GDPR Fines 2025/26: Tracker and SME Reality Check

1. GDPR fines 2025/26: context and competence

Short answer: The highest amounts come from a small number of corporate proceedings — the realistic benchmark for SMEs is therefore not the maximum but the range opened by the specific duty infringed (section 2). The figure for the highest EU fine reflects the status of the first version of 2 May 2026.

DE/AT — who imposes sanctions, and what is added nationally? The fine ranges of Art. 83(4) and (5) GDPR apply equally in Germany and Austria. What differs is supervision and the national supplementary provisions: in Germany, the authorities competent under Länder law supervise non-public bodies (§ 40(1) of the German Federal Data Protection Act (BDSG)), while the Federal Commissioner for Data Protection (BfDI) is responsible for federal public bodies and certain telecommunications providers (§ 9(1) BDSG); in addition, § 43(2) and (3) BDSG penalises certain infringements as an administrative offence with up to EUR 50,000. In Austria, the Austrian Data Protection Authority (Datenschutzbehörde, DSB) is established as the national supervisory authority under Art. 51 GDPR (§ 18(1) of the Austrian Data Protection Act (DSG)); in addition, § 62(1) DSG provides for administrative penalties of up to EUR 50,000 in so far as the act is not already covered by Art. 83 GDPR.

Two filters follow from this for your own assessment: first, competence — German companies deal with the authority of the Land in which they are established, Austrian companies exclusively with the Datenschutzbehörde; second, the question of which duty was infringed, because that determines whether the EUR 20 million range is in play at all (section 2).

2. Which infringement triggers which fine range

Short answer: The GDPR has two ranges, and which one applies depends on the article infringed. Infringements of the principles of processing, of lawfulness, of the conditions for consent and of the special categories of data (Art. 5, 6, 7, 9 GDPR), as well as of the rights of the data subject (Art. 12 to 22 GDPR), fall, among others, under Art. 83(5) GDPR: up to EUR 20 million or 4% of the total worldwide annual turnover of the preceding financial year — paragraph 5 also covers infringements relating to third-country transfers (see the FAQ 'What is the maximum fine?'). Infringements of, among others, Art. 8, Art. 11, Art. 25 to 39, Art. 42 and Art. 43 GDPR — including all documentation, security and notification duties — fall under Art. 83(4) GDPR: up to EUR 10 million or 2%. In each case the higher of the two amounts applies.

The first four rows of the following table concern the EU-law range, the last two the national supplementary provisions that apply alongside Art. 83 GDPR:

In practice this means: a missing data processing agreement, incomplete records of processing activities or a failure to notify a Personal Data Breach sit within the EUR 10 million range of paragraph 4 — the blanket formula 'GDPR fine of up to EUR 20 million' is the wrong yardstick for these cases. Conversely, a cookie banner without valid consent is enough to land in the stricter range of paragraph 5, because the legal basis under Art. 6(1) GDPR and the conditions for consent under Art. 7 GDPR are then affected.

3. Top 10 fines 2025/26

Short answer: The ten largest proceedings are corporate cases and useless as an amount benchmark for SMEs — but they are very useful as a catalogue of infringement patterns. The ten rows cover seven patterns: third-country transfer without safeguards, targeting without consent, marketing calls, biometric processing without a legal basis, retention without a deletion policy, video and employee monitoring, and Personal Data Breach and access shortcomings. The same facts appear in SME proceedings on a smaller scale. The list reflects the status of the first version of 2 May 2026.

The lesson for your own practice: the infringements listed are for the most part not technical mishaps but decisions — and therefore visible in the documentation. Anyone who records the third-country transfer in the records of processing activities together with the safeguard, and keeps a dated deletion policy on file, holds exactly the evidence a supervisory authority asks for first (section 6).

4. SME fines: what actually happens in practice

Short answer: In SME practice, it is not the size of the company that determines the range but the duty infringed; within that range, the supervisory authority determines the fine in each individual case according to the criteria of Art. 83(2) GDPR. The allocation of typical triggers to company sizes in the following table is an experience value from the first version, not official statistics; the middle column names the statutory range.

The column 'Most frequent triggers' mixes both ranges: cookie banner, missing Privacy notice and refusal of access concern the legal basis, consent and data subject rights, and therefore Art. 83(5) GDPR; missing data processing agreements, weak TOMs, shortcomings in the records of processing activities, missing DPIA and delayed notifications lie within Art. 25 to 39 GDPR and therefore within the range of Art. 83(4) GDPR. For your own assessment, what counts is not headcount but open duties.

5. 7 typical mistakes that lead to fines

Short answer: Seven error patterns recur again and again in proceedings against SMEs — cookie banners without a genuine choice, missing data processing agreements, inadequate technical and organisational measures, refused or late responses to access requests, missing impact assessment, missing deletion policy and undocumented third-country transfers. The selection is a practice assessment by the editorial team, not official statistics.

1. Cookie banner without a genuine choice — CJEU C-673/17, tightened by CJEU C-621/22
2. Missing data processing agreements with cloud providers — typically: Microsoft 365 without the EU Data Boundary activated
3. Inadequate TOMs after a Personal Data Breach — after an incident the supervisory authority checks whether the protective measures in place beforehand were sufficient
4. Refusal of access under Art. 15 — response >1 month WITHOUT reasons for the extension
5. Missing DPIA for high-risk processing
6. No deletion policy (retention beyond all periods)
7. Third-country transfer without a TIA (Schrems II / DPF not documented)

The seven mistakes in detail: what to do and why

Each point names the specific measure, the reason and — where one exists — the provision. Statements without a legal reference are expressly marked as practitioner recommendations.

1. Cookie banner: Check whether consent is obtained before non-essential cookies are first set, and whether you can evidence it. In Germany, under the German Telecommunications-Digital-Services Data Protection Act (TDDDG), storing information on terminal equipment and accessing information already stored there is permitted only with consent on the basis of clear and comprehensive information (§ 25(1) TDDDG); without consent this is possible only where the sole purpose is carrying out the transmission of a message, or where access is strictly necessary in order to provide a digital service expressly requested by the user (§ 25(2) TDDDG). In Austria, § 165 TKG 2021 of the Austrian Telecommunications Act 2021 requires opt-in for tracking cookies. At GDPR level, the ability to demonstrate consent (Art. 7(1) GDPR) and an equally easy withdrawal (Art. 7(3) GDPR) are added. Practitioner recommendation: keep consent logs in a way that allows them to be traced back to a specific point in time and a specific banner version.
2. Data processing agreements: Reconcile the categories of recipients in your records of processing activities against your list of data processing agreements; every external service provider that processes personal data on your behalf needs a contract. Art. 28(1) GDPR permits cooperation only with processors providing sufficient guarantees of appropriate technical and organisational measures; Art. 28(3) GDPR sets out the minimum content: subject matter and duration of the processing, nature and purpose, type of personal data, categories of data subjects, and the obligations and rights of the controller.
3. Technical and organisational measures: Document the TOM concept with a date and before an incident — after a Personal Data Breach the supervisory authority examines the situation as it stood beforehand. Effective protective measures work twice over here: under Art. 34(3) GDPR they can also make communication to the data subjects unnecessary (section 7). A central TOM concept is sufficient; the records of processing activities need only refer to it, not reproduce its content.
4. Access under Art. 15: Respond without undue delay and in any event within one month of receipt of the request. The period may be extended by two months where the complexity and number of requests make this necessary — but the data subject must then be informed within the first month of the extension and the reasons for it (Art. 12(3) GDPR). It is precisely this notification that is most often missing in practice. Infringements of Art. 12 to 22 GDPR fall within the stricter range of Art. 83(5) GDPR.
5. Data protection impact assessment: Carry out the DPIA in advance where a type of processing — in particular using new technologies — is likely to result in a high risk to the rights and freedoms of natural persons, taking into account its nature, scope, context and purposes (Art. 35(1) GDPR). It is required in particular for a systematic and extensive evaluation of personal aspects, including profiling, on which decisions with legal effect are based, for processing on a large scale of special categories under Art. 9 GDPR, and for systematic monitoring of publicly accessible areas on a large scale (Art. 35(3) GDPR).
6. Deletion policy: Set deletion periods for each data category and document the conflict between retention obligations and the right to erasure. Practical reference points are the commercial and tax retention periods (10 years) and social-law periods (5 years); wherever a retention obligation stands in the way of erasure under Art. 17 GDPR, that conflict belongs in the documentation. Without defined periods, a mandatory entry in the records of processing activities is also missing.
7. Third-country transfer: List third-country transfers in the records of processing activities with the relevant safeguard in a separate column — standard contractual clauses, the Data Privacy Framework or binding corporate rules. Practitioner recommendation: record the assessment of each US tool in writing, so that when a request arrives you do not first have to reconstruct the basis on which the transfer operates.

6. Supervisory practice: what authorities actually check

Short answer: As observed in practice, supervisory proceedings usually begin with the records of processing activities and work through the remaining documentation from there in a typical order — processing on behalf of a controller, security measures, impact assessment, website information, cookie banner, Personal Data Breach workflow and training records.

Order in which supervisory authorities typically review, as seen in practice:

1. Production and plausibility check of the records of processing activities
2. List of data processing agreements (matching the recipients in the records)
3. TOM concept (matching the risk situation)
4. DPIA for high-risk processing
5. Privacy notice for the website
6. Cookie banner (testing the genuine choice)
7. Personal Data Breach workflow (tabletop exercise requested)
8. Training records

This order is an observation from practice, not a statutory procedural code. The statutory hook is narrower: under Art. 30(4) GDPR the records must be made available to the supervisory authority 'on request' — the provision names no deadline in days or weeks. In practice, supervisory authorities expect delivery within one to two weeks; anyone unable to deliver signals documentation shortcomings that shape the rest of the proceedings.

Three details often decide how the first round goes. First, the format: supervisory authorities work with editable files, and a PDF export without an Excel or CSV version makes review harder. Second, version control — without a date and version status it cannot be evidenced which version applied at the time of an incident. Third, consistency: recipients in the records without a matching data processing agreement, and third-country references without a documented safeguard, are the contradictions that become visible at steps 2 and 3. Records of processing activities, processing on behalf of a controller, security and notification follow directly from the GDPR and are identical in Germany and Austria; cookie banner review and employee data protection, by contrast, follow national provisions (section 9). Which escalation stages precede a fine notice, and where there is room to negotiate, is set out in the FAQ at the end of this article.

7. Personal Data Breaches: a common route into proceedings

Short answer: A Personal Data Breach triggers two separate duties — notification to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it (Art. 33(1) GDPR) and, only where the risk is likely to be high, communication to the data subjects (Art. 34(1) GDPR). Both duties lie within Art. 25 to 39 GDPR and therefore within the range of Art. 83(4) GDPR.

The duty to notify is dispensed with only where the breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where notification is not made within 72 hours, it must be accompanied by reasons for the delay — exceeding the deadline is therefore not a knock-out criterion, but the absence of reasons is a separate point of attack.

Communication to the data subjects is not required under Art. 34(3) GDPR where appropriate technical and organisational protective measures — in particular encryption — were applied, where the high risk no longer exists as a result of subsequent measures, or where communication would involve disproportionate effort; in the last case, a public communication takes its place.

Irrespective of this: every breach is documented, including one that is not notified (Art. 33(5) GDPR). The documentation must cover the time of occurrence and of becoming aware, a detailed description, the consequences and risk assessment, the measures taken and — where no notification was made — the reasons for that. The notification itself must cover the mandatory content of Art. 33(3) GDPR: a description of the breach, the approximate number of data subjects and records concerned, the categories of data, the likely consequences, the measures taken to address the breach and mitigate its effects, and the contact details of the data protection officer or of the controller.

Where notification goes differs: in Germany, non-public bodies notify the authority competent under Länder law (§ 40(1) BDSG); every Land operates its own notification portal — in Bavaria, for example, the Bavarian Data Protection Authority (BayLDA), while the Bavarian Data Protection Commissioner looks after the public sector. The BfDI accepts notifications only from federal public bodies and certain telecommunications providers (§ 9(1) BDSG), not from companies generally. In Austria, Art. 33 GDPR applies in identical wording; the addressee is the Datenschutzbehörde (§ 18(1) DSG).

Which circumstances after a breach influence the decision on a fine and its amount is laid down in Art. 83(2) GDPR — the supervisory authority takes them into account in each individual case. The examples in the middle column are explanations by the editorial team:

For preparation, this means: encryption, fast notification and demonstrable cooperation are circumstances that can be taken into account in the controller's favour when the fine is assessed; affected special categories under Art. 9 GDPR and missing protective measures point the other way. None of the criteria sets a specific amount — the decision is taken in each individual case.

8. 14 documents supervisory authorities expect

Short answer: Fourteen documents cover the evidence that supervisory authorities ask for in practice; twelve of them can be traced directly to a provision, while for the deletion policy and the third-country transfer assessment only the documentation entry is prescribed by law, the methodology being practice standard. The following table sets out both separately and names the points at which Germany and Austria differ.

1. Records of processing activities (Art. 30)
2. TOM concept (Art. 32)
3. List of data processing agreements covering all processors
4. DPIA methodology + threshold analysis
5. Personal Data Breach response plan + 72h notification template
6. Deletion policy (DIN 66398-compliant)
7. DPO designation document (where required)
8. Privacy notice for the website
9. Privacy notice for applicants and employees
10. Cookie and consent concept (TDDDG-compliant)
11. Third-country transfer TIA (Schrems II)
12. Training concept + attendance records
13. Confidentiality undertaking (Art. 28(3)(b), Art. 32(4) GDPR)
14. Access-request workflow (Art. 15-22)

Sources and DE/AT differences for each document

Two rows depend on the country: in row 7 the duty to designate arises earlier in Germany, because § 38(1) BDSG expressly applies 'in addition to Article 37(1)(b) and (c)' GDPR — a business with 20 employees constantly engaged in automated processing must designate a DPO in Germany, whereas in Austria it need not without an Art. 37 trigger. In row 9, Austria has no provision corresponding to § 26 BDSG; monitoring measures that touch upon human dignity require a works agreement there under § 96(1) no. 3 of the Austrian Labour Constitution Act (ArbVG).

9. Austria: same range, different practice

Short answer: In Austria the same EU-law fine ranges under Art. 83 GDPR apply as in Germany, but with a different supervisory architecture and its own supplementary provisions: the Datenschutzbehörde alone is competent (§ 18(1) DSG), § 11 DSG provides for the proportionate application of Art. 83 GDPR and, in particular for first-time infringements, a warning instead of a fine, and the administrative penalty under § 62(1) DSG applies only on a subsidiary basis (section 2).

The Datenschutzbehörde is a central federal authority based in Vienna (Barichgasse 40-42, dsb.gv.at); an online complaints form is available. This differs from Germany, where supervision is split between the authorities competent under Länder law for non-public bodies (§ 40(1) BDSG) and the BfDI for federal bodies and certain telecommunications providers (§ 9(1) BDSG). The German BDSG does not apply in Austria; neither § 43 BDSG nor the 20-person threshold of § 38(1) BDSG applies there.

The maximum ranges of Art. 83(4) and (5) GDPR are identical to the German ones; § 11 DSG does not change the range but its application in the individual case. In repeat or serious cases, the full ranges remain in play.

Four Austrian special topics have direct relevance for fines:

Practitioner recommendation for companies with sites in both countries: do not maintain document sets as a 'DACH template', but keep them separate by jurisdiction. Records of processing activities, processing on behalf of a controller, security and notification follow directly from the GDPR and are identical; the supervisory addressee, the complaints body named in the Privacy notice, the video surveillance concept and employee data protection are not.

10. Compensation under Art. 82 — escalating

Short answer: Alongside the administrative fine there is a second, independent cost risk: civil claims for compensation by data subjects under Art. 82 GDPR, which add up to substantial sums where many people are affected.

Alongside supervisory fines: civil compensation claims under Art. 82 GDPR. CJEU C-340/21 (Dec. 2023): compensation for non-material damage arises from the mere 'fear' of misuse. For the risk assessment:

• Individual compensation: Art. 82 GDPR names no amounts; the courts assess the amount in the individual case
• Many data subjects: the individual claims add up, and the risk grows with the number of people affected
• The EU Representative Actions Directive allows qualified consumer organisations to sue on behalf of many

What matters most for preparation is that both sets of proceedings draw on the same evidence: whatever is submitted in the supervisory proceedings on protective measures, notification timing and risk assessment is also the basis in civil proceedings. The documentation under Art. 33(5) GDPR should therefore be created immediately after the incident, not retrospectively.

11. 9-step checklist for avoiding fines

Short answer: Nine recurring review steps cover the duties at which proceedings typically start — eight of them are tied to a provision; the annual DPO activity report is a practitioner recommendation.

1. Records audit: are all processing operations documented?
2. Inventory of data processing agreements: are all external service providers covered contractually?
3. TOM review: appropriate to the risk situation?
4. DPIA for all high-risk processing
5. Personal Data Breach tabletop exercise every six months
6. Cookie banner tested with the consent tool
7. Third-country transfer TIA for all US tools
8. Employee training annually + onboarding
9. DPO activity report to management

Frequency and character of each step

The column 'Character' separates what the provision itself requires from what has proven useful in practice. The intervals in the 'Frequency' column are practitioner recommendations throughout; the only timing prescribed by law in this table is that of two steps — the prior obligation for the impact assessment (Art. 35(1) GDPR) and the 72-hour notification (Art. 33(1) GDPR).

One point that does not appear in the list but regularly triggers proceedings: the vacant data protection officer position — see the FAQ at the end of the article.