GDPR fines: biggest penalties and latest news

What are GDPR fines and who administers them

GDPR fines are administrative penalties that national data protection authorities impose on organizations that break the GDPR. The regulation does not fine anyone itself. Each country’s authority does: Ireland’s DPC, France’s CNIL, Italy’s Garante, Sweden’s IMY, Norway’s Datatilsynet, and in Poland the President of the UODO. According to Article 83 on EUR-Lex (checked 10 October 2026), every fine must be effective, proportionate and dissuasive. The authority weighs the nature, gravity and duration of the breach, the number of people affected, intent or negligence, cooperation with the authority and earlier infringements. It can fine instead of, or on top of, other corrective measures.

How high are GDPR fines

The ceiling is €20 million or 4% of worldwide annual turnover for the gravest breaches and €10 million or 2% for lesser ones, whichever is higher. From Article 83(4) and (5), as of 10 October 2026:

If one operation breaks several provisions, the total cannot exceed the amount for the gravest one (Article 83(3)). In Poland, public finance bodies, research institutes and the central bank face up to 100,000 zł, and some other public bodies up to 10,000 zł (Article 102 of the Polish data protection act, 2019 consolidated text).

Biggest GDPR fines in 2026

The biggest fine in 2026 reports is Uber’s €825 million from the Dutch regulator. Fines reported this year:

The Netherlands fined Uber €825 million for 2018 to 2022 practices: the GDPR bans fully automated decisions, and drivers were not told the suspensions were automatic. It is the fourth fine from this regulator against Uber. The previous record was €290 million in 2024 for sending drivers’ data to the US.

Ireland’s DPC fined Google €403 million over Web & App Activity, Timeline and Google Location Accuracy data collected between 25 May 2018 and 4 February 2020. Sources convert it to $459 million or $462 million. Google has six months to bring its practices into line and says the case concerns historical policies. In the report on tracking despite location being off, Web & App Activity collected location in a non-obvious way, and the feature remains live in more than 30 countries. See Google and location tracking.

How to avoid GDPR fines: what regulators punished in 2026

Fix the failures regulators punished this year: weak access controls, bundled consent, false anonymisation and fully automated decisions. Four patterns:

• Security and breaches. CNIL fined a French hospital €500,000 under Articles 32 and 34: outside doctors had no VPN or multi-factor authentication, one compromised account opened every patient record, and 202,246 trusted third parties were never notified. Sweden’s IMY fined Miljödata SEK 1.8 million for not checking newly installed software and lacking real-time monitoring. Ireland’s DPC fined the HSE for abandoned records and ordered an audit of all storage sites. See healthcare data breaches and data breach fines and settlements.
• Consent. Norway’s Datatilsynet fined Elkjop NOK 20 million: more than six million loyalty club members had to accept newsletters, profiling and personalisation as one package. The company had itself flagged in February 2022 that the consent could be invalid and changed nothing.
• Marketing and health data. Italy held TIM responsible for partner call centres that used spoofed numbers, based on about 7,000 complaints. In the IQVIA case a persistent 16-byte Pat ID made a patient database personal data, failing the singling-out test.
• Children. TikTok lost its appeal against the £12.7m fine; the Upper Tribunal rejected its claim that users’ videos were artistic expression. The ICO estimated up to 1.75 million British under-13s used TikTok in 2020, while the tribunal spoke of over 1.4 million. See TikTok and children’s online safety.

Not every breach ends in a fine. Sweden’s IMY ruled Securitas’s AI driver cameras unlawful but issued only a reprimand because the pilot was limited. More in workplace surveillance. Courts and guidelines also shape the rules: the EU Court of Justice blocked Sweden’s GDPR exemption for a paid convictions database, and the EDPB held encrypted blockchain data to be personal data.

What happens if you ignore a GDPR fine

Ignoring an authority’s order is a fineable offence of its own, up to €20 million or 4% of worldwide turnover (Article 83(5)(e) and 83(6)). Poland shows how it works. In October 2026 the UODO president fined the Warsaw company Costalea 29,112 zł. According to the UODO announcement of 5 October 2026, the company did not carry out a 2025 decision ordering it to inform a complainant, and ignored a request for explanations and a formal reminder. The amount reflected the company’s last financial year, and the UODO says it will keep pressing for the original decision to be carried out.

Companies also appeal. Uber says it will challenge the €825 million, and IQVIA has 30 days to appeal or can settle for half. TikTok withdrew its appeal, and paying the fine lets the ICO resume a separate probe of its recommender systems.

Where do GDPR fines go

It depends on the country: Article 83 sets amounts and criteria but does not say who receives the money. In Poland, funds from an administrative fine are state budget revenue (Article 104 of the Polish act). The fine is due within 14 days of the court deadline passing or the ruling becoming final, and the UODO can defer it or allow instalments (Article 105).

How other countries fine: the UK and South Korea

South Korea has had the world’s highest national fine ceiling since 11 September 2026: up to 10% of global annual revenue. The amended PIPA took effect on 11 September and sets a base tier of up to 3% of revenue tied to the violation and an elevated tier of 10%, makes the CEO accountable, and allows up to 40% off for documented privacy investment. In June the PIPC fined Coupang a record 624.6 billion won, about $409 million, after a breach of about 37.55 million people. See South Korea data breaches.

The UK fines rarely. The Good Law Project and Open Rights Group say the ICO averaged under seven fines a year from more than 220,000 complaints in six years, and threaten legal action over its triage system.

What it means for you

• Audit access to personal data: VPN and multi-factor authentication for every outside user, real-time alerts, and a plan to notify everyone whose data leaks.
• Split consent by purpose. One bundled box cost Elkjop NOK 20 million.
• Do not call a dataset anonymous if a persistent identifier lets you single people out.
• Carry out an authority’s decision or challenge it. Silence cost Costalea 29,112 zł and did not close the case.

Still open: whether Uber wins its appeal, how Google changes practices within six months, whether IQVIA settles for €3.5 million, and whether the ICO changes how it handles complaints after the legal threat.