GDPR Fines: Real Examples and How to Avoid Them (2026)

Every GDPR fine starts the same way: a gap between what the regulation requires and what a business actually does. For Meta, that gap was a decade of unlawful data transfers. For a small Hungarian real estate agency, it was one email sent without a valid consent record. The supervisory authorities do not distinguish by company size. They distinguish by violation severity.

This guide documents real GDPR fines, the exact violations that triggered them, and the practical steps that would have prevented each one.

How GDPR Fines Work: The Two-Tier System

GDPR Article 83 establishes two separate fine tiers. Understanding which applies to which violation determines whether you are looking at a €10 million ceiling or a €20 million one — and for large companies, the global turnover percentage makes those numbers irrelevant anyway.

Tier 1 — up to €10 million or 2% of global annual turnover (whichever is higher):

This tier covers administrative and procedural violations. Examples include failing to maintain Article 30 records of processing activities, not implementing appropriate technical security measures under Article 32, not notifying a data breach within the 72-hour window, failing to appoint a Data Protection Officer when required, and violating the rules on Data Processing Agreements.

Tier 2 — up to €20 million or 4% of global annual turnover (whichever is higher):

This tier covers fundamental violations of GDPR principles. Examples include processing data without a valid legal basis, violating the core principles of lawfulness, fairness, and transparency, infringing data subjects' rights (access, erasure, portability), and unlawfully transferring personal data to third countries.

For Meta, whose global annual revenue exceeded €30 billion, 4% meant a fine ceiling above €1.2 billion. For a freelancer with €80,000 turnover, 4% means €3,200. The percentage mechanism is intentional: it calibrates the financial impact across business sizes so that the fine is actually painful regardless of who the controller is.

Real GDPR Fines: 10 Cases That Define Enforcement

The table below presents confirmed enforcement actions from official supervisory authority records.

Three things stand out from this table. First, transparency failures are just as heavily penalised as unlawful processing — WhatsApp's €225 million fine was not for stealing data, it was for not explaining clearly enough what data was being shared. Second, children's data is a regulatory priority: TikTok's €345 million fine exceeded even the WhatsApp penalty. Third, the smallest fine in the table — €2,000 — came from a single marketing email. The mechanism that triggered it is one that thousands of small businesses replicate every week.

The 7 Most Common Violations That Lead to GDPR Fines

1. Unlawful International Data Transfers

Transferring personal data outside the EU/EEA requires a valid mechanism under Chapter V of GDPR. After the Schrems II ruling in 2020 invalidated the Privacy Shield, many US data transfers became unlawful overnight. Standard Contractual Clauses remain valid but must be supplemented with a Transfer Impact Assessment for high-risk transfers. Meta's €1.2 billion fine is the defining example.

2. Invalid Cookie Consent

A cookie banner is not the same as valid cookie consent. Consent must be freely given, specific, informed, unambiguous, and as easy to withdraw as to give. Pre-ticked boxes, "continue browsing equals consent" language, and making the "reject" option harder to find than "accept" are all invalid. Google's €90 million YouTube fine was specifically about the reject button being buried.

3. Unlawful Marketing Emails

Sending commercial emails requires either prior consent or a demonstrable legitimate interest (typically limited to existing customers, about directly related products). Purchasing email lists and mailing them without consent is among the fastest routes to a GDPR complaint. Every spam report to a supervisory authority is a potential investigation trigger.

4. Inadequate Transparency — Missing or Incomplete Privacy Policies

Article 13 requires specific disclosures whenever personal data is collected. A website with a contact form and no privacy policy, or a copied generic policy that does not accurately describe the site's data processing, is in violation. This is also one of the most common triggers for small business enforcement actions, because any visitor can report it.

5. Unlawful Processing of Employee Data

H&M's €35.3 million fine illustrates what happens when HR practices cross into GDPR violation territory. Storing excessive personal information about employees — health conditions, family situations, religious beliefs — without a valid legal basis and without their knowledge is a serious violation. The same applies to covert monitoring, excessive CCTV, and email surveillance without proper notice.

6. Inadequate Technical Security Measures

Article 32 requires "appropriate technical and organisational measures" to protect personal data. British Airways suffered a breach via a compromised third-party script that skimmed payment card data. The ICO found that basic security measures — stronger access controls, penetration testing, multi-factor authentication — would have prevented it. A data breach followed by an investigation that finds inadequate security exposes the controller to Tier 1 fines on top of any reputational damage.

7. Ignoring Data Subject Rights Requests

If an individual submits a Subject Access Request, deletion request, or data portability request, you have 30 days to respond. Ignoring these requests, delaying them without justification, or refusing them without a valid reason are GDPR violations. Supervisory authorities take rights violation complaints seriously because they are clear-cut — there is either a response within 30 days or there is not.

GDPR Fine Factors: What Makes a Fine Bigger or Smaller

Supervisory authorities do not simply apply maximum fines. Article 83(2) lists the factors that determine where in the range a fine lands.

Factors that increase a fine:

• The violation is intentional, not negligent
• The controller took no action to mitigate damage after the breach
• High number of individuals affected
• Special category data involved (health, biometric, children's data)
• The controller has previous violations or enforcement history
• The violation has caused significant damage to data subjects

Factors that reduce a fine:

• The violation was negligent rather than deliberate
• The controller proactively notified the supervisory authority
• The controller cooperated fully with the investigation
• Few individuals were affected, and damage was minimal
• The controller took immediate remedial action on discovery
• The controller had no previous GDPR violations

H&M's fine was high partly because the surveillance was systematic and intentional. The Hungarian real estate agency's fine was low because it was a single incident, the agency cooperated, and the violation was negligent. The difference between a €2,000 fine and a €200,000 fine for technically similar violations often comes down to cooperation and remediation speed.

Real Small Business GDPR Fines

The narrative that GDPR enforcement only targets large corporations is demonstrably false. These are confirmed enforcement actions against businesses that could not pay for specialist legal teams:

• Portuguese medical clinic — €150,000 for allowing unauthorised administrative staff to access patient records in the clinical system. The violation was systemic access control failure.
• Danish taxi company — €160,000 for retaining customer data — specifically passenger names and trip records — for 5 years when their stated retention period was 2 years.
• Romanian grocery website — €15,000 for operating a website with Google Analytics without a valid cookie consent mechanism and an inadequate privacy policy.
• German construction company — €5,000 for responding to a Subject Access Request after the 30-day deadline without a valid justification for the delay.
• Austrian hotel chain — €18,000 for operating CCTV cameras in areas accessible to staff without proper notice and without documenting the legitimate interests assessment.

Notice the pattern: these are not exotic edge cases. They are the absence of basic compliance infrastructure — a cookie banner, an access control policy, a retention schedule, a process for subject access requests. See our guide on what GDPR means for small businesses for the full picture of what is actually required.

How to Protect Yourself: 10-Step GDPR Compliance Checklist

This checklist addresses the seven violations above directly. Work through it in order — the first five steps eliminate the highest-risk exposure.

1. Publish a compliant privacy policy that covers all nine Article 13 elements: controller identity, purposes, legal bases, third-party recipients, international transfers, retention periods, data subject rights, right to complain, and whether provision of data is obligatory. See our guide on GDPR privacy policy requirements for the exact template language.
2. Audit your cookie setup and implement a consent management platform that makes accepting and rejecting cookies equally easy. Do not set non-essential cookies before consent is given.
3. Review your email marketing list and verify that every subscriber has a documented consent record — when they subscribed, via which mechanism, and to what they consented. If you cannot document it, do not email them.
4. Map your international data transfers — identify every third-party service that processes EU personal data in a non-adequate country (including most US-based services) and confirm that Standard Contractual Clauses are in place.
5. Sign Data Processing Agreements with every processor: hosting provider, analytics platform, email marketing service, payment processor, CRM, and support tool.
6. Create a Subject Access Request procedure — designate an email address, set a calendar reminder for the 30-day response window, and document each request in a log.
7. Implement a data breach response plan — establish who is responsible for assessing a breach, when the supervisory authority must be notified (within 72 hours of becoming aware), and how to document the incident.
8. Review employee data practices — ensure that HR files contain only data that has a documented legal basis, that employees have been given GDPR-compliant privacy notices, and that any monitoring (email, CCTV, device tracking) is disclosed and proportionate.
9. Set retention schedules for each data category you hold and implement a process to actually delete data when the retention period expires. An undeletable 10-year-old contact form submission is a violation waiting to be discovered.
10. Conduct an annual review — GDPR compliance is not a one-time project. Update your privacy policy when you add new tools, re-verify consent records annually, and document your review process.

Sources: EU Regulation 2016/679 (GDPR); EDPB fine tracker; Irish DPC decision in Meta case (May 2023); Luxembourg CNPD decision in Amazon case (July 2021); Irish DPC decision in WhatsApp case (September 2021); Irish DPC decision in TikTok case (September 2023); CNIL decision in Google/YouTube case (January 2022); Hamburg DPA decision in H&M case (October 2020); ICO decision in British Airways case (October 2020); CNIL decision in Clearview AI case (October 2022); NAIH decision in Hungarian real estate case (2023).