Frequently Asked Questions: GDPR fines

Fines under the GDPR are imposed by supervisory authorities for violations of the General Data Protection Regulation. This means that only if a controller disregards the provisions of the GDPR can a fine be imposed on them.

Examples can be:

• 1. Lack of Lawful Basis for Processing Personal Data (Art. 5(1)(a) GDPR)

  Real-world example: A Meta (Facebook, Instagram) was fined €390 million for attempting to rely on contractual necessity as a legal basis for processing user data for personalized advertising, when regulators deemed it should have been based on consent.

• 2. Failure to Obtain Valid Consent (Art. 6(1)(a) and Art. 7 GDPR)

  A website uses pre-ticked boxes for cookies, or buries consent options deep within its privacy policy, making it difficult for users to genuinely opt-in. As an example: Amazon Europe was fined €746 million for failing to obtain proper “freely given” consent for the use of advertising cookies.

• 3. Insufficient Technical and Organizational Measures to Ensure Security (Art. 32 GDPR)

  A company experiences a data breach due to weak security protocols, unpatched software, or lack of encryption for sensitive data. British Airways was fined £20 million after a cyberattack exposed customer data due to the company’s negligence in maintaining its security practices.

Fines under the GDPR are generally imposed by the relevant supervisory authority. In Germany, this is usually the respective state data protection commissioner. A list of state data protection authorities with contact details can be found at the Federal Commissioner for Data Protection and Freedom of Information (in German short: BfDI).

No. In accordance with recital 148 of the GDPR, the supervisory authority may also issue a warning in the case of minor infringements. This was clarified by the supervisory authorities in the Article 29 Data Protection Working Party in WP 254 rev. 1, p. 9.

Fines under the GDPR are calculated based on Guidelines 02/2022 of the European Data Protection Board (EDPB). The EDPB is responsible for adopting such guidelines under Article 70(1)(k) of the GDPR. The guidelines for fines were adopted in version 2.1 on May 24, 2023.

Legally, the guidelines are not binding on supervisory authorities. However, since the EDPB is the cooperation body of the national data protection authorities, they are in fact highly relevant. We have a whole page explaining the method how such fines are calculated.

No, there is no central list of all GDPR fines. The activity reports of the supervisory authorities may provide some insight. The State Commissioner for Data Protection and Freedom of Information in North Rhine-Westphalia, Germany, for example, publishes annual activity reports. The current report of the Federal Commissioner for Data Protection and Freedom of Information (2024) can also provide guidance. In addition, the law firm CM/S attempts to collect information on specific fines in its EnforcementTracker.

However, it must be assumed that the number of fines actually imposed is significantly higher. From the perspective of the supervisory authorities, too much transparency regarding fines is probably not desirable – if those responsible are uncertain about the specific amount of fines to be expected, this may, under certain circumstances, increase the deterrent effect of possible fines.

If you have been fined under the GDPR, you can seek legal representation. Competent legal advice often pays off, especially in the case of higher fines, and fines can be averted or reduced. You can consult a lawyer at any stage of the proceedings.

Your internal or external data protection officer can also support you in the event of a fine imposed on your organization and provide you with advice.

The European Data Protection Board (EDPB) is a body established under Article 68 of the GDPR. It is composed of the heads of the member states’ supervisory authorities and the European Data Protection Supervisor (Article 68 (3) GDPR). If there are multiple supervisory authorities in a member state – as is the case in Germany, for example – that member state must appoint a representative. Germany has designated the Federal Commissioner for Data Protection and Freedom of Information as this representative in Section 17 (1) Sentence 1 of the Federal Data Protection Act (BDSG).

The EDPB’s task is to ensure the consistent application of the GDPR within the European Union. Numerous individual tasks are assigned to this purpose in Article 70 (1) GDPR. These tasks include, for example, under Article 70 (1) (k) “the development of guidelines for supervisory authorities on the application of measures pursuant to Article 58 (1), (2), and (3) and the imposition of fines pursuant to Article 83.”