Data Protection Fines Statistics (2026)

How much regulators fine companies for privacy and security failures, which cases set the totals and how fines compare with the number of people affected.

By Siddharth ShankarUpdated October 12, 202632 statistics · 10 sourcesCite this page

Key takeaways

• GDPR fines were about €1.2 billion in 2025, closely matching 2024, and €7.1 billion cumulatively to January 10, 2026 (DLA Piper).
• A few decisions dominate. Ireland’s fines in 2025 were just over €530.77 million, and the TikTok decision alone was €530 million, about 99.9% of that total (our calculation) (DPC).
• Breach notifications keep climbing: DLA Piper counted 443 a day across Europe, up from 363, an increase of 22%.
• UK fines in the cases we verified ranged from £1.2 million (LastPass UK) to £14.47 million (Reddit), with Capita at £14 million.
• Fines are small per affected person. Capita’s works out to about £2.12 for each of 6.6 million people (our calculation). Australia’s first Privacy Act penalty, A$5.8 million, is about A$26 for each of 223,000+ people.

Europe: DLA Piper GDPR survey

DLA Piper’s annual survey compiles GDPR fines and breach notifications across European countries. Its January 2026 edition covers fines to January 10, 2026 and breach notifications from January 28, 2025 to January 27, 2026.

Ireland: Data Protection Commission

The Data Protection Commission (DPC) is Ireland’s data protection regulator. Its 2025 annual report was published on June 30, 2026.

United Kingdom: Information Commissioner’s Office

The ICO found that Reddit had no lawful basis for processing the data of under-13s, had not carried out a data protection impact assessment until January 2025 and had no effective age checks until July 2025 (ICO). The ICO’s release was updated on April 1, 2026 to record that Reddit has appealed to the First-tier Tribunal, so the outcome may change. Our case write-up of the Capita fine explains the breach.

Australia and California

The OAIC release does not name the currency for the $5.8 million; the case is Australian, and we label it A$. The Australian Clinical Labs breach followed a February 2022 attack on Medlab Pathology. See our case write-up for the details.

For how the California cases fit together, see the data broker statistics page: data broker and people-search statistics.

Methodology and limitations

Every figure on this page comes from the organization that published it, such as a regulator, a government agency or the original report. We read the source page or document directly, and we record the period each figure covers. When a number could not be confirmed against a primary source, we left it out. Rows marked “Our calculation” are simple arithmetic on published figures, and the inputs are named in the same row.

• Fines depend on each regulator’s powers and on legal appeals. Some of the penalties above are under appeal or subject to later change.
• DLA Piper’s totals are its own compilation of publicly reported fines and are not a complete count.
• We did not find a primary-source total for ICO penalties since 2023, so we do not cite one. Third-party analyses exist but are single-source and are excluded.
• Per-person figures divide a fine by the number of people the regulator says were affected. They illustrate the scale, not the harm, and use “up to” or “more than” counts, so the true figures vary.

Counts of reports, complaints and notifications measure what was reported or notified, not everything that happened. Currency symbols follow the source. Where an agency does not name its currency, we show the symbol the source uses (for example, C$ for Canada and A$ for Australia are our labels). Figures from different countries use different definitions and should not be added together. Spot an error? Tell us and include the source link; we correct verified errors and note the date at the top of the page.