Your cookie preferences

EDPB guidance · Art. 7 GDPR

We use technical cookies essential for the platform to work (login, security, sessions). We would also like to use analytics cookies to understand how to improve it.

You can accept all, reject all, or choose which categories to switch on.Your consent is valid for 6 months and you can withdraw it at any time from the footer.

You will find everything in our privacy notice.

All news
Enforcement June 12, 2026 5 min

GDPR fines top EUR 7.1 billion: enforcement accelerates and SMEs are not exempt

Over 60% of fines came after January 2023. Authorities reward those who DEMONSTRATE implemented controls, not those with policies in a drawer

TL;DR for the DPO

Industry trackers (DLA Piper, Enforcement Tracker) put cumulative GDPR fines since 2018 above EUR 7.1 billion across 1,400+ decisions. Over 60% came after January 2023. Article 6 legal-basis violations alone account for about a third of actions.

Myth: 'fines only hit the giants'

False. A significant share of fines hit small organisations: local providers, agencies, small software houses. Absolute amounts are lower, but severity is proportional. SMEs are exactly the external DPO's typical client.

Key criterion: IMPLEMENTED controls

Fine-calculation guidelines reward demonstrable, active technical measures. Fragmented logs across disconnected systems are not audit-ready evidence.

Official source:DLA Piper GDPR Fines and Data Breach Survey (Jan 2026)

Looking for a workspace for your DPO work?

DPO Workspace is built by a certified DPO. 30-day free trial.

Start free

Related articles

Enforcement
26complaints, and no fine

You declare contract, then you reject the objections: Norway shows how the two mistakes travel together

SATS asked members for a photo kept in the membership system and used at the desk to check the identity of people coming in. Datatilsynet found the notice stated the wrong legal basis, failed to explain the right to object, and that objections were rejected without demonstrating compelling legitimate grounds. The deadline to fix it is 11 September 2026.

Aug 26, 2026New 6 min
Enforcement
825 mln €the second-largest fine ever

Eight hundred and twenty-five million for an algorithm that deactivated accounts with nobody looking

It is the second-largest fine ever imposed under the GDPR, behind only Meta's 1.2 billion. It is not about a data transfer or a security breach: it is about Article 22, the rule on automated decisions that almost nobody documents because it looks like a big-platform problem. It is in fact about anyone who lets software decide something that weighs on a person's life.

Aug 24, 2026New 5 min
Enforcement
64 mln złagainst 14 the year before

Poland quadrupled its fines in a year, and the three highest ever all date from 2025

For years Poland was treated as a low-enforcement market. That assumption no longer holds: in twelve months the total went from fourteen to over sixty-four million zloty, and the three largest fines in the country's history all carry the same year. If you look after a client with a branch, a supplier or a service centre in Poland, the risk calculation has changed.

Aug 24, 2026New 4 min