GDPR Fines and Enforcement: How Penalties Are Set and How to Reduce Your Risk

GDPR fines are set by national data protection authorities under Article 83 of the regulation, and they come in two tiers: up to €10 million or 2% of total worldwide annual revenue, and up to €20 million or 4%, whichever is higher in each case. The tier depends on which provisions were breached. Regulators weigh the nature, gravity, and duration of the infringement, whether it was intentional or negligent, the steps taken to limit harm, and how the organization cooperated. The largest penalties to date have involved international data transfers, advertising without a valid legal basis, and the handling of children’s data, while security failures and late breach notifications produce a steady stream of mid-sized fines.

The practical lesson is that most fines trace back to a few controllable failures: not knowing where personal data goes, weak access and authentication controls, and slow or incomplete incident response. Kiteworks provides a control plane for secure data exchange that helps organizations apply encryption, access control, and audit logging to personal data in every email, file share, and API exchange.

This page provides general information, not legal advice, and it reflects one reading of the rules. GDPR obligations depend on your organization’s circumstances, so consult your own legal counsel or data protection advisor before relying on it.

Key Takeaways

1. The Tier Depends on the Provision You Breached

Security and breach notification failures fall in the lower tier, while violations of core principles, data subject rights, and transfer rules fall in the upper tier. Both tiers apply the “whichever is higher” test to organizations, so a fixed euro amount can understate the real exposure for a large company.

2. Fines Reflect Circumstances, Not a Price List

Article 83(2) requires regulators to weigh factors such as intent, mitigation, cooperation, and the technical measures in place. Two organizations that breach the same article can receive very different penalties depending on how they prepared and how they responded.

3. Transfers, Advertising, and Children’s Data Drive the Largest Fines

The biggest penalties to date concern where data goes, what legal basis supports its use, and how minors are treated. Mid-sized fines often come from weak security, excessive retention, and incomplete breach notification.

4. Processors and Vendors Are Part of Your Exposure

Regulators have started fining processors directly, and a vendor’s failure can still become your incident. Contracts, due diligence, and visibility into how partners handle personal data belong in the compliance program.

5. Evidence Is the Best Mitigation

Organizations that can show what happened, when, and who had access respond faster and present a stronger record to regulators. Audit logs, encryption, and documented incident response are the controls that most often shape the outcome after an incident.

What Are the Maximum GDPR Fines?

Article 83 sets two caps on administrative fines. The cap that applies depends on which provisions the organization breached:

• Lower tier (Article 83(4)): up to €10 million or 2% of total worldwide annual revenue from the preceding financial year, whichever is higher. This tier covers the obligations of controllers and processors, including data protection by design and by default, processor contracts, security of processing, and breach notification.
• Upper tier (Article 83(5)): up to €20 million or 4% of total worldwide annual revenue, whichever is higher. This tier covers the basic principles for processing, the conditions for consent, data subject rights, and the rules on international transfers.

Article 83(1) requires every fine to be effective, proportionate, and dissuasive. When one processing operation breaches several provisions, Article 83(3) caps the total at the amount set for the gravest infringement. Fines are only one of the tools available. Supervisory authorities can also issue warnings and reprimands, order processing to stop, require data to be deleted, and suspend data flows to a third country (Article 58). Individuals can claim compensation separately under Article 82. For a full overview of the regulation, see our GDPR guide.

How Are GDPR Fines Calculated?

There is no fixed formula in the regulation itself. Article 83(2) lists the factors that authorities must consider in each case:

1. The nature, gravity, and duration of the infringement, including the number of people affected and the damage they suffered.
2. Whether the infringement was intentional or negligent.
3. Any action the organization took to limit the damage.
4. The organization’s degree of responsibility, taking into account the technical and organizational measures it had in place.
5. Relevant previous infringements.
6. The degree of cooperation with the supervisory authority.
7. The categories of personal data affected.
8. How the authority learned of the infringement, including whether the organization reported it.
9. Compliance with earlier corrective orders, adherence to approved codes of conduct or certifications, and other aggravating or mitigating factors.

To make fines more consistent across the EU, the European Data Protection Board adopted Guidelines 04/2022 on the calculation of administrative fines, with a final version published in May 2023. The guidelines describe a common method that considers the seriousness of the infringement, the size and turnover of the organization, and aggravating and mitigating circumstances. Authorities still apply their own national procedures, so outcomes vary.

Two points from this framework matter in practice. First, the “technical and organizational measures” factor rewards organizations that can show strong controls were in place, which is where encryption, access control, and logging count. Second, reporting a breach promptly and cooperating with the authority are explicit mitigating factors.

Who Enforces GDPR Fines?

Enforcement sits with the national supervisory authorities in each member state, such as Ireland’s Data Protection Commission (DPC), France’s CNIL, Italy’s Garante, and the Dutch Autoriteit Persoonsgegevens. For companies that operate in several member states, the “one-stop-shop” mechanism lets the authority where the company has its main EU establishment lead the case, in cooperation with the other authorities concerned. This concentrates many cross-border cases in a small number of regulators, most notably the Irish DPC, which hosts the EU headquarters of several large technology companies.

Organizations outside the EU are not exempt. If you offer goods or services to people in the EU or monitor their behavior, the GDPR applies to you, and authorities can act against you directly. Our guide for U.S. companies handling EU data explains how scope is assessed.

What Are the Biggest GDPR Fines?

The following penalties are among the largest imposed under the GDPR. They are listed here to show what regulators punish most heavily, not as a complete ranking.

Three patterns stand out. Transfer rules are a repeated target, which is why a documented mechanism and a fallback matter, as covered in our guides to the transfer impact assessment and cross-border data transfer risks. Advertising and tracking practices need a valid lawful basis, and consent must meet the regulation’s standard. Children’s data receives particular scrutiny.

What Triggers a GDPR Fine?

Most fines follow one of five triggers:

• Unlawful processing or invalid consent. Using personal data without a lawful basis, or relying on consent that is not freely given, specific, informed, and unambiguous.
• Insufficient security. Weak authentication, poor access control, and missing monitoring. Regulators treat security as a core duty under Article 32.
• Late or incomplete breach notification. The 72 hour deadline in Article 33 and the duty to inform affected individuals in Article 34 are enforced in practice.
• Excessive retention. Keeping personal data longer than needed breaches the storage limitation principle. See our guide to data minimization.
• Unlawful transfers. Moving personal data outside the EU and EEA without a valid mechanism.

Failures in responding to data subject requests, ignoring regulator orders, and skipping a required data protection impact assessment also appear in enforcement decisions.

How Can You Reduce Your GDPR Fine Risk?

The factors in Article 83(2) point to a practical program. Start with these steps:

1. Map your personal data. Know what you hold, where it is stored, who can access it, and where it travels, including to vendors and partners.
2. Document a lawful basis for each purpose. Keep records that show why you process each category of data.
3. Control access and encrypt data. Apply least-privilege permissions, strong authentication, and encryption in transit and at rest, and keep control of your own encryption keys.
4. Keep complete audit logs. Records of who accessed what, and when, shorten investigations and support breach reports. See our guide to audit logs.
5. Rehearse breach response. Test your incident response plan against the 72 hour deadline.
6. Manage vendors and processors. Use written contracts and monitor how partners handle personal data. See our overview of third-party risk management.
7. Document transfer mechanisms. Record the adequacy decision or safeguard behind every transfer, including standard contractual clauses where used.
8. Limit retention. Delete personal data when you no longer need it, and be able to show the schedule you follow.

Current Status and Recent Enforcement

This section is reviewed and updated separately from the rest of the page. Last reviewed: October 2026.

Cumulative fines. DLA Piper’s January 2026 survey reports that total GDPR fines since May 25, 2018 reached about €7.1 billion as of January 10, 2026. Fines imposed in 2025 totaled about €1.2 billion, roughly matching 2024 and ending a period of year-on-year decline. The Irish Data Protection Commission accounts for about €4.04 billion of the cumulative total.

Breach notifications. The same survey reports an average of 443 personal data breach notifications per day across the surveyed European countries between January 2025 and January 2026, up 22% from the prior year, and the first time the daily average passed 400. It also notes continued fines for security failures, growing attention to supply chain security, and several fines imposed directly on processors in 2025.

Recent decisions. Secondary reporting on 2026 enforcement points to the same themes. France’s CNIL fined Free Mobile €27 million and Free €15 million in January 2026 over weak security for subscriber data, excessive retention, and inadequate notification after a 2024 breach. It also fined France Travail €5 million over a breach that exposed job seekers’ data, citing weak access controls, authentication, and monitoring. In the United Kingdom, which applies the UK GDPR rather than the EU regulation, the Information Commissioner’s Office fined Reddit about £14.5 million in February 2026 over its handling of children’s data.

Transfers. The European Commission adopted an adequacy decision for the EU-U.S. Data Privacy Framework on July 10, 2023. The EU General Court dismissed a challenge to it on September 3, 2025, and the applicant appealed to the Court of Justice on October 31, 2025. The decision remained in effect at the time of this review, and many organizations keep standard contractual clauses available as a fallback.

Proposed GDPR changes. The European Commission has proposed changes to the GDPR as part of its Digital Omnibus package, and the European Data Protection Board and European Data Protection Supervisor issued a joint opinion on it in February 2026. The GDPR amendments were still a proposal at the time of this review, so current obligations and penalty tiers are unchanged.

The EU AI Act. The AI Act is a separate regime with its own penalties. Regulation (EU) 2026/1744, which entered into force on July 27, 2026, moved the date for most high-risk AI obligations to December 2, 2027 for stand-alone systems listed in Annex III, and to August 2, 2028 for AI that is a safety component of regulated products. Read our guide to the EU AI Act for the current timeline. For privacy laws beyond the EU, see our overviews of global data privacy laws and U.S. state data privacy laws.

How Kiteworks Helps Organizations Reduce Privacy Enforcement Risk

Many of the failures behind GDPR fines happen when personal data moves between people, partners, and systems. Kiteworks provides a control plane for secure data exchange that governs how personal data is sent, shared, and accessed across email, file sharing, SFTP, managed file transfer, and APIs. The platform helps organizations support the controls regulators look for in these ways:

• Customer-owned encryption keys. Customers own their encryption keys, so Kiteworks staff cannot decrypt a customer’s data. Learn more about customer-owned encryption key control.
• Double encryption. Data is encrypted at the file level and again at the disk level, each with separate keys. See how double encryption works.
• A single audit log with SIEM feeds. User, data, and system activity is recorded in one audit log that can be fed to your security tools in real time, which supports faster breach investigation and reporting. Audit logs are anonymized by default to support privacy requirements. The CISO Dashboard helps security teams spot unusual activity.
• Least-privilege access. Granular permissions and configurable administrator roles limit who can view, download, or share personal data.
• Data sovereignty controls. Geofencing and location settings let organizations keep a user’s data in a designated country and show auditors where it is stored. Explore data sovereignty on the platform.
• Compliance reporting. Built-in reports summarize policy settings and relevant operations to support audit preparation. See the Kiteworks GDPR compliance page.

These controls apply across email, managed file transfer, and SFTP. Explore the Kiteworks data control plane, or browse our GDPR compliance resources.