Anaelle Guez
Co-founder & CEO, Compliance
GDPR Enforcement by Country: Fines and Trends in 2026
Seven years after GDPR took effect, enforcement varies dramatically across EU member states. Here's the 2026 landscape.
The enforcement leaders
Ireland's DPC has issued the largest individual fines, including Meta's record €1.2 billion penalty in 2023. France's CNIL and Italy's Garante are the most prolific enforcers by volume. Spain's AEPD leads by number of enforcement actions, though typically at lower fine amounts.
Ireland (DPC): €2.8B+ total fines, focused on Big Tech
France (CNIL): €500M+ total, active across all sectors
Italy (Garante): €400M+ total, strong on telemarketing
Germany (16 DPAs): €150M+ total, decentralized
Spain (AEPD): Highest number of decisions
2026 enforcement trends
Three patterns define GDPR enforcement in 2026: AI and automated decision-making are under the spotlight, the EDPB's coordinated enforcement framework is producing more cross-border cases, and smaller DPAs in Central and Eastern Europe are becoming more active. Cleo tracks enforcement across all 27 EU DPAs and alerts your team when decisions may affect your operations.
Frequently asked questions
Which country has issued the highest GDPR fines?
Ireland's DPC has issued the largest individual GDPR fines (Meta, €1.2B in 2023), while France's CNIL and Italy's Garante are the most active enforcers by volume.
Related resources
Solutions
Product Compliance SolutionGuides
GDPR Compliance GuideTry Cleo: free regulatory risk scan
See your regulatory landscape mapped in minutes. No signup, no credit card.
