GDPR Fines and Enforcement Statistics: Totals, Biggest Fines and Security Penalties

GDPR fine totals quoted in board papers and vendor decks rarely agree, because each tracker counts different countries, cut-off dates and categories, and a few very large fines distort every average. This page gathers the current enforcement figures from the publishers' own pages: the CMS GDPR Enforcement Tracker Report 2026, the DLA Piper GDPR Fines and Data Breach Survey (January 2026), the Irish Data Protection Commission, the French CNIL's 2025 sanctions review and the UK Information Commissioner's Office. Every figure carries its source and date in the same sentence or table row. It is for privacy, security and risk leaders who need to size regulatory exposure or explain it to a board. The qualitative lessons from security decisions sit in the GDPR Enforcement Decisions on Security Failures Guide; this page is the numbers. Last reviewed: November 2026.

Key takeaways

• Cumulative fines are now in the EUR 6 to 7 billion range. The CMS Enforcement Tracker Report 2026 records about EUR 6.11 billion across 2,685 fines to 1 March 2026; DLA Piper puts the cumulative total at EUR 7.1 billion to 10 January 2026, using a different country set.
• Annual totals have plateaued at around EUR 1.2 billion. DLA Piper reports about EUR 1.2 billion in fines in 2025, broadly the same as 2024, while breach notifications rose 22% to an average of 443 a day.
• Ireland dominates value, Spain dominates volume. The Irish DPC issued nine of the ten largest fines (CMS) and EUR 4.04 billion in total (DLA Piper), while Spain has published the most fines for seven years running (CMS), 1,048 at the 2026 cut-off.
• Security failures are a top-three fine category. CMS ranks "insufficient technical and organisational measures to ensure information security" third by frequency, and two Meta fines of EUR 265 million and EUR 251 million sit in that category in its top ten.
• Averages mislead. CMS calculates an average fine of about EUR 2.28 million but notes a small number of very large fines drive it; most fines, especially in Spain and under the CNIL simplified procedure, are far smaller.

Headline statistics

Why the trackers disagree

• Different scope: DLA Piper surveys 16 jurisdictions including the UK, Norway and the EU's largest enforcers. CMS counts fines with complete information on amount, date and controller, and lists the rest separately.
• Different cut-off dates: DLA Piper's cumulative total runs to 10 January 2026; CMS's to 1 March 2026. A single large fine or annulment in between moves the totals by hundreds of millions.
• Annulled and appealed fines: CMS reports that the EUR 746 million Amazon fine imposed in Luxembourg was set aside by the Luxembourg Administrative Court in March 2026 and referred back to the CNPD. Trackers that removed it show a lower total than those that kept it.
• Incomplete records: CMS counts 377 fines with limited information on amount or date separately (3,062 against 2,685), so "number of fines" depends on which figure is quoted.

When quoting a total, name the tracker, the edition and the cut-off date. The CMS figure is the more conservative of the two for value.

The largest GDPR fines

Source: CMS GDPR Enforcement Tracker Report 2026 (dates as recorded by CMS; the DPC announced the EUR 251 million decision on 17 December 2024). The Uber fine concerned transfers of driver data to the United States, per the CMS executive summary.

The top of the table is about legal basis, transparency and international transfers, not breaches. Fines driven by security failures are fewer at the very top but frequent lower down, and they follow incidents, which is the exposure most security teams control directly.

Fines by country

• Ireland, by value: DLA Piper reports aggregate DPC fines of EUR 4.04 billion since May 2018, well over half of all GDPR fines by value. This reflects the one-stop-shop: many large technology firms have their EU main establishment in Ireland.
• Spain, by number: CMS records 1,048 Spanish fines at the 2026 cut-off (116 more than a year earlier), the most of any country for the seventh consecutive year. CMS notes the Spanish average fine is much lower than in most other countries.
• Italy, Romania and Poland: CMS ranks them next by number of published fines.
• France: the CNIL's 2025 review reports 83 sanctions and EUR 486,839,500 in fines in 2025, including two fines of EUR 325 million and EUR 150 million in the cookies and trackers area. CMS names a EUR 150 million CNIL fine against Infinite Styles Services for tracking without valid consent.
• Netherlands: the Dutch DPA's EUR 290 million fine on Uber (July 2024) is the largest outside Ireland in the CMS top ten.
• United Kingdom: the ICO enforces UK GDPR separately. Recent security penalties include Capita (GBP 14 million, October 2025) and 23andMe (GBP 2.31 million, June 2025); see below.

Fines by violation type and sector

Source for ranking: CMS GDPR Enforcement Tracker Report 2026. The article column is our mapping of each category to the GDPR provisions it usually rests on. CMS reports "very few" fines for failures on cooperation with authorities, DPO involvement and appointment, and data processing agreements, and the highest average fine in the general principles category, driven largely by the TikTok decision.

Sector: CMS finds the most fines in Industry and Commerce and in Media, Telecoms and Broadcasting; the highest average fines in Media, Telecoms and Broadcasting, Employment, and Transportation and Energy; and the fewest fines in Accommodation and Hospitality and in Real Estate.

Security and breach-driven penalties

These are the decisions most relevant to security teams, because the triggering failure is a control gap rather than a business model choice.

The Meta decision is worth noting for how it was framed: no Article 32 fine was imposed, yet EUR 240 million rested on design and default duties, and EUR 11 million on notification quality. The Capita reduction shows the other side: the ICO cited post-attack improvements, support for affected people, engagement with the NCSC and a voluntary settlement. For the decisions in depth see the GDPR Enforcement Decisions on Security Failures Guide.

Breach notification volumes

DLA Piper counts an average of 443 personal data breach notifications a day across its surveyed jurisdictions between 28 January 2025 and 27 January 2026, up 22% from 363 and the first time above 400 since 2018. Notifications rose while fine totals stayed flat, so most notified breaches never lead to a fine. The obligation itself is to notify the supervisory authority within 72 hours of becoming aware where feasible, as GDPR Recital 85 explains. For the notification workflow see the Data Breach Notification Checklist.

What the numbers mean for defenders

• Size exposure with the right maximum: GDPR Article 83 sets two tiers. Infringements of controller and processor obligations, including Article 32 security and Articles 33 and 34 notification, carry up to EUR 10 million or 2% of total worldwide annual turnover; principles, legal basis, data subject rights and transfers carry up to EUR 20 million or 4%, whichever is higher in each tier. The Meta EUR 251 million decision shows security-adjacent failures can reach nine figures through Article 25.
• The median breach-driven fine is small, the tail is not: most fines are a fraction of the EUR 2.28 million average, but large processors and platforms face the tail. Model both a typical and a tail case.
• Privileged access is a recurring finding: Capita's missing admin tiering and 23andMe's missing MFA are basic identity controls. See the GDPR Compliance Guide for Security Teams for how Article 32 maps to these controls.
• Response quality changes the number: the ICO cut Capita's provisional fine by more than two thirds. Detection speed, honest notification and remediation evidence are financial controls as well as security ones.
• Notification content is enforced: Meta's Article 33(3) and 33(5) fines punish incomplete notifications and missing breach records. Keep a breach register for every incident, notified or not.

Practitioner checklist

• When quoting GDPR fine statistics, name the tracker, edition and cut-off date, and state whether the figure is a total, median or mean.
• Identify your lead supervisory authority and review its recent fines, since national practice varies more than the regulation.
• Map your security controls to Articles 5(1)(f), 25 and 32, with evidence of testing, not just policy.
• Close the identity findings regulators keep citing: admin account tiering, MFA for customer and privileged accounts, and monitoring of high-priority alerts against a defined response target.
• Maintain an Article 33(5) breach register covering facts, effects and remediation for every personal data breach.
• Rehearse the 72-hour notification with legal, DPO and security together, including what you will say when facts are still incomplete.
• Model regulatory exposure at both the Article 83(4) and 83(5) tiers using group worldwide turnover.
• Recheck these figures each January (DLA Piper) and May (CMS) when new editions publish.

Standards and references

• EUR-Lex: Regulation (EU) 2016/679 (General Data Protection Regulation)
• Irish Data Protection Commission: Irish Data Protection Commission fines Meta EUR 251 Million
• ICO: Capita fined GBP 14m for data breach affecting over 6m people
• ICO: 23andMe fined for failing to protect UK users' genetic data
• CNIL: Sanctions et mesures correctrices, bilan 2025
• CMS: GDPR Enforcement Tracker Report, Numbers and Figures
• CMS: GDPR Enforcement Tracker Report, Executive Summary
• DLA Piper: GDPR Fines and Data Breach Survey, January 2026

Related NHI Mgmt Group resources: GDPR Enforcement Decisions on Security Failures Guide · GDPR Compliance Guide for Security Teams · UK GDPR and Data Protection Act 2018 Guide · Data Breach Statistics Guide. This guide summarises published GDPR enforcement statistics and is not legal advice.