data protection authorities?
DPAs consider factors listed in Article 83(2) GDPR: nature, gravity, and duration of the infringement; intentional or negligent character; actions taken to mitigate damage; degree of responsibility; previous infringements; degree of cooperation; categories of personal data affected; how the infringement became known; and adherence to approved codes of conduct or certification mechanisms.
Q:Can GDPR fines be appealed?
Yes, GDPR fines can be appealed through national courts. Many high-profile fines have been challenged. The appeals process varies by country. Some fines have been reduced on appeal (e.g., British Airways' fine was reduced from GBP 183 million to GBP 20 million), while others have been upheld or even increased.
Browse case links on this page
GDPR Enforcement Actions (144 total)
- Court case 3 C 112/24 (Germany) – court ruling – Oct 2024
- Court case 27 O 60/24 (Germany) – court ruling – Oct 2024
- CJEU case C‑21/23 Lindenapotheke (Germany) – cjeu ruling – Oct 2024
- Court case 10 O 4/24 (Germany) – court ruling – Sept 2024
- Court case 13 O 220/23 (Germany) – court ruling – Sept 2024
- HTB Neunte Immobilien Portfolio geschlossene Investment UG & Co. KG (Germany) – cjeu ruling – Sept 2024
- Court case 3 Ca 77/24 (Germany) – court ruling – Sept 2024
- Telecom provider (Controller) (Germany) – court ruling – Sept 2024
- Court case IX R 6/23 (Germany) – court ruling – Aug 2024
- Employee versus Employer (Germany) – court ruling – Jul 2024
- Court case 1 O 64/24 (Germany) – court ruling – Jul 2024
- Court case 14 K 870/22 (Germany) – court ruling – Jun 2024
- Court case 24 O 1624/23 (Germany) – court ruling – Jun 2024
- Court case VI ZR 370/22 (Germany) – court ruling – May 2024
- Person pretending to be the data subject (Germany) – court ruling – Mar 2024
- Court case 3 Bs 146/23 (Germany) – court ruling – Nov 2023
- VG Mainz (Germany) – court ruling – Jun 2023
- Court case 5 BV 20.2104 (Germany) – court ruling – May 2023
- Court case 2-24 O 156/21 (Germany) – court ruling – May 2023
- Energie AG (Germany) – court ruling – May 2023
- Court case 8 U 94/22 (Germany) – court ruling – Apr 2023
- Court case 33 O 5976/22 (Germany) – court ruling – Apr 2023
- Election Commitee of the Workers Council of SuperVista AG (Germany) – court ruling – Apr 2023
- Court case 2 A 111/22 (Germany) – court ruling – Apr 2023
- Data Protection Authority of Lower Saxony (Germany) – court ruling – Mar 2023