GDPR Fines & Penalties 2026
Search published European fines, warnings, orders and court decisions with a confirmed EU GDPR legal basis. Cases whose applicable law has not yet been confirmed are excluded.
Selected coverage: Europe. Only published cases are included.
432 results · Showing 51–75
CURENERGÍA COMERCIALIZADOR DE ÚLTIMO RECURSO S.A.U.
Unknown
4USPORT INSTALACIONES DEPORTIVAS, S.L.
BLUE TEAM FLIGHT SCHOOL, S.L.
Court case Ro 2023/04/0028
Court case C/13/770276 / HA ZA 25-1129
Court case W258 2271494-1
CJEU case C-492/23 Russmedia
Court case BA-1S/27/2022
Father and child (data subjects)
Court case Us I-199/2025-9
Court case 25/12378
DPA case 40 /2025
ASOCIACIÓN ESCUELA NACIONAL DE EQUITACIÓN
DPA case 10188249
Court case Az. I ZB 36/25
EDPS
CJEU case C‑414/24 Datenschutzbehörde (Articulation des recours)
Court case W252 2307842-1
Sole Trader
Court case W137 2308681-1
DPA case 3R-998
Court case Az. VI ZR 426/24
Irish Life Assurance
Lisa Ballmann
Frequently Asked Questions About GDPR Enforcement
Q:What types of GDPR enforcement actions exist?
GDPR enforcement actions include monetary fines (the most publicised), formal warnings, reprimands, processing bans, data erasure orders, and compliance orders. DPAs can also impose temporary or permanent limitations on data processing. Fines can reach up to EUR 20 million or 4% of annual worldwide turnover, whichever is higher, under Article 83(5) GDPR.
Q:How are GDPR fines calculated by data protection authorities?
DPAs consider factors listed in Article 83(2) GDPR: nature, gravity, and duration of the infringement; intentional or negligent character; actions taken to mitigate damage; degree of responsibility; previous infringements; degree of cooperation; categories of personal data affected; how the infringement became known; and adherence to approved codes of conduct or certification mechanisms.
Q:Can GDPR fines be appealed?
Yes, GDPR fines can be appealed through national courts. Many high-profile fines have been challenged. The appeals process varies by country. Some fines have been reduced on appeal (e.g., British Airways' fine was reduced from GBP 183 million to GBP 20 million), while others have been upheld or even increased.
Browse case links on this page
GDPR Enforcement Actions (432 total)
- CURENERGÍA COMERCIALIZADOR DE ÚLTIMO RECURSO S.A.U. (Spain) – €500K – Dec 2025
- Unknown (Spain) – €300 – Dec 2025
- 4USPORT INSTALACIONES DEPORTIVAS, S.L. (Spain) – €600 – Dec 2025
- BLUE TEAM FLIGHT SCHOOL, S.L. (Spain) – €6K – Dec 2025
- Court case Ro 2023/04/0028 (Austria) – court ruling – Dec 2025
- Court case C/13/770276 / HA ZA 25-1129 (Netherlands) – court ruling – Dec 2025
- Court case W258 2271494-1 (Austria) – court ruling – Dec 2025
- CJEU case C-492/23 Russmedia (Romania) – cjeu ruling – Dec 2025
- Court case BA-1S/27/2022 (Slovakia) – court ruling – Dec 2025
- Father and child (data subjects) (Austria) – dismissed – Nov 2025
- Court case Us I-199/2025-9 (Croatia) – court ruling – Nov 2025
- Court case 25/12378 (Norway) – court ruling – Nov 2025
- DPA case 40 /2025 (Greece) – order – Nov 2025
- ASOCIACIÓN ESCUELA NACIONAL DE EQUITACIÓN (Spain) – €750 – Nov 2025
- DPA case 10188249 (Italy) – dismissed – Sept 2025
- Court case Az. I ZB 36/25 (Germany) – court ruling – Sept 2025
- EDPS (European Union) – cjeu ruling – Sept 2025
- CJEU case C‑414/24 Datenschutzbehörde (Articulation des recours) (Austria) – cjeu ruling – Sept 2025
- Court case W252 2307842-1 (Austria) – court ruling – Aug 2025
- Sole Trader (Slovenia) – €500 – Aug 2025
- Court case W137 2308681-1 (Austria) – court ruling – Aug 2025
- DPA case 3R-998 (Lithuania) – dismissed – Jul 2025
- Court case Az. VI ZR 426/24 (Germany) – court ruling – Jul 2025
- Irish Life Assurance (Ireland) – court ruling – Jul 2025
- Lisa Ballmann (European Union) – cjeu ruling – Jul 2025