GDPR fines in numbers: what regulators have actually imposed

Since the GDPR began to apply on 25 May 2018, European data protection authorities have imposed roughly EUR 7 billion in fines. Most of that sum comes from a small number of very large fines against technology companies. This guide gives the figures, with the source and date for each, and explains what they do and do not tell a small business. The data is as of 4 November 2026.

#How much have GDPR fines added up to?

No single database captures every fine, so the totals depend on who counts. The main sources agree on the order of magnitude, not on the exact number.

The numbers differ because each source counts a different set of fines, and the trackers only list fines that authorities publish. The Commission counted far more fines (over 6,680 by July 2024) than the CMS tracker held in March 2025 (2,560 at most), which suggests many fines are never published.

DLA Piper's January 2026 survey found that fines in 2025 totalled about EUR 1.2 billion, broadly the same as in 2024, which reversed a downward trend. Ireland's Data Protection Commission leads the cumulative table with about EUR 4.04 billion. The same survey recorded an average of 443 personal data breach notifications a day between 28 January 2025 and 27 January 2026, up 22% from 363.

#What are the largest GDPR fines?

The ten largest fines in the CMS report (cut-off 1 March 2026) add up to roughly EUR 4.21 billion, which is about 69% of the EUR 6.11 billion total. That share is our own calculation from CMS's table. Nine of the ten were issued by Ireland's Data Protection Commission.

Two caveats. The CNIL's Google and Shein fines are not in CMS's top ten, probably because they were issued under French ePrivacy rules for cookies and not under the GDPR itself, and they are the largest cookie fines we verified. And the Amazon fine of EUR 746 million, issued in Luxembourg in July 2021, is absent from CMS's 2026 list (the report does not say why) and is no longer standing: according to press reports, a Luxembourg court annulled it on 12 March 2026 because the regulator had not properly assessed whether the breaches were intentional or negligent, and sent the case back to the CNPD to reassess. Large fines are often challenged in court, so headline numbers can change.

#What are the most common reasons for GDPR fines?

By number of fines, the CMS 2026 ranking is:

1. Insufficient legal basis for data processing.
2. Non-compliance with general data processing principles.
3. Insufficient technical and organisational measures to ensure information security.
4. Insufficient fulfilment of data subjects' rights.
5. Insufficient fulfilment of information obligations.

The 2025 CMS report put numbers on the top three: 669 fines for insufficient legal basis (average EUR 2.9 million), 644 for general principles (average EUR 3.8 million) and 418 for security failures (average EUR 2.0 million). Fines for missing data protection officers, missing processor contracts or lack of cooperation with authorities are very rare, according to the 2026 report. DLA Piper adds that security-principle fines continue across all surveyed countries, that processors can be fined directly, and that regulators are watching supply chain security.

Cookie rules are enforced under national ePrivacy laws as well as the GDPR, so they do not always appear in GDPR totals. The September 2025 CNIL fines show they can still be large. Our cookie consent guide covers what is required.

#What are the two GDPR fine tiers?

Article 83 sets two ceilings. For a company, the cap is the higher of the fixed amount and the percentage of worldwide annual turnover.

These are ceilings, not prices. Article 83(1) says every fine must be effective, proportionate and dissuasive in the individual case.

#What do regulators weigh when setting a fine?

Article 83(2) lists the factors. The regulator looks at:

• the nature, gravity and duration of the breach, the number of people affected and the damage they suffered;
• whether it was intentional or negligent;
• what you did to reduce the damage;
• your degree of responsibility, including the technical and organisational measures you had in place;
• previous infringements;
• how well you cooperated with the regulator;
• the categories of personal data involved;
• how the regulator found out, including whether you reported it yourself;
• compliance with earlier orders, and adherence to approved codes of conduct or certifications;
• any other aggravating or mitigating factor, such as financial gain.

The European Data Protection Board adopted final guidelines on how authorities calculate fines (Guidelines 04/2022) on 24 May 2023.

#Do small businesses get fined like Big Tech?

The headline fines are against very large companies, but no source we found breaks fines down by company size, so there is no reliable "typical small-business fine". What the evidence does show:

• Most complaints do not end in a fine. The privacy group noyb analysed EDPB statistics for 2018 to 2023 and found that on average 1.3% of cases before data protection authorities end in a fine (published 28 January 2025). That is an advocacy group's analysis, and the share ranged from 0.03% in the Netherlands to 6.84% in Slovakia.
• Regulators have other tools. The European Commission's 2024 report says that apart from fines, the most common corrective measures were warnings, reprimands and orders to comply. Recital 148 of the GDPR allows a reprimand instead of a fine for a minor infringement.
• Smaller fines exist, and are recorded. Spain's regulator leads by volume, with 1,048 published fines in the 2026 CMS report, and CMS notes that the average fine in Spain is much lower than in most countries. One example from the tracker: on 21 January 2022 the Spanish authority fined a website operator EUR 2,000 for having no privacy policy, in breach of Article 13.
• The percentage caps rarely matter to small companies. For a company, the cap is the higher of the fixed amount and the percentage. By our arithmetic, 2% or 4% of turnover only overtakes EUR 10 million or EUR 20 million when turnover is above EUR 500 million. Below that, the fixed amount is the ceiling, and Article 83(1) still requires the fine to be proportionate.

These are enforcement patterns, not promises. Compensation claims for damage can come on top of fines, and DLA Piper notes follow-on claims for non-material damage are rising.

#What this means for a small business

The pattern in the data is fairly consistent: fines follow weak basics. Missing legal bases, missing or false privacy policies, poor security, ignored requests and cookies set without consent are what authorities act on, and complaints from individuals are a common trigger. A short list of things that reduce risk, and that also count in your favour under Article 83(2):

1. Know your legal basis for each use of personal data and say so in your privacy policy.
2. Answer people's requests on time. See responding to access requests.
3. Secure the data and keep vendor agreements in place.
4. Ask for cookie consent before non-essential cookies run.
5. If a breach happens, assess it quickly and notify within 72 hours when required. See what to do in a personal data breach.
6. Keep records of what you did and when. They show responsibility and cooperation.

Privacyboard's incident register records each breach, its risk and the 72-hour deadline; see the incident register guide. For a broader baseline, use our GDPR checklist for small businesses.

#FAQ

#What is the biggest GDPR fine ever?

EUR 1.2 billion, imposed on Meta Platforms Ireland by the Irish Data Protection Commission on 12 May 2023 over transfers of Facebook users' data to the US. The next largest still standing in CMS's list is TikTok's EUR 530 million from 2 May 2025.

#How much have GDPR fines totalled?

About EUR 7.1 billion between 25 May 2018 and 10 January 2026, according to DLA Piper. The CMS Enforcement Tracker showed EUR 7.59 billion on 3 November 2026. Totals vary by source.

#What is the maximum GDPR fine?

EUR 20 million or 4% of worldwide annual turnover, whichever is higher, for the most serious infringements, and EUR 10 million or 2% for the lower tier (Article 83).

#Do small businesses get GDPR fines?

Yes, but usually small ones, and many cases end without a fine. Regulators can also issue warnings and reprimands. We found no source that gives a statistical breakdown of fines by company size.

#What is the most common GDPR violation?

Insufficient legal basis for processing is the most frequent category in the CMS tracker, followed by general processing principles, security failures and people's rights.

#Can a GDPR fine be cancelled?

According to press reports, yes: Amazon's EUR 746 million fine was annulled by a Luxembourg court on 12 March 2026 and sent back to the regulator, which must reassess whether and how to fine.

#Sources

• Regulation (EU) 2016/679 (GDPR), Article 83 and Recital 148, EUR-Lex
• European Commission: second report on the application of the GDPR, COM(2024) 357, EUR-Lex
• EDPB: Guidelines 04/2022 on the calculation of administrative fines, final version 24 May 2023
• EDPB: Binding Decision 1/2023 on data transfers by Meta Platforms Ireland for its Facebook service
• Irish Data Protection Commission: TikTok fined EUR 530 million
• CNIL: Google fined EUR 325 million and Shein EUR 150 million, 3 September 2025
• DLA Piper: GDPR fines and data breach survey, January 2026
• CMS: GDPR Enforcement Tracker Report 2026, numbers and figures
• CMS: GDPR Enforcement Tracker Report 2025, executive summary
• CMS Enforcement Tracker (live database)
• CMS Enforcement Tracker entry ETid-1007: Spanish AEPD, EUR 2,000
• noyb: Data Protection Day, only 1.3% of cases before EU DPAs result in a fine
• Decision Marketing: court overturns EUR 746m Amazon GDPR fine, 16 March 2026
• Luxembourg Chronicle: court annuls CNPD ruling in Amazon data protection case