GDPR Fines & Penalties 2026
Search published European fines, warnings, orders and court decisions with a confirmed EU GDPR legal basis. Cases whose applicable law has not yet been confirmed are excluded.
Selected coverage: Europe. Only published cases are included.
168 results · Showing 1–25
DPA case DKE.561.7.2026
Sole trader
DPA case DKN.5131.24.2025
Court bailiff at a district court
Sole trader providing accounting and tax advisory services
DPA case DKN.5131.12.2022
Minister of Justice
DPA case DKE.561.1.2026
Court case III OSK 2508/25
DPA case DS.523.2582.2024
Civic association
Housing Associaction
Court case III C 904/23
Election Committee of Karol Nawrocki
Fundację Lumus
DPD Polska sp. z o.o.
Poczta Polska (Polish Post)
Powiatowego Inspektora Sanitarnego w Policach
Court Bailiff
Court case I C 321/24
Unknown
Non-Public Health Care Institution
L. Zamenhof University Children's Clinical Hospital in Białystok
Municipal Social Welfare Center Aleksandrów
Krajowa Szkoła Sądownictwa i Prokuratury (National School of Judiciary and Public Prosecutor)
Frequently Asked Questions About GDPR Enforcement
Q:What types of GDPR enforcement actions exist?
GDPR enforcement actions include monetary fines (the most publicised), formal warnings, reprimands, processing bans, data erasure orders, and compliance orders. DPAs can also impose temporary or permanent limitations on data processing. Fines can reach up to EUR 20 million or 4% of annual worldwide turnover, whichever is higher, under Article 83(5) GDPR.
Q:How are GDPR fines calculated by data protection authorities?
DPAs consider factors listed in Article 83(2) GDPR: nature, gravity, and duration of the infringement; intentional or negligent character; actions taken to mitigate damage; degree of responsibility; previous infringements; degree of cooperation; categories of personal data affected; how the infringement became known; and adherence to approved codes of conduct or certification mechanisms.
Q:Can GDPR fines be appealed?
Yes, GDPR fines can be appealed through national courts. Many high-profile fines have been challenged. The appeals process varies by country. Some fines have been reduced on appeal (e.g., British Airways' fine was reduced from GBP 183 million to GBP 20 million), while others have been upheld or even increased.
Browse case links on this page
GDPR Enforcement Actions (168 total)
- DPA case DKE.561.7.2026 (Poland) – violation found – Sept 2026
- Sole trader (Poland) – €8K – Sept 2026
- DPA case DKN.5131.24.2025 (Poland) – violation found – Jul 2026
- Court bailiff at a district court (Poland) – €4K – Jul 2026
- Sole trader providing accounting and tax advisory services (Poland) – €3K – Jun 2026
- DPA case DKN.5131.12.2022 (Poland) – violation found – Jun 2026
- Minister of Justice (Poland) – €24K – Jun 2026
- DPA case DKE.561.1.2026 (Poland) – violation found – Jun 2026
- Court case III OSK 2508/25 (Poland) – court ruling – May 2026
- DPA case DS.523.2582.2024 (Poland) – complaint upheld – May 2026
- Civic association (Poland) – €2K – May 2026
- Housing Associaction (Poland) – €2K – Apr 2026
- Court case III C 904/23 (Poland) – court ruling – Feb 2026
- Election Committee of Karol Nawrocki (Poland) – €8K – Feb 2026
- Fundację Lumus (Poland) – €5K – Feb 2026
- DPD Polska sp. z o.o. (Poland) – €2.7M – Feb 2026
- Poczta Polska (Polish Post) (Poland) – €225K – Jan 2026
- Powiatowego Inspektora Sanitarnego w Policach (Poland) – €5K – Nov 2025
- Court Bailiff (Poland) – €5K – Oct 2025
- Court case I C 321/24 (Poland) – court ruling – Oct 2025
- Unknown (Poland) – €3K – Sept 2025
- Non-Public Health Care Institution (Poland) – €8K – Aug 2025
- L. Zamenhof University Children's Clinical Hospital in Białystok (Poland) – €16K – Jun 2025
- Municipal Social Welfare Center Aleksandrów (Poland) – €4K – Jun 2025
- Krajowa Szkoła Sądownictwa i Prokuratury (National School of Judiciary and Public Prosecutor) (Poland) – court ruling – Jun 2025