GDPR fines hit €225 million in Q2 2026 despite strict regulations
DUBAI, United Arab Emirates, Aug. 20, 2026 (GLOBE NEWSWIRE) -- The General Data Protection Regulation (GDPR)
Press Release Disclaimer: This is a press release distributed through the XPR Media network. It has not been independently verified by our newsroom.
DUBAI, United Arab Emirates, Aug. 20, 2026 (GLOBE NEWSWIRE) — The General Data Protection Regulation (GDPR) enforcement authorities have issued €225,879,175 ($260.59 million) worth of fines in the second quarter of 2026, according to new research from Finbold.
The value of GDPR fines jumped by roughly 230% quarter-over-quarter from €68.18 million ($73.63 million) in the first quarter, bringing the H1 2026 total to around €295 million ($340.5 million).
During the second quarter, companies in violation of GDPR guidelines on average paid €2.48 million ($2.86 million) in penalties per day, or €17.36 million ($20.02 million) per week.
The Netherlands recorded the highest total at €100.25 million ($115.64 million), accounting for nearly 49% of all penalties in the European Union (EU).
France was the second most fined country, with €52 million ($59.98) in fines. Italy ranked third with €45.50 million ($52.47 million), followed by the United Kingdom (U.K.) with €18 million ($20.76 million).
Jordan Major, Chief Editor at Finbold, said: “The scale of the increase in Q2 shows that GDPR enforcement remains a material financial risk for companies operating in Europe. What stands out is not only the size of the penalties, but how quickly the total accelerated from one quarter to the next, with a handful of major cases accounting for a significant share of the overall figure.”
The €100 million fine in the Netherlands was imposed on Ridetech International B.V. for failing to implement adequate guarantees for the transfer of personal data into a third country.
In Italy, Intesa Sanpaolo S.p.A. was fined €31.8 million ($36.68 million) over shortcomings in the protection of customers’ banking data.
France followed with a €27 million ($31.14 million) fine against FREE MOBILE and a €15 million ($17.3 million) fine against its parent company FREE over a major data breach.
In the U.K., Reddit was fined €16.61 million ($19.16 million) after the Information Commissioner’s Office (ICO), the UK’s independent authority, found that the platform failed to implement an age-verification procedure.
Other notable Q2 penalties included €6.62 million ($7.64 million) and €5.88 million ($6.78 million) against Italy’s Poste Italiane and PostePay for banking application mismanagement, €5 million ($5.77 million) against France Travail due to cyberattacks, as well as €15 million ($17.3 million) against IQVIA Operations France for health data breaches.
The Polish company DPD Polska was also penalized with €2.68 million ($3.09 million) for not having a data processing agreement with the subcontractors.
Diana Paluteder, Head of Content at Finbold, said: “The data suggests that regulators are continuing to focus on core compliance failures rather than isolated technical breaches. The takeaway is that data governance, security controls, lawful processing and oversight of third parties need to be treated as ongoing operational priorities rather than box-ticking exercises.”
Security failures and lack of legal ground for data processing remain the most common guideline violations, accounting for virtually all of the major penalties.
Media and finance remain the most problematic sectors number-wise, each responsible for three of the ten largest fines, followed by transportation and energy, which accounted for two, including the largest one in the Netherlands.
Contact: Diana Paluteder
Dubai Silicon Oasis,
Dubai, UAE
Media gallery
