GDPR Fines & Penalties 2026
Search published European fines, warnings, orders and court decisions with a confirmed EU GDPR legal basis. Cases whose applicable law has not yet been confirmed are excluded.
Selected coverage: Europe. Only published cases are included.
1,393 results · Showing 351–375
Serfin 97 S.r.l.
Agentsia po vpisvaniyata
Nederlands Instituut voor Forensische Psychiatrie en Psychologie (Netherlands Institute for Forensic Psychiatry and Psychology)
DPA case 10072622
Ministero dell'Interno
Udviklings- og Forenklingsstyrelsen
CI & DI Food s.r.l.
Attorney
PPC ENERGIE MUNTENIA S.A.
Ministry of Citizan Protection
DPA case TSV/12/2019
Vodafone România SA
SC Class IT Outsourcing SRL
Top Quality Corporation s.r.l.s.
Ordine delle Professioni Infermieristiche di Udine
Bunq BV
Senira Ltd.
Court case 6 O 65/24
Court case III OSK 769/23
Δ.Ε.Η. Α.Ε. (Public Power Corporation)
Finnish Tax Administration
Court case PVN-2024-05
[Verzoeker]
Court case 62 O 88/23
Santander Consumer Finance S.A.
Frequently Asked Questions About GDPR Enforcement
Q:What types of GDPR enforcement actions exist?
GDPR enforcement actions include monetary fines (the most publicised), formal warnings, reprimands, processing bans, data erasure orders, and compliance orders. DPAs can also impose temporary or permanent limitations on data processing. Fines can reach up to EUR 20 million or 4% of annual worldwide turnover, whichever is higher, under Article 83(5) GDPR.
Q:How are GDPR fines calculated by data protection authorities?
DPAs consider factors listed in Article 83(2) GDPR: nature, gravity, and duration of the infringement; intentional or negligent character; actions taken to mitigate damage; degree of responsibility; previous infringements; degree of cooperation; categories of personal data affected; how the infringement became known; and adherence to approved codes of conduct or certification mechanisms.
Q:Can GDPR fines be appealed?
Yes, GDPR fines can be appealed through national courts. Many high-profile fines have been challenged. The appeals process varies by country. Some fines have been reduced on appeal (e.g., British Airways' fine was reduced from GBP 183 million to GBP 20 million), while others have been upheld or even increased.
Browse case links on this page
GDPR Enforcement Actions (1,393 total)
- Serfin 97 S.r.l. (Italy) – €60K – Oct 2024
- Agentsia po vpisvaniyata (Bulgaria) – cjeu ruling – Oct 2024
- Nederlands Instituut voor Forensische Psychiatrie en Psychologie (Netherlands Institute for Forensic Psychiatry and Psychology) (Netherlands) – court ruling – Oct 2024
- DPA case 10072622 (Italy) – violation found – Sept 2024
- Ministero dell'Interno (Italy) – complaint upheld – Sept 2024
- Udviklings- og Forenklingsstyrelsen (Denmark) – complaint upheld – Sept 2024
- CI & DI Food s.r.l. (Italy) – €4K – Sept 2024
- Attorney (Greece) – €1K – Sept 2024
- PPC ENERGIE MUNTENIA S.A. (Romania) – €2K – Sept 2024
- Ministry of Citizan Protection (Greece) – €150K – Sept 2024
- DPA case TSV/12/2019 (Finland) – complaint upheld – Sept 2024
- Vodafone România SA (Romania) – €3K – Sept 2024
- SC Class IT Outsourcing SRL (Romania) – €1K – Sept 2024
- Top Quality Corporation s.r.l.s. (Italy) – €5K – Sept 2024
- Ordine delle Professioni Infermieristiche di Udine (Italy) – €8K – Sept 2024
- Bunq BV (Netherlands) – court ruling – Sept 2024
- Senira Ltd. (Cyprus) – €3K – Sept 2024
- Court case 6 O 65/24 (Germany) – court ruling – Sept 2024
- Court case III OSK 769/23 (Poland) – court ruling – Sept 2024
- Δ.Ε.Η. Α.Ε. (Public Power Corporation) (Greece) – €28K – Sept 2024
- Finnish Tax Administration (Finland) – complaint upheld – Aug 2024
- Court case PVN-2024-05 (Norway) – court ruling – Aug 2024
- [Verzoeker] (Netherlands) – court ruling – Aug 2024
- Court case 62 O 88/23 (Germany) – court ruling – Aug 2024
- Santander Consumer Finance S.A. (Spain) – €50K – Aug 2024