GDPR Fines and Penalties: Latest Enforcement Tracker (2026)

GDPR Article 83 sets two penalty tiers: up to EUR 10 million or 2% of global annual turnover for organizational violations, and up to EUR 20 million or 4% for breaches of core processing principles, data subject rights, or transfer requirements, whichever is higher.

The GDPR gives European data protection authorities the power to impose substantial administrative fines on organizations that violate its provisions. DLA Piper's January 2026 survey put the fines issued from May 25, 2018 to January 10, 2026 at about EUR 7.1 billion, and the CMS Enforcement Tracker lists 3,366 fines totaling about EUR 7.58 billion as of October 2026.

This guide explains the penalty structure in detail, covers the EDPB methodology for calculating fines, analyzes the landmark Deutsche Wohnen ruling on corporate liability, lists the largest fines and their current status, and covers consequences beyond fines including civil compensation claims under Article 82. For an overview of the regulation itself, see our guide to What Is GDPR.

This article is for informational purposes only and does not constitute legal advice. Consult a qualified data protection attorney or privacy professional for guidance specific to your situation.

Quick Answer: What Are the GDPR Penalties?

GDPR penalties fall into two tiers under Article 83.

For the more serious violations (breaches of core processing principles, data subject rights, consent rules, and international transfer requirements), the maximum is EUR 20 million or 4% of the organization's total worldwide annual turnover, whichever is higher.

For organizational and procedural violations (failing to maintain records, not appointing a DPO when required, inadequate breach notification), the maximum is EUR 10 million or 2% of global annual turnover, whichever is higher.

For large multinationals, the percentage cap vastly exceeds the fixed euro amount. A company with EUR 30 billion in annual revenue faces a potential ceiling of EUR 1.2 billion at the 4% tier.

Beyond fines, authorities can ban processing, order data erasure, impose compliance remediation orders, and suspend international data transfers. Individuals can also claim compensation directly from controllers and processors for material and non-material damage under Article 82.

The Two-Tier Fine Structure Under Article 83

Article 83 of the GDPR establishes the two-tier maximum fine framework. The applicable tier depends entirely on which provision was violated.

Lower Tier: Up to EUR 10 Million or 2% of Global Turnover

The lower tier applies to violations of the controller and processor obligations set out in Articles 8, 11, 25 through 39, 42, and 43. These are primarily organizational and procedural requirements:

• Failing to maintain records of processing activities (Article 30)
• Not conducting a required Data Protection Impact Assessment (Article 35)
• Failing to appoint a DPO when one is required (Article 37)
• Deficient breach notification procedures (Article 33)
• Failures by certification bodies and monitoring bodies

These violations are serious, but they are treated as less severe than breaches of the fundamental principles governing how personal data may be used.

Upper Tier: Up to EUR 20 Million or 4% of Global Turnover

The upper tier applies to violations of the provisions that sit at the heart of the GDPR's data protection framework:

• The basic principles for processing and conditions for lawful processing (Articles 5, 6, 7, 9)
• Data subject rights: access, rectification, erasure, restriction, portability, and objection (Articles 12 through 22)
• International data transfer rules (Articles 44 through 49)
• National law provisions adopted under Chapter IX
• Non-compliance with a binding order from a supervisory authority

The fine is always whichever amount is higher within the relevant tier. For a company with EUR 10 billion in global annual revenue, 4% yields a EUR 400 million ceiling, twenty times the EUR 20 million fixed maximum.

The Fault Requirement: The Deutsche Wohnen Ruling

A significant question in early GDPR enforcement was whether fines could be imposed on companies under a strict liability standard, or only where the infringement was intentional or negligent.

The CJEU resolved this in its December 5, 2023 judgment in Case C-807/21 (Deutsche Wohnen). The case arose from a EUR 14.5 million fine imposed by the Berlin data protection authority on a real estate company for retaining tenant data after it was no longer needed.

The CJEU made three important rulings.

First, a fault requirement applies: GDPR administrative fines may only be imposed where the infringement was committed intentionally or negligently. Strict liability is incompatible with Article 83. This brought an end to the argument that companies could be fined for violations they had no reasonable means to identify or prevent.

Second, no identified natural person is needed: Authorities do not need to attribute the infringement to a specific identified individual within the organization before imposing a fine on the legal entity. A company can be fined directly based on the conduct of its organs, employees, or agents, without a separate finding against a named person.

Third, companies are fined as undertakings: For calculating fine ceilings, a controller is treated as an "undertaking" in the competition-law sense. This means the ceiling is calculated against the entire economic unit's worldwide turnover: not just the subsidiary or entity that was the direct controller. Parent-company revenues are included where the parent forms part of the same economic unit. The Court restated this as a formal ruling in ILVA (C-383/23, 13 February 2025): "undertaking" in Article 83(4) to (6) has its Articles 101 and 102 TFEU meaning, so the maximum fine is set on the undertaking's total worldwide annual turnover, and the same concept is used to judge whether a fine is effective, proportionate and dissuasive.

The ruling matters in practice because it shapes both how authorities approach fine investigations and how companies can defend against them. Demonstrating that a violation was non-negligent (through documented reasonable compliance efforts) is now a viable defense.

How GDPR Fines Are Calculated: EDPB Guidelines 04/2022

The EDPB Guidelines 04/2022 on the calculation of administrative fines establish a five-step methodology that supervisory authorities across all EU member states follow. The guidelines were finalized in June 2023 following public consultation.

The methodology is not an automated formula. Fines remain a matter of supervisory discretion within the steps, but the framework creates consistency across jurisdictions.

Step 1: Identify Processing Operations and Applicable Provisions

The authority identifies which processing operations are at issue and which GDPR provisions were infringed. Where multiple infringements arise from the same set of processing operations, Article 83(3) applies: where a controller or processor, intentionally or negligently, infringes several provisions through the same or linked processing operations, the total amount of the administrative fine may not exceed the amount specified for the gravest infringement. This prevents the artificial multiplication of penalties for what is functionally one course of conduct.

Step 2: Determine the Starting Amount

The starting amount reflects three variables.

Nature of the infringement: Which tier of Article 83 applies? Is the violated provision central to data subjects' fundamental rights, or is it an organizational procedure?

Gravity: How severe is the infringement in concrete terms: the number of data subjects affected, the sensitivity of the data involved (special category data such as health or biometric data is treated more seriously), the financial or other harm suffered, and the geographic scope.

Duration: How long did the infringement continue? A violation discovered and remediated within days is treated differently from one that persisted for years.

The starting amount is also calibrated against the turnover of the undertaking. A fine that would be dissuasive for an SME would be negligible for a multinational, so the absolute figure scales with organizational size.

Step 3: Evaluate Aggravating and Mitigating Circumstances

Article 83(2) lists specific factors that authorities must weigh. These push the calculated amount up or down:

Cooperation is one of the most practically significant factors. Organizations that engage transparently, implement remediation quickly, and respond fully to information requests consistently receive lower fines than those that delay or obstruct.

Step 4: Apply the Legal Maximum

The calculated amount is checked against the applicable ceiling for the relevant tier. The fine cannot exceed the maximum regardless of how severe the circumstances are.

Step 5: Assess Effectiveness, Proportionality, and Dissuasiveness

The final figure must satisfy three requirements under Article 83(1): effective (capable of ensuring compliance), proportionate (not excessive relative to the violation and the organization's circumstances), and dissuasive (capable of deterring future violations). The authority may adjust the amount if it does not meet all three requirements.

The Amazon annulment in March 2026 illustrates this step's importance, though it was the second of two grounds. Luxembourg's Cour administrative (Administrative Court of Appeal), in arrêt no. 52757C of March 12, 2026, found that the CNPD had moved quasi automatically from finding violations to imposing a fine, without analysing which of the measures available to it was the most appropriate. The lead ground was separate: the CNPD had never analysed fault, meaning whether the infringement was intentional or negligent.

September 2026: New EDPB Guidelines on Whether to Fine at All

Guidelines 04/2022 answer how large a fine should be. At its September 2026 plenary the EDPB adopted a separate set of guidelines on the application of the power to impose administrative fines in relation to other corrective powers, announced on September 21, 2026, which answer the prior question of whether a fine should be imposed at all, on its own or alongside another corrective measure.

They set out their own five-step methodology for that decision. The authority first checks whether the infringement can attract a fine, finding support either directly in the GDPR or in national law. It then determines whether the party under investigation may be fined for that infringement, which turns on whether the controller or the processor is bound by the provision breached. Third, it assesses whether the infringement was committed intentionally or negligently, since a culpable infringement is a condition for imposing a fine. Fourth, it weighs possible aggravating and mitigating factors: a minor infringement will generally draw a reprimand rather than a fine, while an infringement that is not minor carries a strong presumption that a fine should be imposed. Fifth, it assesses whether a fine would be effective, proportionate and dissuasive, and may consider whether the particular case gives a reason to depart from the standard approach.

The guidelines also survey the corrective powers national authorities hold and how those powers relate to one another, covering warnings, reprimands, orders, limitations including bans, and the withdrawal of certification, and they include 14 practical examples of choosing between measures. They replace the WP29 guidelines on the application and setting of administrative fines and complement Guidelines 04/2022 rather than replacing it.

These guidelines were adopted subject to a public consultation that runs until November 13, 2026, so the text can still change before a final version is issued. Guidelines 04/2022 remains the operative methodology for calculating the amount of a fine.

Article 83(2): The Full List of Factors

Article 83(2) specifies eleven factors that supervisory authorities must take into account. These map directly to what organizations can document:

1. Nature, gravity, and duration of the infringement
2. Whether the infringement was intentional or negligent
3. Actions taken to mitigate damage
4. Degree of responsibility, given the technical and organizational measures under Articles 25 and 32
5. Relevant prior infringements by the controller or processor
6. Degree of cooperation with the supervisory authority
7. Categories of personal data affected
8. How the authority became aware of the infringement (self-reported vs. discovered via complaint)
9. Compliance with any measures under Article 58(2) previously ordered against the controller or processor on the same subject-matter
10. Adherence to approved codes of conduct (Article 40) or certification mechanisms (Article 42)
11. Any other applicable aggravating or mitigating factor

The Largest GDPR Fines and Their Current Status

The following table covers the ten largest GDPR fines issued to date. We rechecked the court status of the older rows on October 26, 2026 against the EUR-Lex case register and the Irish DPC's index of court judgments, and where the court record itself was not confirmed the Status column says so. The 2026 Uber row was verified against the Dutch supervisory authority's own decision page on September 3, 2026. The 2026 Google row was verified against the Irish Data Protection Commission's own announcement and the EDPB's record of the national case on October 8, 2026. The Amazon row was verified against the Luxembourg judiciary's own summary of arrêt no. 52757C and the CNPD's press releases on September 24, 2026.

Key Case Notes

Meta EUR 1.2 billion (May 2023). The Irish DPC imposed this record fine on May 22, 2023, following an EDPB binding decision. Meta transferred EU Facebook user data to the US under Standard Contractual Clauses, but the EDPB found that SCCs could not adequately protect EU data given US surveillance laws. Meta brought an action at the EU General Court to annul the EDPB binding decision (Case T-325/23, lodged June 13, 2023). In February 2026 the Court of Justice held in WhatsApp v EDPB (C-97/23 P) that a comparable action against an EDPB binding decision was admissible and sent that case back to the General Court. We have not verified the current status of Meta's case. Meta adopted the EU-US Data Privacy Framework as a transfer mechanism going forward, but this does not retroactively cure the historical violation.

Uber EUR 824,990,000 (August 2026). The Dutch AP imposed the second-largest GDPR fine on record on Uber for automated driver blocking. Between 2018 and 2022, Uber software temporarily deactivated driver accounts on a suspicion of fraud, and permanently deactivated them for persistently low customer ratings, with no human assessment before the decision took effect. The AP found this breached the GDPR's prohibition on fully automated decision-making and that Uber had not adequately informed drivers about it. The EDPB's record of the national case lists Article 22, on automated individual decision-making, and Article 13, on the information a controller must give the data subject, as the provisions infringed. The case reached the Dutch regulator through the one-stop-shop mechanism: 171 French drivers complained to the Ligue des droits de l'Homme, which lodged a complaint with the CNIL, and the AP took the investigation because Uber's European headquarters are in the Netherlands. The AP noted Uber's 2025 global turnover of roughly EUR 44.5 billion against the GDPR's 4% ceiling. Uber is contesting the fine, so it is not final. The AP's English announcement says Uber has filed an appeal, while its Dutch text says Uber announced an administrative objection (bezwaar), and the EDPB's record of the case states that there is no final judicial decision yet. The AP's announcement is dated August 21, 2026 and gives no date for the underlying decision, so this page states none. The AP records this as the fourth fine it has issued against the company.

Amazon EUR 746 million (2021, annulled March 2026). Luxembourg's CNPD imposed this fine for Amazon's use of "legitimate interests" as the legal basis for behavioral advertising. On March 12, 2026, Luxembourg's Cour administrative (Administrative Court of Appeal), the final instance, annulled the CNPD's decision of July 15, 2021 in all its parts by arrêt no. 52757C and referred the case back to the regulator, while confirming most of the GDPR violations the CNPD had found. This is a different court from the tribunal administratif, the first-instance Administrative Court, which had dismissed Amazon's challenge on March 18, 2025 (no. 46578).

The Cour administrative gave two grounds, each an analysis the CNPD had not performed. The lead ground was fault: an administrative fine may only be imposed where the infringement was committed intentionally or negligently, as the CJEU held in Deutsche Wohnen (C-807/21) and Nacionalinis (C-683/21), both decided December 5, 2023, and the CNPD never conducted that analysis. The second ground was the choice of measure: the CNPD moved quasi automatically from finding violations to imposing a fine, without properly analysing which of the corrective measures available to it was the most appropriate.

The court did not vindicate Amazon on the merits. It confirmed the substance of the violations, including that Amazon could not rely on legitimate interest as the legal basis for interest-based advertising and that its transparency arrangements were not compliant at the time of the decision. The compliance order and the EUR 746,000 per day penalty payment attached to it were declared moot, because by the January 8, 2026 hearing Amazon had brought the processing into compliance, which the CNPD's own counsel confirmed. No fine is currently payable. The matter is back before the CNPD, which may impose a new penalty after performing both analyses.

TikTok EUR 530 million (May 2, 2025). The Irish DPC fined TikTok EUR 45 million for failing to inform EEA users about possible access to their data from China (Article 13 violation) and EUR 485 million for transferring EEA user data to China without effective safeguards under Article 46. The DPC also ordered TikTok to bring its processing into compliance within six months, and to suspend its transfers to China if it did not do so within that time. TikTok challenged the decision in the Irish courts. The DPC's index of court judgments lists a High Court judgment of November 13, 2025 in TikTok Technology Limited and Anor v DPC and, in TikTok Technology Limited v DPC, a Supreme Court judgment of May 5, 2026 and High Court judgments of June 3 and June 30, 2026. This page does not yet state what those judgments decided.

Google EUR 403 million (September 21, 2026). The Irish DPC announced administrative fines totalling EUR 403 million against Google Ireland Limited on September 21, 2026, closing an own-volition inquiry it had opened in February 2020 as Google's lead supervisory authority, following complaints from several European consumer rights organisations including BEUC. The inquiry covered Google's processing of location data in three features, Web & App Activity, Location History and Location Accuracy, between May 25, 2018, the date the GDPR became applicable, and February 4, 2020. The Commissioners for Data Protection, Dr Des Hogan, Mr Dale Sunderland and Ms Niamh Sweeney, found infringements on four points: the lawfulness and fairness of the location-data processing in Web & App Activity and Location History; the accountability obligations, in that Google could not demonstrate compliance with the lawfulness, fairness and transparency principle for Location Accuracy; the transparency obligations across all three features; and the retention of location data in Web & App Activity and Location History. The DPC also ordered Google to bring its processing into compliance within 6 months. The EDPB records the decision as a national case, not an Article 65 binding decision, and gives the legal references as Articles 5, 6, 12 and 13.

The DPC has said it will issue the full decision in due course, so the split of the EUR 403 million across the individual infringements is not yet public. The DPC's own announcement cites no article numbers, and until the decision text is published the reasoning behind each finding cannot be read directly.

LinkedIn EUR 310 million (October 2024). The Irish DPC found that LinkedIn relied on invalid consent, illegitimate interests, and illegitimate contractual necessity as legal bases for behavioral analysis and advertising. LinkedIn challenged the decision in the Irish High Court. The DPC's index of court judgments lists a High Court judgment in LinkedIn Ireland Unlimited Company v DPC of April 20, 2026. This page does not yet state what it decided.

Uber EUR 290 million (August 2024). The Dutch AP fined Uber for transferring EU driver data (including criminal history, medical data, and location information) to Uber's US headquarters without any transfer mechanism for over two years. Uber is contesting the fine, and the AP reported in August 2026 that the proceedings are still ongoing.

Why Ireland Dominates the Largest Fines

Seven of the top ten fines were issued by Ireland's Data Protection Commission. Our guide covers how an individual files a complaint with Ireland's Data Protection Commission. The GDPR's one-stop-shop mechanism assigns primary supervisory authority to the DPA in the member state where a company has its main EU establishment. Meta, Google, Apple, TikTok, LinkedIn, and Microsoft all chose Dublin, making the Irish DPC their lead authority. The DPC's enforcement pace accelerated after 2022, following sustained pressure from the EDPB and other EU authorities who objected to what they regarded as under-enforcement of major technology platforms.

Consequences Beyond Fines

Administrative fines are the most visible GDPR enforcement tool, but supervisory authorities have a broad corrective powers toolkit under Article 58(2), and individuals have independent civil compensation rights under Article 82.

Corrective Powers Under Article 58(2)

Supervisory authorities can issue any of the following, separately from or in addition to a fine:

• Warnings and reprimands: Used for less serious violations or first-time offenders
• Orders to comply: Requiring the controller or processor to bring processing into conformity within a specified period
• Temporary or permanent processing bans: Prohibiting specific processing activities
• Orders to erase data: Requiring deletion of personal data collected in violation of the GDPR
• Suspension of data transfers: Prohibiting transfers of personal data to a third country
• Orders to notify data subjects: Requiring notification of individuals where the controller has failed to do so

Processing bans and transfer suspensions can be existential for companies whose business depends on the affected activities. The Irish DPC's TikTok decision illustrates the point: alongside the EUR 530 million fine, it ordered TikTok to suspend its transfers to China if the processing was not brought into compliance within six months, an order that carries no money but could halt a core data flow.

Civil Compensation Under Article 82

Article 82 gives any person who has suffered material or non-material damage as a result of a GDPR infringement the right to seek compensation from the controller or processor responsible. Any controller involved in the processing is liable for the damage; a processor is liable only where it has not complied with obligations directed specifically to processors or has acted outside or contrary to the controller's lawful instructions. Either is exempt if it proves it is not in any way responsible for the event giving rise to the damage (Article 82(2) and (3)).

The CJEU clarified the scope of Article 82 in its May 2023 judgment in Case C-300/21 (Österreichische Post). Three principles emerged.

Three conditions must all be met: an infringement of the GDPR, actual damage suffered, and a causal link between the infringement and the damage. An infringement without proven damage does not entitle the claimant to compensation.

No minimum seriousness threshold for non-material damage: Article 82 does not require that emotional distress or anxiety reach a particular severity before qualifying for compensation. Member states may not impose their own seriousness threshold.

Compensation amounts are determined by national law, subject to EU principles of equivalence and effectiveness. Awards vary significantly across member states.

In practice, Article 82 claims are brought alongside regulatory enforcement, through representative proceedings, or in standalone civil litigation. Regulatory fines and civil compensation claims can proceed simultaneously, creating dual-track liability for the same GDPR violation.

Enforcement Trends: 2024 to 2026

Tracker status (verified October 8, 2026): the largest fine issued so far in 2026 is the Dutch AP's EUR 824,990,000 penalty against Uber, announced on August 21, 2026 over fully automated driver deactivations. It is also the second-largest GDPR fine on record, behind only Meta's EUR 1.2 billion transfer fine, and it is not final because Uber is contesting it. The next largest fine of 2026 is the Irish DPC's EUR 403 million against Google Ireland Limited, announced September 21, 2026 over its processing of location data, which enters the all-time table at sixth. Before those, 2026's largest was the CNIL's EUR 27 million penalty against Free Mobile (announced January 13, 2026, over a 2024 breach affecting roughly 24 million subscriber accounts, alongside a companion EUR 15 million fine against Free in the same action). The TikTok litigation over the EUR 530 million fine also produced High Court and Supreme Court judgments in 2026, covered above; this page does not yet state their outcome. Note the shift in subject matter: the Uber decision turns on automated decision-making rather than international transfers, the theory that produced most of the earlier record fines.

2025 Statistics and EDPB Annual Report

The EDPB published its 2025 Annual Report on April 9, 2026. It reports that national data protection authorities issued a total of about EUR 1.15 billion (EUR 1,145,760,374) in fines during 2025, a year led by the Irish DPC's EUR 530 million TikTok decision. DLA Piper's January 2026 survey put cumulative fines from May 25, 2018 to January 10, 2026 at about EUR 7.1 billion.

The EDPB's 2025 Coordinated Enforcement Framework (CEF) action focused on the right to erasure under Article 17. Thirty-two supervisory authorities took part, and 764 controllers responded to the questionnaire, according to the EDPB's February 2026 report on the action.

The CEF 2026 action targets transparency and information obligations under Articles 13 and 14, examining whether organizations provide data subjects with clear, complete, and accessible privacy notices. Organizations with generic or incomplete privacy policies face elevated scrutiny in 2026.

Where Enforcement Is Focused

Several patterns characterize enforcement from 2024 through 2026.

International data transfers remain a leading source of the largest fines. The single biggest GDPR penalty, Meta's EUR 1.2 billion, involves transfers of EU personal data to a country without an adequacy decision, as do TikTok's EUR 530 million fine and the Dutch AP's EUR 290 million fine against Uber from 2024. The next two largest by value rest on different theories, so transfers are a dominant strand rather than the whole of the top of the table: the Dutch AP's EUR 824,990,000 fine against Uber in 2026 turns on fully automated decision-making, and Amazon's annulled EUR 746 million fine turned on an invalid legal basis for behavioral advertising. The EU-US Data Privacy Framework, adopted in July 2023, provides a legal mechanism for certified companies, but its validity remains contested in EU courts. For transfers to China and other countries, no adequacy decision exists and the scrutiny is intense.

Behavioral advertising and invalid legal bases. The finding that "legitimate interests" and "contractual necessity" cannot support behavioral profiling and targeted advertising has now generated significant fines against Meta, Amazon, LinkedIn, and others. Companies whose revenue model depends on behavioral advertising face ongoing exposure unless they obtain specific, valid consent.

AI and data processing. The EDPB's April 2025 opinion clarified that large language models rarely achieve GDPR-compliant anonymization. Controllers deploying third-party AI tools that process personal data must assess their legal basis and document a legitimate interests assessment where applicable.

Governance failures, not just incident outcomes. Enforcement has shifted toward penalizing structural deficiencies (absent encryption, weak vendor management, inadequate access controls) regardless of whether a breach has actually occurred.

GDPR Omnibus IV: Proposed Reforms

In May 2025 the European Commission proposed the Omnibus IV package (COM(2025) 501), which would have raised the Article 30(5) record-keeping derogation from organizations with fewer than 250 employees to those with fewer than 750, and extended SME-specific provisions to "small mid-cap enterprises." The provisional agreement text resulting from the interinstitutional negotiations, dated June 26, 2026 (PE790.249), sets the figure at fewer than 1,000 persons, except where a specific processing activity is likely to result in a high risk under Article 35, and in any event where it is a core activity requiring a data protection officer under Article 37(1)(b) or (c). Parliament's committee approved that text on July 2, 2026, and the indicative plenary date is November 23, 2026.

The EDPB and EDPS welcomed some aspects while requesting clarifications. Until the amending regulation enters into force, on the twentieth day after its publication in the Official Journal, the 250-employee threshold applies. The agreed text does not amend Article 83, so the fine structure is unaffected.

How to Reduce Your Risk of GDPR Fines

Supervisory authorities weigh compliance posture, cooperation, and remediation when calculating fines. The following steps both prevent violations and reduce penalties if a violation occurs.

Document Everything

The GDPR's accountability principle (Article 5(2)) requires organizations to demonstrate compliance, not merely to comply. Maintain records of processing activities, completed DPIAs, legal basis assessments, staff training logs, vendor contracts with Article 28 terms, and updated privacy policies. Documentation is evidence of good faith and serves directly as a mitigating factor.

Respond to Incidents Immediately

When a breach or compliance failure occurs, speed matters. The 72-hour breach notification window is a legal obligation, but rapid response is also mitigating. Immediate remediation, prompt notification to the supervisory authority, and transparent communication all weigh in the organization's favor. See our guide on the GDPR 72-hour breach notification rule for the full reporting process.

Cooperate With Supervisory Authority Investigations

Organizations that respond promptly to information requests, grant access for inspections, and implement recommended changes consistently receive lower fines than those that delay or litigate at every step. Full cooperation is explicitly listed as a mitigating factor under Article 83(2)(f).

Audit International Data Transfers

Cross-border transfers still account for the single largest GDPR fine and several others in the top ten, so mapping every outbound data flow and verifying valid transfer mechanisms is a high-priority compliance task. Standard Contractual Clauses must be accompanied by a Transfer Impact Assessment for transfers to countries without an adequacy decision.

Validate Legal Bases for Advertising and Analytics

The wave of fines against Meta, Amazon, LinkedIn, and others for invalid legal bases in behavioral advertising demonstrates that legitimate interests is not a safe harbor for profiling and targeted advertising. Organizations relying on this basis for analytics or advertising should have their assessments reviewed by counsel experienced in GDPR enforcement.

Invest in Staff Training and Privacy by Design

Many violations stem from employee errors or products built without data-minimization principles. Regular, documented training and privacy-by-design review of new products and features reduce both the likelihood of violations and the negligence finding that would aggravate a fine under Deutsche Wohnen.

Use the GDPR Compliance Checklist

Our GDPR compliance checklist covers all key obligations in a structured format. Organizations with documented compliance programs are better positioned to demonstrate the accountability that supervisory authorities require.

More GDPR Guides

• What Is GDPR for a comprehensive overview of the regulation and its scope
• GDPR Compliance Checklist for a step-by-step compliance guide for organizations
• GDPR Data Subject Rights for all eight individual rights and how to respond to them
• GDPR Consent Requirements for what constitutes valid consent under Article 7
• GDPR Breach Notification 72-Hour Rule for breach reporting obligations and timelines
• GDPR for Small Businesses for SME-specific compliance guidance
• EU Data Privacy Laws for the complete EU data protection framework overview

Frequently Asked Questions

What is the maximum GDPR fine?

The maximum GDPR fine is EUR 20 million or 4% of the organization's total worldwide annual turnover from the preceding financial year, whichever is higher. This upper-tier penalty applies to violations of core processing principles, data subject rights, consent rules, and international transfer requirements under Article 83(5). For lower-tier violations such as record-keeping and DPO appointment failures, the maximum is EUR 10 million or 2% of global turnover.

What is the largest GDPR fine ever issued?

The largest confirmed GDPR fine is EUR 1.2 billion, imposed on Meta Platforms Ireland Limited by Ireland's Data Protection Commission in May 2023 for transferring EU Facebook user data to the United States without adequate safeguards. The fine resulted from an EDPB binding decision. Meta has asked the EU General Court to annul the EDPB binding decision behind the fine (Case T-325/23). The second-largest fine on record is the Dutch AP's EUR 824,990,000 penalty against Uber, announced on August 21, 2026 for fully automated driver deactivations; it is not final because Uber is contesting it. Amazon's EUR 746 million fine, which previously held second place, was annulled by Luxembourg's Cour administrative in March 2026 and sent back to the regulator for reassessment.

Can a company be fined under GDPR without any intent to break the rules?

No. The CJEU confirmed in its December 2023 Deutsche Wohnen judgment (Case C-807/21) that GDPR fines require the infringement to have been committed intentionally or negligently. Strict liability is incompatible with Article 83. However, negligence is a low bar: failing to take reasonable compliance steps will generally satisfy it. An organization that makes a genuine, documented effort to comply but still makes a mistake has a viable argument for a reduced fine.

How are GDPR fines calculated?

Supervisory authorities follow the EDPB Guidelines 04/2022, which establish a five-step process: identify the infringements and evaluate Article 83(3) on multiple violations; determine a starting amount based on nature, gravity, and duration and the organization's turnover; evaluate aggravating and mitigating factors including intent, cooperation, prior violations, data categories, and remediation steps; apply the legal maximum for the relevant tier; and assess whether the final amount is effective, proportionate, and dissuasive.

Can GDPR fines apply to companies outside the EU?

Yes. The GDPR applies to any organization worldwide that processes personal data of people in the EU, and fines apply equally to non-EU companies. TikTok (China-owned, EUR 530 million via Irish DPC), Amazon (US-based, EUR 746 million via Luxembourg CNPD, now annulled on appeal), and Uber (US-based, EUR 290 million in 2024 and EUR 824,990,000 in 2026, both via the Dutch AP) have all received major fines despite being headquartered outside the EU.

What happened to Amazon's EUR 746 million GDPR fine?

Amazon's EUR 746 million fine, imposed by Luxembourg's CNPD in 2021 for using an invalid legal basis for behavioral advertising, was annulled on March 12, 2026 by Luxembourg's Cour administrative, the Administrative Court of Appeal and final instance, in arrêt no. 52757C. The lead ground was that the CNPD had never analysed fault, meaning whether the infringement was intentional or negligent, which the CJEU requires under Deutsche Wohnen (C-807/21) and Nacionalinis (C-683/21). A second ground was that the CNPD had not properly analysed which of the measures available to it was the most appropriate. The court did not clear Amazon on the merits: it confirmed the substance of the violations, including that legitimate interest could not support interest-based advertising. No fine is currently payable, and the matter is back before the CNPD, which may impose a new penalty once it performs both analyses.

Can individuals sue for GDPR violations?

Yes. Article 82 gives individuals the right to seek compensation from controllers or processors for material and non-material damage caused by a GDPR infringement. The CJEU confirmed in the Österreichische Post case (C-300/21, May 2023) that there is no minimum seriousness threshold: any proven distress can qualify for compensation. However, claimants must prove an actual infringement, actual damage, and a causal link. Regulatory enforcement and civil claims can proceed simultaneously.

Which EU country issues the most GDPR fines?

Spain's Agencia Española de Protección de Datos (AEPD) issues the highest volume of individual fines: the CMS Enforcement Tracker lists 1,114 Spanish cases as of October 2026, mostly smaller penalties. Ireland's Data Protection Commission leads in total fine value, at about EUR 4.04 billion in aggregate by January 2026 according to DLA Piper's survey, because major technology companies including Meta, TikTok, LinkedIn, Google, and Apple have their European headquarters in Dublin, making the Irish DPC their lead supervisory authority under the one-stop-shop mechanism.

What are the most common GDPR violations that lead to fines?

The most common violations generating fines are: processing data without a valid legal basis under Article 6; inadequate technical security measures leading to data breaches; unlawful international data transfers without adequate safeguards; failure to respond to data subject rights requests within statutory timeframes; and insufficient transparency in privacy notices. The largest fines have concentrated on international transfers and invalid legal bases for behavioral advertising, and since August 2026 the second-largest fine on record rests on a further theory, the prohibition on fully automated decision-making.