GDPR Fines & Penalties 2026
Search published European fines, warnings, orders and court decisions with a confirmed EU GDPR legal basis. Cases whose applicable law has not yet been confirmed are excluded.
Selected coverage: Europe. Only published cases are included.
1,393 results · Showing 701–725
Sats ASA
SATS Norway AS
Bank
DPA case 06/2023
Court case 1 K 6024/20
Court case 14 Sa 359/22
Court case W252 2248013-1
DPA case 04/2023
Court case 4 Sa 201 22
Company
Court case W176 2248585-1
Lensway Group AB
Lensway
DPA case 3116/163/20
DPA case 02/2023
CJEU case C-154/21 Österreichische Post (Information regarding the recipients of personal data)
DPA case 1/2023
XX (the data subject)
Reweb s.r.l.
Azienda Sanitaria Locale di Brindisi
Wikimedia Foundation Inc
Church of Norway - Den norske kirke
Court case C/16/536914 / HA RK 22-78
Homeowners Association
DPA case 189/2022
Frequently Asked Questions About GDPR Enforcement
Q:What types of GDPR enforcement actions exist?
GDPR enforcement actions include monetary fines (the most publicised), formal warnings, reprimands, processing bans, data erasure orders, and compliance orders. DPAs can also impose temporary or permanent limitations on data processing. Fines can reach up to EUR 20 million or 4% of annual worldwide turnover, whichever is higher, under Article 83(5) GDPR.
Q:How are GDPR fines calculated by data protection authorities?
DPAs consider factors listed in Article 83(2) GDPR: nature, gravity, and duration of the infringement; intentional or negligent character; actions taken to mitigate damage; degree of responsibility; previous infringements; degree of cooperation; categories of personal data affected; how the infringement became known; and adherence to approved codes of conduct or certification mechanisms.
Q:Can GDPR fines be appealed?
Yes, GDPR fines can be appealed through national courts. Many high-profile fines have been challenged. The appeals process varies by country. Some fines have been reduced on appeal (e.g., British Airways' fine was reduced from GBP 183 million to GBP 20 million), while others have been upheld or even increased.
Browse case links on this page
GDPR Enforcement Actions (1,393 total)
- Sats ASA (Norway) – €900K – Feb 2023
- SATS Norway AS (Norway) – €870K – Feb 2023
- Bank (Germany) – court ruling – Feb 2023
- DPA case 06/2023 (Belgium) – complaint upheld – Feb 2023
- Court case 1 K 6024/20 (Germany) – court ruling – Feb 2023
- Court case 14 Sa 359/22 (Germany) – court ruling – Jan 2023
- Court case W252 2248013-1 (Austria) – court ruling – Jan 2023
- DPA case 04/2023 (Belgium) – complaint upheld – Jan 2023
- Court case 4 Sa 201 22 (Germany) – court ruling – Jan 2023
- Company (Lithuania) – €8K – Jan 2023
- Court case W176 2248585-1 (Austria) – court ruling – Jan 2023
- Lensway Group AB (Sweden) – complaint upheld – Jan 2023
- Lensway (Sweden) – complaint upheld – Jan 2023
- DPA case 3116/163/20 (Finland) – violation found – Jan 2023
- DPA case 02/2023 (Belgium) – order – Jan 2023
- CJEU case C-154/21 Österreichische Post (Information regarding the recipients of personal data) (Austria) – cjeu ruling – Jan 2023
- DPA case 1/2023 (Greece) – order – Jan 2023
- XX (the data subject) (Italy) – complaint upheld – Jan 2023
- Reweb s.r.l. (Italy) – €5K – Jan 2023
- Azienda Sanitaria Locale di Brindisi (Italy) – €3K – Jan 2023
- Wikimedia Foundation Inc (Austria) – dismissed – Jan 2023
- Church of Norway - Den norske kirke (Norway) – violation found – Jan 2023
- Court case C/16/536914 / HA RK 22-78 (Netherlands) – court ruling – Jan 2023
- Homeowners Association (Spain) – €2K – Dec 2022
- DPA case 189/2022 (Belgium) – complaint upheld – Dec 2022