Top GDPR Fines in 2025-2026: Lessons for Your Business

GDPR enforcement has matured since the regulation took effect in 2018. Fines of hundreds of millions of euros, and one of over a billion, have been imposed, and the lessons from major cases give a clear picture of what regulators prioritise and penalise.

This article examines the patterns behind GDPR's largest enforcement actions and what they mean for your organization's compliance strategy.

Major GDPR fines at a glance

The table below lists selected major fines, each checked against the authority's own announcement. Many large fines are appealed, and a fine under appeal is not final.

What changed in 2026. Three developments stand out. The Dutch DPA's Uber fine, for automated decisions without human involvement, is among the largest GDPR fines ever, and it shows that automated decision-making is now an enforcement priority. CNIL's Free fine shows that a breach caused by basic security failings (weak remote-access authentication, ineffective monitoring) can be costly even for a domestic company. And the annulment of Amazon's fine shows that procedure matters: the court upheld the violations but annulled the fine because the regulator skipped required steps.

How high can a GDPR fine go?

Article 83 sets two ceilings, and the higher of the fixed amount and the turnover percentage applies to companies:

• Up to €10 million or 2% of worldwide annual turnover (Article 83(4)) for infringements of obligations such as security (Article 32), breach notification (Articles 33 and 34), records of processing and data protection by design.
• Up to €20 million or 4% of worldwide annual turnover (Article 83(5) and (6)) for infringements of the core principles, legal basis and consent, data subjects' rights, international transfers, and for not complying with an order from the authority.

The ceilings are maximums, not starting points: the authority sets the amount using the factors in Article 83(2) and the EDPB's calculation method, which our article on how GDPR fines are calculated walks through. To see the range for your own turnover, try the breach cost calculator.

A fine is also not the only consequence. Under Article 58(2) the authority can order you to bring processing into line, suspend data transfers or stop processing altogether; the Meta transfers decision combined the €1.2 billion fine with an order to suspend transfers. People who suffered damage can also claim compensation in court under Article 82, separately from any fine.

What drives the largest fines?

Analyzing the top GDPR enforcement actions reveals consistent patterns. The largest fines are not random — they cluster around specific types of violations that regulators view as particularly serious.

Insufficient legal basis for processing

Two of the largest fines in the table above, LinkedIn and Amazon, were for processing personal data for targeted advertising without a valid legal basis. The same failure appears in many smaller cases: relying on consent that was not freely given, specific or informed, using data for purposes the original legal basis does not cover, or not documenting a legitimate interests assessment.

International data transfers

Transfers of personal data outside the EU/EEA without adequate safeguards have attracted some of the most significant penalties. The invalidation of the EU-US Privacy Shield (Schrems II) created a compliance gap that many organizations failed to address quickly enough. While the EU-US Data Privacy Framework now provides a mechanism for US transfers, organizations transferring data to other non-adequate countries must ensure proper safeguards (Standard Contractual Clauses, Binding Corporate Rules) are in place.

Transparency failures

GDPR requires clear, accessible privacy information. Organizations that bury data practices in impenetrable privacy policies, use dark patterns to obscure choices, or fail to inform individuals about how their data is used face enforcement. This is especially true for consumer-facing services where millions of users are affected.

Inadequate security measures

Data breaches resulting from inadequate security attract fines not for the breach itself (breaches happen), but for the failure to implement appropriate technical and organizational measures beforehand. Common security failures that lead to fines include unencrypted data, weak or default passwords, unpatched systems, lack of network segmentation, inadequate access controls, and insufficient monitoring.

Enforcement patterns across DPAs

The Irish DPC has issued the largest individual fines, driven by its role as lead supervisory authority for major US tech companies with European headquarters in Ireland. Its enforcement has focused on data transfers, legal basis for processing, and transparency requirements.

The French CNIL fines organisations of all sizes, from large platforms to small companies, and publishes its sanctions. Cookie consent and advertising have been recurring themes (our cookie consent checker covers what regulators look at), and the Free decision in the table shows it also pursues basic security failings.

National authorities such as Italy's Garante and Spain's AEPD publish many decisions each year, covering marketing, employee monitoring, health data and more. Individual fines are usually far smaller than the headline cases, which shows that enforcement is not limited to large corporations.

In Germany, supervision is split between a federal authority and state-level authorities, so enforcement approaches can vary between states.

Lessons for your business

1. Legal basis is not optional

The most expensive mistake in GDPR compliance is processing data without a clear, documented legal basis. For every processing activity, determine which of the six Article 6 legal bases applies and document your reasoning. If you rely on consent, ensure it meets all GDPR requirements (freely given, specific, informed, unambiguous, and withdrawable). If on legitimate interest, conduct and document a balancing test.

2. Know where your data goes

Data transfer violations carry significant penalties. Map your data flows — especially those leaving the EU. For each transfer, ensure adequate safeguards are in place. Our Data Flow Mapping Tool helps you document exactly where data goes and what safeguards protect each transfer.

3. Invest in security basics

You do not need a fortune to avoid security-related fines. The violations that attract penalties are usually basic failures: unencrypted databases, default passwords left unchanged, patches not applied for months, and access not revoked for departed employees. Get the fundamentals right. Our Cybersecurity Maturity Assessment helps you evaluate where you stand.

4. Cooperation reduces fines

Article 83(2) lists the factors an authority weighs when setting a fine. They include the degree of cooperation with the authority (point (f)), the action taken to mitigate the damage (point (c)), and the manner in which the infringement became known, including whether you notified it (point (h)). Prompt notification within the 72-hour deadline, transparent communication and active cooperation all count in your favour. Obstruction and delay count against you.

5. Size does not equal immunity

Headline fines are only a small part of enforcement. Authorities also issue decisions against small and medium-sized organisations, and the fine calculation takes turnover into account: a smaller fine for a smaller company can be just as painful in proportion. Our guide to how fines are calculated explains the EDPB method.

6. Breach response matters as much as prevention

Some fines cover not only the breach but also the response. CNIL's Free decision in the table covered inadequate information to customers as well as the security failings. Late or missing notification is an infringement of Articles 33 and 34 in its own right. A tested incident response plan reduces that risk.

How much could a breach cost your organization? Use our GDPR Breach Cost Calculator to estimate your total financial exposure — including fines, notification costs, legal fees, and business impact.

Self-check: could the same thing happen to you?

The headline cases involve large platforms, but the underlying failures are common in organisations of any size. Use the questions below to check your own exposure. Each one links to a free ClevSec tool that goes through the topic in more detail.

The enforcement trajectory

GDPR enforcement keeps developing. The European Data Protection Board (EDPB) coordinates authorities through guidelines and binding decisions, as in the Meta transfers case. Automated decision-making (the Uber fine) and AI, children's data, employee monitoring and adtech are all areas to watch.

The pattern is consistent: regulators keep returning to legal basis, transfers, transparency and security. Fixing those four areas covers most of the risk shown by the cases above.

Common questions

What is the largest GDPR fine so far?

The €1.2 billion fine on Meta Platforms Ireland in May 2023, for transferring Facebook users' data to the US without adequate safeguards. The Irish DPC issued it after the EDPB's Binding Decision 1/2023. Meta has appealed.

Does a fine under appeal have to be paid?

A fine under appeal is not final, and the outcome can change it: the Luxembourg court annulled Amazon's €746 million fine in March 2026 on procedural grounds, while upholding the findings. Whether payment is suspended during the appeal depends on national procedure. That is why the table shows the appeal status next to each fine.

Can small businesses be fined?

Yes. The GDPR applies to organisations of every size, and national authorities publish many decisions against small companies, associations and individual professionals. The amounts are much lower, because turnover is part of the calculation, but a fine of a few tens of thousands of euros can be serious for a small business. Our GDPR guide for SaaS startups covers the basics for small teams.

Can public bodies be fined?

It depends on the country. Article 83(7) lets each member state decide whether, and to what extent, fines can be imposed on public authorities and bodies. The other powers of the supervisory authority, such as orders to stop processing, apply to them in any case.

Does reporting a breach reduce the fine?

It can. How the infringement became known, including whether you notified it, is one of the Article 83(2) factors, as are cooperation and the steps taken to limit the damage. Not reporting a notifiable breach is a separate infringement of Article 33. Our breach notification guide explains when and how to report.

Sources

• EDPB Binding Decision 1/2023 (Meta data transfers)
• Dutch DPA: Uber fined nearly €825 million for automated driver blocking
• Dutch DPA: €290 million fine on Uber for transfers of drivers' data to the US
• Irish DPC: TikTok fined €530 million
• Irish DPC: LinkedIn fined €310 million
• Irish DPC: Meta fined €251 million
• Irish DPC: fines and appeal status
• CNIL: €42 million sanction against Free Mobile and Free (in French)
• MLex: Amazon sees Luxembourg appeals court annul €746 million GDPR fine (March 2026)
• Regulation (EU) 2016/679 (GDPR), EUR-Lex

Related tools