GDPR Fines & Penalties 2026
Search published European fines, warnings, orders and court decisions with a confirmed EU GDPR legal basis. Cases whose applicable law has not yet been confirmed are excluded.
Selected coverage: Europe. Only published cases are included.
2,174 results · Showing 901–925
Compania Națională Poșta Română S.A.
Private individual
ESTUDIO INMOBILIARIO SAN ISIDRO, S.L.U.
Homeowners' association
FUNDACIÓ PRIVADA UNIVERSITARIA EADA
DPA case 11.17.001.010.199
Legal Person
BANQUETES SANTA ANA, S.L.
DPA case NAIH/4410-1/2023
DPA case 49/2023
ASSOCIACIO DE CAÇADORS D'ALZIRA
INFINITY ECOM S.L.
Store owner
Private individual
Università degli studi di Cassino e del Lazio Meridionale
Ufficio Scolastico Regionale per la Puglia, Ufficio VI - Ambito Territoriale di Lecce
DPA case 22/03622
Website operator
Court case 8 U 94/22
Private individual
Court case 33 O 5976/22
Getaround Norway AS (formerly Nabobil.no AS)
DIGI SPAIN TELECOM, S.L.
Telefónica Móviles España, S.A.U.
Election Commitee of the Workers Council of SuperVista AG
Frequently Asked Questions About GDPR Enforcement
Q:What types of GDPR enforcement actions exist?
GDPR enforcement actions include monetary fines (the most publicised), formal warnings, reprimands, processing bans, data erasure orders, and compliance orders. DPAs can also impose temporary or permanent limitations on data processing. Fines can reach up to EUR 20 million or 4% of annual worldwide turnover, whichever is higher, under Article 83(5) GDPR.
Q:How are GDPR fines calculated by data protection authorities?
DPAs consider factors listed in Article 83(2) GDPR: nature, gravity, and duration of the infringement; intentional or negligent character; actions taken to mitigate damage; degree of responsibility; previous infringements; degree of cooperation; categories of personal data affected; how the infringement became known; and adherence to approved codes of conduct or certification mechanisms.
Q:Can GDPR fines be appealed?
Yes, GDPR fines can be appealed through national courts. Many high-profile fines have been challenged. The appeals process varies by country. Some fines have been reduced on appeal (e.g., British Airways' fine was reduced from GBP 183 million to GBP 20 million), while others have been upheld or even increased.
Browse case links on this page
GDPR Enforcement Actions (2,174 total)
- Compania Națională Poșta Română S.A. (Romania) – €5K – May 2023
- Private individual (Spain) – €180 – May 2023
- ESTUDIO INMOBILIARIO SAN ISIDRO, S.L.U. (Spain) – €5K – May 2023
- Homeowners' association (Spain) – €2K – May 2023
- FUNDACIÓ PRIVADA UNIVERSITARIA EADA (Spain) – €1K – May 2023
- DPA case 11.17.001.010.199 (Cyprus) – complaint upheld – May 2023
- Legal Person (Czech Republic) – €4K – May 2023
- BANQUETES SANTA ANA, S.L. (Spain) – €5K – May 2023
- DPA case NAIH/4410-1/2023 (Hungary) – €125 – Apr 2023
- DPA case 49/2023 (Belgium) – complaint upheld – Apr 2023
- ASSOCIACIO DE CAÇADORS D'ALZIRA (Spain) – €2K – Apr 2023
- INFINITY ECOM S.L. (Spain) – €5K – Apr 2023
- Store owner (Italy) – €2K – Apr 2023
- Private individual (Italy) – €400 – Apr 2023
- Università degli studi di Cassino e del Lazio Meridionale (Italy) – €4K – Apr 2023
- Ufficio Scolastico Regionale per la Puglia, Ufficio VI - Ambito Territoriale di Lecce (Italy) – €15K – Apr 2023
- DPA case 22/03622 (Norway) – violation found – Apr 2023
- Website operator (Spain) – €1K – Apr 2023
- Court case 8 U 94/22 (Germany) – court ruling – Apr 2023
- Private individual (Spain) – €300 – Apr 2023
- Court case 33 O 5976/22 (Germany) – court ruling – Apr 2023
- Getaround Norway AS (formerly Nabobil.no AS) (Norway) – dismissed – Apr 2023
- DIGI SPAIN TELECOM, S.L. (Spain) – €70K – Apr 2023
- Telefónica Móviles España, S.A.U. (Spain) – €70K – Apr 2023
- Election Commitee of the Workers Council of SuperVista AG (Germany) – court ruling – Apr 2023