GDPR Fines & Penalties 2026
Search published European fines, warnings, orders and court decisions with a confirmed EU GDPR legal basis. Cases whose applicable law has not yet been confirmed are excluded.
Selected coverage: Europe. Only published cases are included.
878 results · Showing 101–125
Casa di Cura Città di Roma
S-Pankki Oyj
S-Bank Plc
Philippe Latombe
BIZUM, S.L.
Bank of Cyprus Public Company Limited
The Lithuanian Border Police
Comune di Venezia
Ospedaliero-Universitaria Careggi
Non-Public Health Care Institution
Legal Entity
Order of Nursing Professions of Viterbo
HEP-Toplinarstvo
Hestia Publishers & Booksellers I. D. Kollaros & Co. S.A.
Bookstore of Hestia
ADMINISTRACIONES BENIPON, S.L.
VALORA PREVENCIÓN, S.L.U.
Data Subject versus Poste Vita S.p.A.
Poste Vita S.p.a.
Croatian Insurance Bureau
User (data subject)
L. Zamenhof University Children's Clinical Hospital in Białystok
Court case 4-25-326
Alliance for the Union of Romanians Party
SC Piramida Trade Invest SRL
Frequently Asked Questions About GDPR Enforcement
Q:What types of GDPR enforcement actions exist?
GDPR enforcement actions include monetary fines (the most publicised), formal warnings, reprimands, processing bans, data erasure orders, and compliance orders. DPAs can also impose temporary or permanent limitations on data processing. Fines can reach up to EUR 20 million or 4% of annual worldwide turnover, whichever is higher, under Article 83(5) GDPR.
Q:How are GDPR fines calculated by data protection authorities?
DPAs consider factors listed in Article 83(2) GDPR: nature, gravity, and duration of the infringement; intentional or negligent character; actions taken to mitigate damage; degree of responsibility; previous infringements; degree of cooperation; categories of personal data affected; how the infringement became known; and adherence to approved codes of conduct or certification mechanisms.
Q:Can GDPR fines be appealed?
Yes, GDPR fines can be appealed through national courts. Many high-profile fines have been challenged. The appeals process varies by country. Some fines have been reduced on appeal (e.g., British Airways' fine was reduced from GBP 183 million to GBP 20 million), while others have been upheld or even increased.
Browse case links on this page
GDPR Enforcement Actions (878 total)
- Casa di Cura Città di Roma (Italy) – €12K – Sept 2025
- S-Pankki Oyj (Finland) – €1.8M – Sept 2025
- S-Bank Plc (Finland) – €1.8M – Sept 2025
- Philippe Latombe (European Union) – cjeu ruling – Sept 2025
- BIZUM, S.L. (Spain) – €80K – Aug 2025
- Bank of Cyprus Public Company Limited (Cyprus) – €25K – Aug 2025
- The Lithuanian Border Police (Lithuania) – complaint upheld – Aug 2025
- Comune di Venezia (Italy) – €10K – Aug 2025
- Ospedaliero-Universitaria Careggi (Italy) – €80K – Aug 2025
- Non-Public Health Care Institution (Poland) – €8K – Aug 2025
- Legal Entity (Slovenia) – €5K – Jul 2025
- Order of Nursing Professions of Viterbo (Italy) – €10K – Jul 2025
- HEP-Toplinarstvo (Croatia) – €320K – Jul 2025
- Hestia Publishers & Booksellers I. D. Kollaros & Co. S.A. (Greece) – €9K – Jul 2025
- Bookstore of Hestia (Greece) – €9K – Jul 2025
- ADMINISTRACIONES BENIPON, S.L. (Spain) – €1K – Jul 2025
- VALORA PREVENCIÓN, S.L.U. (Spain) – €32K – Jul 2025
- Data Subject versus Poste Vita S.p.A. (Italy) – €80K – Jul 2025
- Poste Vita S.p.a. (Italy) – €80K – Jul 2025
- Croatian Insurance Bureau (Croatia) – €101K – Jul 2025
- User (data subject) (Germany) – court ruling – Jul 2025
- L. Zamenhof University Children's Clinical Hospital in Białystok (Poland) – €16K – Jun 2025
- Court case 4-25-326 (Estonia) – court ruling – Jun 2025
- Alliance for the Union of Romanians Party (Romania) – €25K – Jun 2025
- SC Piramida Trade Invest SRL (Romania) – €3K – Jun 2025