GDPR Fines & Penalties 2026
Search published European fines, warnings, orders and court decisions with a confirmed EU GDPR legal basis. Cases whose applicable law has not yet been confirmed are excluded.
Selected coverage: Europe. Only published cases are included.
187 results · Showing 126–150
Banca Cambiano 1884 S.p.A.
Deca s.r.l.
XX (the data subject)
Reweb s.r.l.
Azienda Sanitaria Locale di Brindisi
Scuola Statale Secondaria di I^ grado 'Bianco-Pascol'
Amazon Italia Logistica s.r.l.
Areti spa
Signore XX (the data subject)
Cisterna di Latina Municipality
I-Model s.r.l.
Vodafone Italia S.p.A.
Comune di Salento
Associazione Rescue Drones Network ODV
FCA Italia s.p.a.
FCA Italy S.p.A.
Bper Banca S.p.A.
Lazio Region
Mister Brick S.a.s.
Cosmopol Security S.p.A.
Policoro municipality
Stay over s.r.l.
Senseonics Inc.
Deutsche Bank
Deutsche Bank S.p.A.
Frequently Asked Questions About GDPR Enforcement
Q:What types of GDPR enforcement actions exist?
GDPR enforcement actions include monetary fines (the most publicised), formal warnings, reprimands, processing bans, data erasure orders, and compliance orders. DPAs can also impose temporary or permanent limitations on data processing. Fines can reach up to EUR 20 million or 4% of annual worldwide turnover, whichever is higher, under Article 83(5) GDPR.
Q:How are GDPR fines calculated by data protection authorities?
DPAs consider factors listed in Article 83(2) GDPR: nature, gravity, and duration of the infringement; intentional or negligent character; actions taken to mitigate damage; degree of responsibility; previous infringements; degree of cooperation; categories of personal data affected; how the infringement became known; and adherence to approved codes of conduct or certification mechanisms.
Q:Can GDPR fines be appealed?
Yes, GDPR fines can be appealed through national courts. Many high-profile fines have been challenged. The appeals process varies by country. Some fines have been reduced on appeal (e.g., British Airways' fine was reduced from GBP 183 million to GBP 20 million), while others have been upheld or even increased.
Browse case links on this page
GDPR Enforcement Actions (187 total)
- Banca Cambiano 1884 S.p.A. (Italy) – €10K – Mar 2023
- Deca s.r.l. (Italy) – €2K – Mar 2023
- XX (the data subject) (Italy) – complaint upheld – Jan 2023
- Reweb s.r.l. (Italy) – €5K – Jan 2023
- Azienda Sanitaria Locale di Brindisi (Italy) – €3K – Jan 2023
- Scuola Statale Secondaria di I^ grado 'Bianco-Pascol' (Italy) – €3K – Dec 2022
- Amazon Italia Logistica s.r.l. (Italy) – €20K – Dec 2022
- Areti spa (Italy) – €1.0M – Nov 2022
- Signore XX (the data subject) (Italy) – €1.0M – Nov 2022
- Cisterna di Latina Municipality (Italy) – €5K – Nov 2022
- I-Model s.r.l. (Italy) – €10K – Nov 2022
- Vodafone Italia S.p.A. (Italy) – €500K – Nov 2022
- Comune di Salento (Italy) – €12K – Oct 2022
- Associazione Rescue Drones Network ODV (Italy) – €3K – Oct 2022
- FCA Italia s.p.a. (Italy) – €40K – Sept 2022
- FCA Italy S.p.A. (Italy) – €40K – Sept 2022
- Bper Banca S.p.A. (Italy) – €10K – Sept 2022
- Lazio Region (Italy) – €100K – Sept 2022
- Mister Brick S.a.s. (Italy) – €1K – Aug 2022
- Cosmopol Security S.p.A. (Italy) – €20K – Aug 2022
- Policoro municipality (Italy) – €26K – Aug 2022
- Stay over s.r.l. (Italy) – €10K – Jul 2022
- Senseonics Inc. (Italy) – €45K – Jul 2022
- Deutsche Bank (Italy) – €20K – Jun 2022
- Deutsche Bank S.p.A. (Italy) – €20K – Jun 2022