GDPR Fines & Penalties 2026
Search published European fines, warnings, orders and court decisions with a confirmed EU GDPR legal basis. Cases whose applicable law has not yet been confirmed are excluded.
Selected coverage: Europe. Only published cases are included.
2,174 results · Showing 1,451–1,475
Deutsche Wohnen SE
Store owner
Lawyer
Azienda USL di Parma
IMAGINA FRAN SPORT, S.L.
Vienna police officers
Neighborhood community
German Football Association (Deutscher Fußball Bund, DFB)
Court case 4 U 1158/21
DAVISER SERVICIOS, S.L.
DPA case Decision 29-11-2021
DPA case 130/2021
Íslenskrar erfðagreiningar
Restaurant owner
Società H San Raffaele Resnati s.r.l.
Dutch Minister of Finance
The Ministry of Finance
Norwegian State Pension Fund (SPK)
UNIÓN FINANCIERA ASTURIANA S.A. E.F.C.
Statens pensjonskasse (SPK - The Norwegian Public Service Pension Fund)
Vodafone España, S.A.U.
Vodafone España, S.A.U.
Vodafone España, SAU
Chief Epidemiologist of the Office of the Medical Director of Health
Unknown
Frequently Asked Questions About GDPR Enforcement
Q:What types of GDPR enforcement actions exist?
GDPR enforcement actions include monetary fines (the most publicised), formal warnings, reprimands, processing bans, data erasure orders, and compliance orders. DPAs can also impose temporary or permanent limitations on data processing. Fines can reach up to EUR 20 million or 4% of annual worldwide turnover, whichever is higher, under Article 83(5) GDPR.
Q:How are GDPR fines calculated by data protection authorities?
DPAs consider factors listed in Article 83(2) GDPR: nature, gravity, and duration of the infringement; intentional or negligent character; actions taken to mitigate damage; degree of responsibility; previous infringements; degree of cooperation; categories of personal data affected; how the infringement became known; and adherence to approved codes of conduct or certification mechanisms.
Q:Can GDPR fines be appealed?
Yes, GDPR fines can be appealed through national courts. Many high-profile fines have been challenged. The appeals process varies by country. Some fines have been reduced on appeal (e.g., British Airways' fine was reduced from GBP 183 million to GBP 20 million), while others have been upheld or even increased.
Browse case links on this page
GDPR Enforcement Actions (2,174 total)
- Deutsche Wohnen SE (Germany) – court ruling – Dec 2021
- Store owner (Spain) – €1K – Dec 2021
- Lawyer (Hungary) – €843 – Dec 2021
- Azienda USL di Parma (Italy) – €5K – Dec 2021
- IMAGINA FRAN SPORT, S.L. (Spain) – €2K – Dec 2021
- Vienna police officers (Austria) – court ruling – Dec 2021
- Neighborhood community (Spain) – €2K – Nov 2021
- German Football Association (Deutscher Fußball Bund, DFB) (Germany) – court ruling – Nov 2021
- Court case 4 U 1158/21 (Germany) – court ruling – Nov 2021
- DAVISER SERVICIOS, S.L. (Spain) – €20K – Nov 2021
- DPA case Decision 29-11-2021 (Croatia) – dismissed – Nov 2021
- DPA case 130/2021 (Belgium) – complaint upheld – Nov 2021
- Íslenskrar erfðagreiningar (Iceland) – violation found – Nov 2021
- Restaurant owner (Spain) – €1K – Nov 2021
- Società H San Raffaele Resnati s.r.l. (Italy) – €6K – Nov 2021
- Dutch Minister of Finance (Netherlands) – €2.8M – Nov 2021
- The Ministry of Finance (Netherlands) – €2.8M – Nov 2021
- Norwegian State Pension Fund (SPK) (Norway) – €98K – Nov 2021
- UNIÓN FINANCIERA ASTURIANA S.A. E.F.C. (Spain) – €9K – Nov 2021
- Statens pensjonskasse (SPK - The Norwegian Public Service Pension Fund) (Norway) – €87K – Nov 2021
- Vodafone España, S.A.U. (Spain) – €40K – Nov 2021
- Vodafone España, S.A.U. (Spain) – €40K – Nov 2021
- Vodafone España, SAU (Spain) – €40K – Nov 2021
- Chief Epidemiologist of the Office of the Medical Director of Health (Iceland) – violation found – Nov 2021
- Unknown (Spain) – €3K – Nov 2021