Which country has issued the highest GDPR fines?

Ireland's DPC has issued the largest individual GDPR fines (Meta, €1.2B in 2023), while France's CNIL and Italy's Garante are the most active enforcers by volume.

GDPR Enforcement by Country: Fines and Trends in 2026

Seven years after GDPR took effect, enforcement varies dramatically across EU member states. Here's the 2026 landscape.

The enforcement leaders

Ireland's DPC has issued the largest individual fines, including Meta's record €1.2 billion penalty in 2023. France's CNIL and Italy's Garante are the most prolific enforcers by volume. Spain's AEPD leads by number of enforcement actions, though typically at lower fine amounts.

Ireland (DPC): €2.8B+ total fines, focused on Big Tech

France (CNIL): €500M+ total, active across all sectors

Italy (Garante): €400M+ total, strong on telemarketing

Germany (16 DPAs): €150M+ total, decentralized

Spain (AEPD): Highest number of decisions

2026 enforcement trends

Three patterns define GDPR enforcement in 2026: AI and automated decision-making are under the spotlight, the EDPB's coordinated enforcement framework is producing more cross-border cases, and smaller DPAs in Central and Eastern Europe are becoming more active. Cleo tracks enforcement across all 27 EU DPAs and alerts your team when decisions may affect your operations.

Frequently asked questions

Which country has issued the highest GDPR fines?: Ireland's DPC has issued the largest individual GDPR fines (Meta, €1.2B in 2023), while France's CNIL and Italy's Garante are the most active enforcers by volume.