GDPR Fines & Penalties 2026
Search published European fines, warnings, orders and court decisions with a confirmed EU GDPR legal basis. Cases whose applicable law has not yet been confirmed are excluded.
Selected coverage: Europe. Only published cases are included.
2,174 results · Showing 426–450
Alessandro Volta Classical and Scientific High School in Como
CAJA RURAL CENTRAL, S.C.C.
CAJA RURAL DE JAEN, BARCELONA Y MADRID, S.C.C.
Δήμος Πατρέων (Municipality of Patra)
Spanish Society of Medical Oncology
EDP Solar Spain
Association Mousse
Court case 22-3460
Court case III OSK 4868/21
Banco Pichincha
Court case W258 2227269-1/39E
Coolblue B.V
Court case 62 O 194/23
LÍNEA DIRECTA ASEGURADORA, S.A.
Comune di Brescia
Court case W137 2292450-1/4E
INTERURBANA DE AUTOBUSES, S.A.
El León Espanol
DPA case 2024-0.796.258
Comune di Corte Franca
dott. Giuseppe Rubino
CAIXABANK, S.A.
Physician
Compania de Transport Public Cluj-Napoca S.A.
Granit Bostad Beritsholm AB
Frequently Asked Questions About GDPR Enforcement
Q:What types of GDPR enforcement actions exist?
GDPR enforcement actions include monetary fines (the most publicised), formal warnings, reprimands, processing bans, data erasure orders, and compliance orders. DPAs can also impose temporary or permanent limitations on data processing. Fines can reach up to EUR 20 million or 4% of annual worldwide turnover, whichever is higher, under Article 83(5) GDPR.
Q:How are GDPR fines calculated by data protection authorities?
DPAs consider factors listed in Article 83(2) GDPR: nature, gravity, and duration of the infringement; intentional or negligent character; actions taken to mitigate damage; degree of responsibility; previous infringements; degree of cooperation; categories of personal data affected; how the infringement became known; and adherence to approved codes of conduct or certification mechanisms.
Q:Can GDPR fines be appealed?
Yes, GDPR fines can be appealed through national courts. Many high-profile fines have been challenged. The appeals process varies by country. Some fines have been reduced on appeal (e.g., British Airways' fine was reduced from GBP 183 million to GBP 20 million), while others have been upheld or even increased.
Browse case links on this page
GDPR Enforcement Actions (2,174 total)
- Alessandro Volta Classical and Scientific High School in Como (Italy) – €2K – Jan 2025
- CAJA RURAL CENTRAL, S.C.C. (Spain) – €72K – Jan 2025
- CAJA RURAL DE JAEN, BARCELONA Y MADRID, S.C.C. (Spain) – €400K – Jan 2025
- Δήμος Πατρέων (Municipality of Patra) (Greece) – €5K – Jan 2025
- Spanish Society of Medical Oncology (Spain) – €42K – Jan 2025
- EDP Solar Spain (Spain) – €42K – Jan 2025
- Association Mousse (France) – cjeu ruling – Jan 2025
- Court case 22-3460 (Netherlands) – court ruling – Jan 2025
- Court case III OSK 4868/21 (Poland) – court ruling – Jan 2025
- Banco Pichincha (Spain) – €50K – Jan 2025
- Court case W258 2227269-1/39E (Austria) – court ruling – Dec 2024
- Coolblue B.V (Netherlands) – €40K – Dec 2024
- Court case 62 O 194/23 (Germany) – court ruling – Dec 2024
- LÍNEA DIRECTA ASEGURADORA, S.A. (Spain) – €300K – Dec 2024
- Comune di Brescia (Italy) – €10K – Dec 2024
- Court case W137 2292450-1/4E (Austria) – court ruling – Dec 2024
- INTERURBANA DE AUTOBUSES, S.A. (Spain) – €70K – Dec 2024
- El León Espanol (Spain) – €10K – Dec 2024
- DPA case 2024-0.796.258 (Austria) – €2K – Dec 2024
- Comune di Corte Franca (Italy) – €6K – Dec 2024
- dott. Giuseppe Rubino (Italy) – €20K – Dec 2024
- CAIXABANK, S.A. (Spain) – €3.5M – Dec 2024
- Physician (Italy) – €20K – Dec 2024
- Compania de Transport Public Cluj-Napoca S.A. (Romania) – €4K – Dec 2024
- Granit Bostad Beritsholm AB (Sweden) – €18K – Dec 2024