GDPR Fines 2025–2026: Real Cases & What Small Businesses Must Know

GDPR enforcement isn't slowing down — it's accelerating. Here are the major fines from 2025–2026, the exact violations that triggered them, and the practical steps that would have prevented each one.

Why This Matters for Small Businesses

A common misconception is that GDPR fines are reserved for tech giants — the Meta, Google, Amazon variety of violations. The data tells a different story. In 2024 and 2025, data protection authorities across the EU issued over 1,800 fines, with a significant proportion targeting small and medium-sized businesses. Regulators have explicitly said that size is not a shield.

The enforcement model has also shifted. Where early GDPR enforcement was complaint-driven, regulators now conduct proactive audits — particularly targeting cookie consent practices, data subject rights handling, and privacy notice completeness. If your website is publicly accessible from the EU, you are in scope.

Notable GDPR Enforcement Cases (2025)

The following cases illustrate the breadth of enforcement — from large enterprises to small operators. The violations are often straightforward; the fines are not.

The Five Most Common GDPR Violations (and How to Fix Them)

1. Non-compliant cookie banners

This is the #1 cited violation in enforcement actions. A compliant cookie banner must: appear before any non-essential scripts load, make rejection as easy as acceptance, and provide granular consent options (at minimum: essential, analytics, marketing).

2. Inadequate or missing privacy policies

GDPR Article 13 lists exactly what your privacy notice must contain: identity of the data controller, purposes and legal basis for processing, data retention periods, recipients of data, and user rights. Most free-generated policies miss at least 2-3 of these.

3. No mechanism to handle data subject requests

Users have the right to access, correct, delete, or export their data. You must have a clear process for receiving and responding to these requests within 30 days. A simple contact email specifically for privacy requests is the minimum.

4. Missing data processing agreements

As illustrated above: any third party that processes personal data on your behalf requires a signed DPA. This includes your hosting provider, email marketing tool, payment processor, analytics platform, and customer support software.

5. No breach notification process

If personal data is compromised, GDPR requires notifying your supervisory authority within 72 hours. Many small businesses have no plan in place. You don't need a complex incident response team — you just need a documented procedure and a contact at your local DPA.

The Minimum Viable Compliance Baseline

You don't need enterprise-grade compliance infrastructure. For most small businesses and solo operators, the following baseline covers the majority of enforcement risk:

• ✓ Privacy Policy — Covers what data you collect, why, legal basis, retention periods, subprocessors, and user rights. Must be publicly accessible.
• ✓ Compliant Cookie Banner — Blocks all non-essential scripts before consent, equal accept/reject prominence, granular categories.
• ✓ Data Processing Agreement — Signed with every third-party tool that processes user data. Most major providers (Stripe, AWS, Google, Mailchimp) publish standard DPAs you can countersign.
• ✓ Terms of Service — Defines the relationship with users, limits your liability, and sets expectations for use of your product or service.
• ✓ Data Subject Rights Process — A documented way for users to request access, correction, or deletion of their data. An email address + 30-day response commitment is the minimum.

What Happens If You're Investigated

If a user files a complaint or a DPA initiates an audit, the sequence typically looks like this:

1. Initial inquiry — The DPA contacts you requesting documentation of your data practices.
2. Review period — You have a window (usually 30–90 days) to respond with evidence of compliance measures.
3. Remediation — If deficiencies are found, you're given a chance to fix them before a formal decision.
4. Fine or reprimand — If the violation was serious or you failed to remediate, a formal decision with a fine or public reprimand is issued.

Having proper documentation in place before step 1 is your best defense. Most DPAs are not looking to make examples of small businesses — they want to see good faith effort toward compliance. A proper privacy policy and consent mechanism demonstrates that.

Key Takeaways

• GDPR enforcement applies to any business serving EU users, regardless of company location.
• Cookie consent and privacy policy issues are the most commonly cited violations — and the easiest to fix.
• The €20M maximum fine is for serious violations; most SMB fines are in the €5,000–€100,000 range.
• Good faith compliance efforts significantly reduce risk — investigators look at whether you tried.
• The cost to get compliant is a tiny fraction of even the smallest fine.

This article is for informational purposes only and does not constitute legal advice. Regulations change frequently; consult a qualified attorney for guidance specific to your situation. All fine figures are based on publicly available DPA decisions as of March 2026.