The average GDPR fine leveled off at roughly EUR 2.28 million per case in 2026, according to CMS's GDPR Enforcement Tracker Report 2025/2026, published 21 May 2026 and built from 2,685 documented fines with a disclosed amount through a 1 March 2026 cutoff. That average, though, is not what a typical fined company pays: CMS's own report describes it as "heavily influenced by a comparatively small number of exceptionally large fines" against household-name platforms.
This post breaks that headline number apart: where the EUR 2.28 million figure comes from, how much a handful of billion-euro fines distort it, how it compares against a rival tracker's count, and how far it sits below GDPR's actual statutory ceiling.
What is the average GDPR fine in 2026?
CMS's GDPR Enforcement Tracker Report 2025/2026 puts the average GDPR fine at EUR 2,277,122 (about EUR 2.28 million), calculated across the 2,685 fines in its database that carry a publicly disclosed amount, out of 3,062 total tracked cases. For the first time since the report launched, cumulative documented fines passed the EUR 6 billion mark, reaching EUR 6.11 billion, an increase of EUR 487.6 million over the prior edition.
That average is a simple division: total documented value divided by case count. It says nothing about what any individual company is likely to pay, which is the distinction the rest of this post exists to explain.
Why does a EUR 2.28 million average not match what most companies pay?
A handful of record-setting fines against large platforms pull the average far above what a typical enforcement action actually costs. CMS's report language is explicit about this: the average fine is "heavily influenced by a comparatively small number of exceptionally large fines," not a representative midpoint.
Figure 1: Why the average diverges from the typical fine. Source: CMS GDPR Enforcement Tracker Report 2025/2026.
The single largest fine on record, EUR 1.2 billion against Meta Platforms Ireland Limited, issued by Ireland's Data Protection Commission in May 2023, is roughly 527 times the average and on its own accounts for close to a fifth of the entire EUR 6.11 billion documented total. Nine of the ten largest individual GDPR fines were issued by Ireland's regulator, which handles Meta, TikTok, and LinkedIn under GDPR's one-stop-shop mechanism. Remove that top tier of platform-scale fines and the number a typical mid-size or small organization faces drops considerably below the headline average.
How does the average fine compare to GDPR's statutory caps?
Article 83 of GDPR sets two statutory ceilings: EUR 10 million or 2% of global annual turnover for lower-tier infringements, and EUR 20 million or 4% of turnover for higher-tier ones, whichever is greater in each case. The EUR 2.28 million average sits well under both flat euro caps.
Figure 2: The average fine against Article 83's two statutory caps. Source: GDPR Article 83; CMS GDPR Enforcement Tracker Report 2025/2026.
At EUR 2.28 million, the average fine is about 23% of the EUR 10 million lower-tier cap and roughly 11% of the EUR 20 million higher-tier cap. That gap shows regulators are not defaulting to the statutory maximum in most cases; they scale the fine to the severity, duration, and intent behind each specific violation. A business that keeps its privacy disclosures current, including a clear legal basis and data-transfer statement, addresses exactly the categories CMS's report lists as the most common drivers of fines: insufficient legal basis for processing, non-compliance with general data-processing principles, and weak technical or organizational security measures. You can generate a GDPR-ready privacy policy that covers those disclosures directly.
Do all GDPR trackers agree on the average fine?
No. The two most-cited public trackers count different case sets and land on different averages. CMS's 2,685 documented cases imply EUR 2.28 million per case; enforcementtracker.com's larger set of 3,202 recorded actions, worth EUR 6.31 billion in total, implies an average of about EUR 1.97 million, roughly 14% lower.
Figure 3: Implied average fine per case, CMS versus enforcementtracker.com. Source: CMS GDPR Enforcement Tracker Report 2025/2026; enforcementtracker.com, checked July 2026.
| Tracker | Documented total | Cases counted | Implied average |
|---|---|---|---|
| CMS GDPR Enforcement Tracker Report | EUR 6.11 billion | 2,685 | EUR 2.28 million |
| enforcementtracker.com | EUR 6.31 billion | 3,202 | EUR 1.97 million |
| DLA Piper GDPR Fines and Data Breach Survey | EUR 7.1 billion | Not disclosed per case | Not calculable |
enforcementtracker.com's lower implied average makes sense given its larger case count: it picks up more smaller, lower-value fines than CMS's more tightly scoped dataset, which pulls its per-case average down even though its total documented value is slightly higher. DLA Piper's January 2026 survey reports the highest cumulative total, EUR 7.1 billion, but does not publish a matching per-case count, so no average can be calculated from it. For a full breakdown of how all three trackers' cumulative totals compare, see our companion post on total GDPR fines since 2018.
How much of the tracked total is actually documented?
CMS tracks 3,062 GDPR enforcement cases in total, but only 2,685 of them, about 88%, carry a disclosed fine amount that its EUR 6.11 billion total and EUR 2.28 million average are calculated from. The remaining 377 cases are known enforcement actions where a fine was not publicly confirmed with a specific figure.
Figure 4: Documented versus undocumented cases behind the CMS tracker's headline total. Source: CMS GDPR Enforcement Tracker Report 2025/2026, cutoff 1 March 2026.
That gap is not a data error; it reflects genuine disclosure inconsistency across EU and EEA regulators, some of which announce that a fine was issued without publishing the amount. It also means the true average, if every fine amount were disclosed, could differ meaningfully from EUR 2.28 million in either direction.
How has the average fine changed since GDPR took effect?
Cumulative totals have climbed steadily since GDPR took effect on 25 May 2018, but the average fine per case has moved less dramatically, settling into a narrower band over the past two report editions after climbing sharply in the first several years.
Figure 5: Cumulative totals and the average fine at each CMS report milestone. Source: CMS GDPR Enforcement Tracker Report, 2023, 2024, and 2025/2026 editions.
At the five-year mark in 2023, CMS reported EUR 2.7 billion spread across more than 1,500 documented cases, an implied average at or below EUR 1.8 million per case. By the 2025/2026 edition, the average had risen to EUR 2.28 million even as the annual pace of new fines held roughly flat: 2025's total of about EUR 1.2 billion, per DLA Piper's January 2026 survey, matched 2024's figure rather than accelerating past it.
Which countries and sectors pull the average up or down?
Country and sector matter more to a company's realistic fine exposure than the headline average does. Spain has issued the most individual fines of any country for a seventh consecutive year, 1,048 of the 2,685 documented cases, but CMS's own breakdown notes that Spain's average fine runs significantly lower than most other countries, a pattern consistent with a high volume of smaller enforcement actions rather than platform-scale penalties. Ireland, by contrast, issues far fewer fines but at far higher individual value, since it is the lead regulator for Meta, TikTok, and LinkedIn under GDPR's one-stop-shop rule.
By sector, CMS's case-level breakdown shows Media, Telecoms and Broadcasting and Employment recording the highest average fine per case, while Industry and Commerce logs the largest number of individual cases. The most common violation categories driving fines, regardless of sector, are insufficient legal basis for processing, non-compliance with general data-processing principles, and insufficient technical or organizational security measures, the same categories a current privacy policy and consent flow are built to address. Two related questions worth tracking as this cluster grows: which single fine holds the all-time record, and how the year-by-year fine total has moved since 2018.
The Bottom Line
The EUR 2.28 million average GDPR fine is a real, sourced figure, but it answers a narrower question than most readers assume. It tells you what EUR 6.11 billion divided by 2,685 documented cases equals, not what a typical small or mid-size business is likely to face if a regulator finds a violation. A single EUR 1.2 billion fine against Meta accounts for roughly a fifth of the entire documented total, Spain's high case count skews toward smaller penalties, and even the full average sits at only about 11 to 23% of GDPR's statutory caps. The practical takeaway is the same regardless of which average you use: the violation categories driving most of the 2,685-plus recorded cases, unclear legal basis, unclear processing principles, and weak security measures, apply to sites of any size, and a current, accurate privacy policy addresses the first two directly.
Frequently Asked Questions
What is the average GDPR fine in 2026? About EUR 2.28 million per documented case, or EUR 2,277,122 precisely, according to CMS's GDPR Enforcement Tracker Report 2025/2026, published 21 May 2026 and covering 2,685 fines with a disclosed amount through a 1 March 2026 cutoff.
Is the average GDPR fine what most companies actually pay? No. CMS itself describes the average as heavily influenced by a comparatively small number of exceptionally large fines. The single EUR 1.2 billion Meta fine alone equals about 20% of the entire EUR 6.11 billion documented total, and Spain, which logged 1,048 of the 2,685 cases, reports an average fine well below the overall figure.
How does the average GDPR fine compare to the maximum statutory fine? It is far below both statutory caps in Article 83. The EUR 2.28 million average is about 23% of the lower-tier cap (EUR 10 million or 2% of global turnover) and roughly 11% of the higher-tier cap (EUR 20 million or 4% of global turnover), confirming that regulators rarely fine anywhere near the legal maximum.
Why do different GDPR fine trackers report different averages? Because they count different case sets. CMS's 2,685 documented cases imply an average of EUR 2.28 million, while enforcementtracker.com's larger set of 3,202 actions and EUR 6.31 billion implies a lower average of about EUR 1.97 million per case, since it includes more smaller, lower-value fines.
Where the Numbers Come From
- CMS Law. (2026). "GDPR Enforcement Tracker Report 2025/2026, Numbers and Figures." 2,685 documented fines, EUR 6.11 billion cumulative, average EUR 2,277,122, cutoff 1 March 2026, published 21 May 2026.
- CMS Law. (2026). "GDPR Enforcement Tracker Report, Executive Summary." Notes the average fine is "heavily influenced by a comparatively small number of exceptionally large fines"; 3,062 total tracked cases.
- CMS Law. (2026). "Enforcement Tracker Report: Overview of GDPR Fines." States the average fine "levelled off around EUR 2.28 million" in the 2025/2026 edition, the first to pass EUR 6 billion cumulative.
- DLA Piper. (2026). "GDPR Fines and Data Breach Survey: January 2026." Cumulative total EUR 7.1 billion since 25 May 2018; 2025 total EUR 1.2 billion; Ireland cumulative EUR 4.04 billion; data through 10 January 2026.
- enforcementtracker.com. Live GDPR fines database, 3,202 recorded actions, EUR 6.31 billion cumulative, checked July 2026.
- CMS Law. (2023). "Fifth Anniversary of the GDPR: Fines Totalling EUR 2.7 Billion in Over 1,500 Cases." Published 22 May 2023, cutoff 1 March 2023.
- CMS Law. (2024). "Six Years of GDPR: Fines Totalling EUR 4.5 Billion." Published 15 May 2024, cutoff 1 March 2024.
Note: All figures verified as of July 2026. The implied average for enforcementtracker.com is calculated by dividing its own published total by its own published case count, not a figure the tracker publishes directly. Averages are refreshed at least twice a year to track new CMS Enforcement Tracker Report editions and DLA Piper survey updates.
