All news
Enforcement June 12, 2026 5 min

GDPR fines top EUR 7.1 billion: enforcement accelerates and SMEs are not exempt

Over 60% of fines came after January 2023. Authorities reward those who DEMONSTRATE implemented controls, not those with policies in a drawer

TL;DR for the DPO

Industry trackers (DLA Piper, Enforcement Tracker) put cumulative GDPR fines since 2018 above EUR 7.1 billion across 1,400+ decisions. Over 60% came after January 2023. Article 6 legal-basis violations alone account for about a third of actions.

Myth: 'fines only hit the giants'

False. A significant share of fines hit small organisations: local providers, agencies, small software houses. Absolute amounts are lower, but severity is proportional. SMEs are exactly the external DPO's typical client.

Key criterion: IMPLEMENTED controls

Fine-calculation guidelines reward demonstrable, active technical measures. Fragmented logs across disconnected systems are not audit-ready evidence.

Official source:DLA Piper GDPR Fines and Data Breach Survey (Jan 2026)

Looking for a workspace for your DPO work?

DPO Workspace is built by a certified DPO. 30-day free trial.

Start free

Related articles

Enforcement
€16,7Mfor telemarketing and contracts activated without consent

Italian DPA fines Wind Tre €16.7 million: telemarketing despite objections and contracts activated without customers' knowledge

People who had objected kept receiving calls, and some contracts were activated without the person knowing. The Garante fines Wind Tre €16.7 million and restates a principle for every company with an agency network: responsibility is not outsourced along with sales.

Oct 12, 2026New 5 min
Enforcement
€350kto controller and processor over outdated systems

Greece: €350,000 for a data breach — both the Ministry and the processor running outdated systems fined, and there was no Article 28 contract

An attack on the systems of the agency running a Ministry's programmes exposed identification, financial and health data of a very large number of people. The Hellenic DPA fines the controller €200,000 and the processor €150,000: notifying well is not enough if the supplier works on outdated systems and the relationship is not governed by a contract.

Oct 08, 2026New 5 min
Enforcement
€4kfor a camera pointed at a home

Italian DPA fines the municipality of Arvier €4,000: a camera filmed a resident's windows and balconies, and the masking came too late

A small municipality in the Aosta Valley uses cameras for traffic, parking, number plates, the environment and civil protection. A resident finds that one covers her home. The Garante imposes a fine and makes a point that applies to every system: masking private areas is designed before the camera is switched on, not after the complaint.

Oct 08, 2026New 5 min