GDPR Fines & Penalties 2026
Search published European fines, warnings, orders and court decisions with a confirmed EU GDPR legal basis. Cases whose applicable law has not yet been confirmed are excluded.
Selected coverage: Europe. Only published cases are included.
878 results · Showing 551–575
English School staff union (ESSA)
DPA case 2020031451
DPA case 33/2022
Azienda USL Toscana Centro
Reykjavík University
Retail company (name not available at the moment)
Court case 4 CS 21.2254
e-Boks
Danish Agency for Digitisation
Norwegian Parliament
Høje-Taastrup Municipality
Court case 10 As 190/2020 - 39
Dutch Foreign Ministry
Capital Region of Denmark
Scanshare S.r.l.
IAB Europe
Lillestrøm Municipality
Lillestrøm municipality
EU DisinfoLab
Researcher
Slane Credit Union Ltd.
DPA case IN-20-4-7
Fortum Marketing and Sales Polska S.A.
Santander Bank Polska S. A.
Fortum Marketing and Sales Polska S.A.
Frequently Asked Questions About GDPR Enforcement
Q:What types of GDPR enforcement actions exist?
GDPR enforcement actions include monetary fines (the most publicised), formal warnings, reprimands, processing bans, data erasure orders, and compliance orders. DPAs can also impose temporary or permanent limitations on data processing. Fines can reach up to EUR 20 million or 4% of annual worldwide turnover, whichever is higher, under Article 83(5) GDPR.
Q:How are GDPR fines calculated by data protection authorities?
DPAs consider factors listed in Article 83(2) GDPR: nature, gravity, and duration of the infringement; intentional or negligent character; actions taken to mitigate damage; degree of responsibility; previous infringements; degree of cooperation; categories of personal data affected; how the infringement became known; and adherence to approved codes of conduct or certification mechanisms.
Q:Can GDPR fines be appealed?
Yes, GDPR fines can be appealed through national courts. Many high-profile fines have been challenged. The appeals process varies by country. Some fines have been reduced on appeal (e.g., British Airways' fine was reduced from GBP 183 million to GBP 20 million), while others have been upheld or even increased.
Browse case links on this page
GDPR Enforcement Actions (878 total)
- English School staff union (ESSA) (Cyprus) – €5K – Mar 2022
- DPA case 2020031451 (Iceland) – complaint upheld – Mar 2022
- DPA case 33/2022 (Belgium) – complaint upheld – Mar 2022
- Azienda USL Toscana Centro (Italy) – €10K – Mar 2022
- Reykjavík University (Iceland) – complaint upheld – Mar 2022
- Retail company (name not available at the moment) (Croatia) – €89K – Mar 2022
- Court case 4 CS 21.2254 (Germany) – court ruling – Mar 2022
- e-Boks (Denmark) – violation found – Mar 2022
- Danish Agency for Digitisation (Denmark) – violation found – Mar 2022
- Norwegian Parliament (Norway) – €195K – Mar 2022
- Høje-Taastrup Municipality (Denmark) – violation found – Mar 2022
- Court case 10 As 190/2020 - 39 (Czech Republic) – court ruling – Feb 2022
- Dutch Foreign Ministry (Netherlands) – €565K – Feb 2022
- Capital Region of Denmark (Denmark) – violation found – Feb 2022
- Scanshare S.r.l. (Italy) – €10K – Feb 2022
- IAB Europe (Belgium) – €0 – Feb 2022
- Lillestrøm Municipality (Norway) – €30K – Feb 2022
- Lillestrøm municipality (Norway) – €26K – Feb 2022
- EU DisinfoLab (Belgium) – €3K – Jan 2022
- Researcher (Belgium) – €1K – Jan 2022
- Slane Credit Union Ltd. (Ireland) – €5K – Jan 2022
- DPA case IN-20-4-7 (Ireland) – no violation – Jan 2022
- Fortum Marketing and Sales Polska S.A. (Poland) – €1.0M – Jan 2022
- Santander Bank Polska S. A. (Poland) – €117K – Jan 2022
- Fortum Marketing and Sales Polska S.A. (Poland) – €1.1M – Jan 2022