GDPR Fines & Penalties 2026
Search published European fines, warnings, orders and court decisions with a confirmed EU GDPR legal basis. Cases whose applicable law has not yet been confirmed are excluded.
Selected coverage: Europe. Only published cases are included.
2,174 results · Showing 1,951–1,975
Merlini s.r.l.
DPA case 9401/163/18
School Fitness Holiday & Franchising S.L.
Vodafone España, SAU
Auto Desguaces Iglesias S.L.
ING Bank N.V.
XX and XX
XX
Gambling hall operator
Odin Flissenter AS
Iberdrola Clientes
DPA case DKN.5112.7.2020
DPA case 42/2020
New York College S.A.
DPA case DSB-D205.023
Court case 4354/19.7T8CBR-A.C2
Ligue des droits de l'Homme
DPA case 2020010616
DPA case 2020010425
Court case 1 S 1739/20
DPA case 2020010677
Comunidad de propietarios demelza beach
Aquateknikk AS
Court case VSL Sodba PRp 345/2019
Court case VSL00035084
Frequently Asked Questions About GDPR Enforcement
Q:What types of GDPR enforcement actions exist?
GDPR enforcement actions include monetary fines (the most publicised), formal warnings, reprimands, processing bans, data erasure orders, and compliance orders. DPAs can also impose temporary or permanent limitations on data processing. Fines can reach up to EUR 20 million or 4% of annual worldwide turnover, whichever is higher, under Article 83(5) GDPR.
Q:How are GDPR fines calculated by data protection authorities?
DPAs consider factors listed in Article 83(2) GDPR: nature, gravity, and duration of the infringement; intentional or negligent character; actions taken to mitigate damage; degree of responsibility; previous infringements; degree of cooperation; categories of personal data affected; how the infringement became known; and adherence to approved codes of conduct or certification mechanisms.
Q:Can GDPR fines be appealed?
Yes, GDPR fines can be appealed through national courts. Many high-profile fines have been challenged. The appeals process varies by country. Some fines have been reduced on appeal (e.g., British Airways' fine was reduced from GBP 183 million to GBP 20 million), while others have been upheld or even increased.
Browse case links on this page
GDPR Enforcement Actions (2,174 total)
- Merlini s.r.l. (Italy) – €200K – Jul 2020
- DPA case 9401/163/18 (Finland) – complaint upheld – Jul 2020
- School Fitness Holiday & Franchising S.L. (Spain) – €5K – Jul 2020
- Vodafone España, SAU (Spain) – €12K – Jul 2020
- Auto Desguaces Iglesias S.L. (Spain) – €2K – Jul 2020
- ING Bank N.V. (Netherlands) – court ruling – Jul 2020
- XX and XX (Italy) – €4K – Jul 2020
- XX (Italy) – €1K – Jul 2020
- Gambling hall operator (Germany) – court ruling – Jul 2020
- Odin Flissenter AS (Norway) – order – Jul 2020
- Iberdrola Clientes (Spain) – €24K – Jul 2020
- DPA case DKN.5112.7.2020 (Poland) – violation found – Jun 2020
- DPA case 42/2020 (Belgium) – dismissed – Jun 2020
- New York College S.A. (Greece) – €5K – Jun 2020
- DPA case DSB-D205.023 (Austria) – dismissed – Jun 2020
- Court case 4354/19.7T8CBR-A.C2 (Portugal) – court ruling – Jun 2020
- Ligue des droits de l'Homme (France) – court ruling – Jun 2020
- DPA case 2020010616 (Iceland) – dismissed – Jun 2020
- DPA case 2020010425 (Iceland) – violation found – Jun 2020
- Court case 1 S 1739/20 (Germany) – court ruling – Jun 2020
- DPA case 2020010677 (Iceland) – complaint upheld – Jun 2020
- Comunidad de propietarios demelza beach (Spain) – €2K – Jun 2020
- Aquateknikk AS (Norway) – order – Jun 2020
- Court case VSL Sodba PRp 345/2019 (Slovenia) – court ruling – Jun 2020
- Court case VSL00035084 (Slovenia) – court ruling – Jun 2020