GDPR Fines & Penalties 2026
Search published European fines, warnings, orders and court decisions with a confirmed EU GDPR legal basis. Cases whose applicable law has not yet been confirmed are excluded.
Selected coverage: Europe. Only published cases are included.
1,393 results · Showing 501–525
Simtan Kaubandus OÜ
Candidate for parliamentary elections
Austrian Data Protection Authority
Public Employment Service Austria (respondent in the initial trial before the DSB)
CRIF Bürgel
DPA case NAIH-6752-10/2023
DPA case Mál nr. 2021091751
VACACIONES EDREAMS, S.L.
Uber Technologies Inc. and Uber B.V.
Uber Technologies Inc. Uber B.V.
Schufa
UF (data subject and claimant before national court)
Nordea Bank
Postbeamtenkrankenkasse (PBeaKK, German Postal Civil Servants’ Health Insurance Fund)
Techno Security s.r.l.
DPA case 07100-15-2023-1
Court case W214 2233132-1/27E
Court case 4 U 347/21
Ex-employee (data subject)
DPA case DOS-2023-04144
Pitagorasz Oktatási Stúdió Kft
Alpha Bank
EASYJET AIRLINE COMPANY LIMITED
Court case W214 2222613-2
Frequently Asked Questions About GDPR Enforcement
Q:What types of GDPR enforcement actions exist?
GDPR enforcement actions include monetary fines (the most publicised), formal warnings, reprimands, processing bans, data erasure orders, and compliance orders. DPAs can also impose temporary or permanent limitations on data processing. Fines can reach up to EUR 20 million or 4% of annual worldwide turnover, whichever is higher, under Article 83(5) GDPR.
Q:How are GDPR fines calculated by data protection authorities?
DPAs consider factors listed in Article 83(2) GDPR: nature, gravity, and duration of the infringement; intentional or negligent character; actions taken to mitigate damage; degree of responsibility; previous infringements; degree of cooperation; categories of personal data affected; how the infringement became known; and adherence to approved codes of conduct or certification mechanisms.
Q:Can GDPR fines be appealed?
Yes, GDPR fines can be appealed through national courts. Many high-profile fines have been challenged. The appeals process varies by country. Some fines have been reduced on appeal (e.g., British Airways' fine was reduced from GBP 183 million to GBP 20 million), while others have been upheld or even increased.
Browse case links on this page
GDPR Enforcement Actions (1,393 total)
- Simtan Kaubandus OÜ (Estonia) – violation found – Jan 2024
- Candidate for parliamentary elections (France) – €0 – Dec 2023
- Austrian Data Protection Authority (Austria) – court ruling – Dec 2023
- Public Employment Service Austria (respondent in the initial trial before the DSB) (Austria) – court ruling – Dec 2023
- CRIF Bürgel (Germany) – complaint upheld – Dec 2023
- DPA case NAIH-6752-10/2023 (Hungary) – complaint upheld – Dec 2023
- Facebook (Germany) – court ruling – Dec 2023
- DPA case Mál nr. 2021091751 (Iceland) – dismissed – Dec 2023
- VACACIONES EDREAMS, S.L. (Spain) – €10K – Dec 2023
- Uber Technologies Inc. and Uber B.V. (Netherlands) – €10.0M – Dec 2023
- Uber Technologies Inc. Uber B.V. (Netherlands) – €10.0M – Dec 2023
- Schufa (Germany) – cjeu ruling – Dec 2023
- UF (data subject and claimant before national court) (Germany) – cjeu ruling – Dec 2023
- Nordea Bank (Sweden) – dismissed – Dec 2023
- Postbeamtenkrankenkasse (PBeaKK, German Postal Civil Servants’ Health Insurance Fund) (Germany) – court ruling – Nov 2023
- Techno Security s.r.l. (Italy) – €1K – Nov 2023
- DPA case 07100-15-2023-1 (Slovenia) – complaint upheld – Nov 2023
- Court case W214 2233132-1/27E (Austria) – court ruling – Nov 2023
- Court case 4 U 347/21 (Germany) – court ruling – Nov 2023
- Ex-employee (data subject) (Germany) – court ruling – Nov 2023
- DPA case DOS-2023-04144 (Belgium) – complaint upheld – Nov 2023
- Pitagorasz Oktatási Stúdió Kft (Hungary) – €1K – Nov 2023
- Alpha Bank (Greece) – €10K – Nov 2023
- EASYJET AIRLINE COMPANY LIMITED (Spain) – €8K – Nov 2023
- Court case W214 2222613-2 (Austria) – court ruling – Nov 2023