GDPR Fines & Penalties 2026
Search published European fines, warnings, orders and court decisions with a confirmed EU GDPR legal basis. Cases whose applicable law has not yet been confirmed are excluded.
Selected coverage: Europe. Only published cases are included.
878 results · Showing 726–750
Capio St. Göran AB
Karolinska University Hospital of Solna
Sahlgrenska University Hospital
Västerbotten Region
Östergötland Region
Aleris Sjukvård AB
Aleris Sjukvård AB
Comercio Online Levante, S.L.
Kry
Hälso- och sjukvårdsnämnden, Region Västerbotten
Aleris Sjukvård AB
Sahlgrenska University Hospital, Board of directors
Styrelsen för Karolinska Universitetssjukhuset
OLVG hospital
City of Stockholm
Carrefour France
Secretaría General para la Innovación y Calidad del Servicio Público de Justicia
Indre Østfold kommune (municipality)
Vodafone Italy S.p.A
Urbis sp. z o.o.
Vodafone Italia S.p.A.
Court case 29 OWi 1/20
Telecoms provider (1&1 Telecom GmbH)
Ryanair DAC
Miguel Ibáñez Bezanilla, S.L.
Frequently Asked Questions About GDPR Enforcement
Q:What types of GDPR enforcement actions exist?
GDPR enforcement actions include monetary fines (the most publicised), formal warnings, reprimands, processing bans, data erasure orders, and compliance orders. DPAs can also impose temporary or permanent limitations on data processing. Fines can reach up to EUR 20 million or 4% of annual worldwide turnover, whichever is higher, under Article 83(5) GDPR.
Q:How are GDPR fines calculated by data protection authorities?
DPAs consider factors listed in Article 83(2) GDPR: nature, gravity, and duration of the infringement; intentional or negligent character; actions taken to mitigate damage; degree of responsibility; previous infringements; degree of cooperation; categories of personal data affected; how the infringement became known; and adherence to approved codes of conduct or certification mechanisms.
Q:Can GDPR fines be appealed?
Yes, GDPR fines can be appealed through national courts. Many high-profile fines have been challenged. The appeals process varies by country. Some fines have been reduced on appeal (e.g., British Airways' fine was reduced from GBP 183 million to GBP 20 million), while others have been upheld or even increased.
Browse case links on this page
GDPR Enforcement Actions (878 total)
- Capio St. Göran AB (Sweden) – €2.9M – Dec 2020
- Karolinska University Hospital of Solna (Sweden) – €390K – Dec 2020
- Sahlgrenska University Hospital (Sweden) – €341K – Dec 2020
- Västerbotten Region (Sweden) – €244K – Dec 2020
- Östergötland Region (Sweden) – €244K – Dec 2020
- Aleris Sjukvård AB (Sweden) – €1.2M – Dec 2020
- Aleris Sjukvård AB (Sweden) – €1.5M – Dec 2020
- Comercio Online Levante, S.L. (Spain) – €3K – Dec 2020
- Kry (Sweden) – violation found – Dec 2020
- Hälso- och sjukvårdsnämnden, Region Västerbotten (Sweden) – €220K – Dec 2020
- Aleris Sjukvård AB (Sweden) – €1.3M – Dec 2020
- Sahlgrenska University Hospital, Board of directors (Sweden) – €308K – Dec 2020
- Styrelsen för Karolinska Universitetssjukhuset (Sweden) – €352K – Dec 2020
- OLVG hospital (Netherlands) – €440K – Nov 2020
- City of Stockholm (Sweden) – €394K – Nov 2020
- Carrefour France (France) – €2.3M – Nov 2020
- Secretaría General para la Innovación y Calidad del Servicio Público de Justicia (Spain) – violation found – Nov 2020
- Indre Østfold kommune (municipality) (Norway) – €17K – Nov 2020
- Vodafone Italy S.p.A (Italy) – €12.3M – Nov 2020
- Urbis sp. z o.o. (Poland) – violation found – Nov 2020
- Vodafone Italia S.p.A. (Italy) – €12.3M – Nov 2020
- Court case 29 OWi 1/20 (Germany) – court ruling – Nov 2020
- Telecoms provider (1&1 Telecom GmbH) (Germany) – €900K – Nov 2020
- Ryanair DAC (Ireland) – complaint upheld – Nov 2020
- Miguel Ibáñez Bezanilla, S.L. (Spain) – €3K – Nov 2020