Ireland's Data Protection Commission has issued EUR 4.04 billion in cumulative GDPR fines, more than half of the EUR 7.1 billion recorded across Europe since 2018, according to DLA Piper's GDPR Fines and Data Breach Survey published in January 2026. No other single country comes close on value. Spain leads on a different measure entirely: it has filed the most individual fines of any country for seven years running, even though its typical penalty is far smaller than Ireland's.
Those two facts, one country dominating by euro amount and a different country dominating by case count, explain most of the confusion around "which country fines the most" headlines. Below is what actually drives each ranking, country by country.
Which EU country has issued the most GDPR fines by value?
Ireland, decisively. Its Data Protection Commission has issued EUR 4.04 billion in cumulative fines since 2018, which is more money than every other EU and EEA member state combined, according to DLA Piper's January 2026 survey. That concentration is not an accident of enforcement severity. GDPR's one-stop-shop mechanism assigns lead-regulator status to whichever country a company is headquartered in for EU purposes, and Meta, TikTok, and LinkedIn all run their European operations through Ireland, so Ireland's Data Protection Commission is the authority that reviews and fines them.
Figure 1: Ireland alone accounts for roughly 57% of Europe's cumulative confirmed GDPR fine value. France's total is an approximate floor, since CNIL does not publish a single cumulative figure the way DLA Piper's EU-wide survey does. Sources: DLA Piper (January 2026), CNIL enforcement summaries (2026).
France sits a distant second at just over EUR 1 billion, and every other country's confirmed total falls well behind both. Value concentration, not raw fine count, is the number that best answers "which country fines the most."
Which country has filed the most individual GDPR fines?
Spain has filed more individual GDPR fines than any other country for the seventh consecutive year, logging 1,048 published cases as of the CMS GDPR Enforcement Tracker Report 2026's 1 March 2026 cutoff. That is 116 more cases than the 2025 edition of the same report recorded twelve months earlier. Italy ranks second by count, followed by Romania and Poland, though CMS's own report explicitly cautions that these rankings reflect how consistently each national authority publishes its decisions rather than a precise measure of enforcement intensity.
Spain's high case count comes with a tradeoff: its average fine is much smaller than the EU-wide average of EUR 2.28 million, since most Spanish cases involve routine violations against small and mid-size businesses rather than the platform-scale cases that drive Ireland's totals. A country can lead on volume and still trail badly on value, and Spain is the clearest example of that split.
Why does Ireland account for 9 of the 10 largest GDPR fines?
Ireland's dominance of the largest individual fines has actually grown stronger in 2026. Nine of the ten largest GDPR fines ever issued now originate from Ireland's Data Protection Commission, according to the CMS Enforcement Tracker Report 2026, after Luxembourg's EUR 746 million fine against Amazon Europe was set aside on procedural grounds by Luxembourg's Administrative Court in March 2026 and referred back to the CNPD for reconsideration. Before that ruling, Luxembourg held one of the ten spots; after it, Ireland holds all but one.
Figure 2: Ireland's Data Protection Commission issued 9 of the 10 largest confirmed GDPR fines on record as of the CMS Enforcement Tracker Report's 2026 ranking. Source: CMS GDPR Enforcement Tracker Report, 2026 edition.
That single procedural ruling reshuffled the entire top-ten list without a single new fine being issued, which is a reminder that "largest fines" rankings can shift on appeal outcomes as much as on new enforcement.
Is France catching up to Ireland in GDPR fines?
France's CNIL became the only country besides Ireland to pass EUR 1 billion in cumulative GDPR fines, overtaking Luxembourg's now-shrinking total in 2025. Much of that growth came in a single day: on 1 September 2025, CNIL fined Google EUR 325 million and Shein EUR 150 million in the same announcement, both over cookie consent violations, adding EUR 475 million to France's total at once.
Figure 3: The Google and Shein cookie-consent fines account for most of CNIL's recent growth, on top of earlier confirmed cases against Criteo, Amazon France Logistique, and Clearview AI. Source: CNIL press releases, 2022 to 2025.
Even with that surge, France remains far behind Ireland. EUR 1 billion is roughly a quarter of Ireland's EUR 4.04 billion, and closing that gap would require several more fines the size of the Google case. If your site sets cookies or runs ad targeting for EU visitors, a privacy policy generator built for GDPR keeps consent and legal-basis disclosures aligned with the same rules CNIL and Ireland's DPC are now enforcing most aggressively.
This mirrors the sector pattern behind these fines just as much as the country pattern; see our breakdown of average GDPR fines in 2026 for how the same enforcement data looks once you set country aside and look at violation type instead.
How much have total GDPR fines grown across the EU since 2018?
The country rankings above sit on top of a total that keeps climbing. Cumulative EU-wide GDPR fines have grown from roughly EUR 2.7 billion at the five-year mark to EUR 6.11 billion by CMS's 1 March 2026 cutoff, using three consecutive editions of the same fixed-methodology report as consistent checkpoints.
Figure 4: Cumulative EU-wide GDPR fines at each CMS Enforcement Tracker Report cutoff. Source: CMS Enforcement Tracker Report, 2023, 2024, and 2026 editions.
Country leadership can change, as Luxembourg's 2026 slide shows, but the overall total has not gone in reverse in any of the report's seven editions.
How do the top GDPR-fining countries compare?
| Country | Leads by | Headline figure | Basis |
|---|---|---|---|
| Ireland | Cumulative value | EUR 4.04 billion, roughly 57% of the EU total | DLA Piper, January 2026 |
| Spain | Number of fines | 1,048 fines, 7th consecutive year at the top | CMS Enforcement Tracker Report 2026 |
| France | Fastest-growing value | Just over EUR 1 billion, 2nd-highest by value | CNIL enforcement data, 2025 to 2026 |
| Luxembourg | Formerly 3rd by value | Roughly EUR 0.75 billion, mostly one disputed fine | CMS Enforcement Tracker Report 2026 |
Source: DLA Piper GDPR Fines and Data Breach Survey (January 2026); CMS GDPR Enforcement Tracker Report (2026 edition); CNIL press releases.
No single country leads on every measure, which is exactly why "which country fines the most" needs a value answer and a count answer, not one number.
The Bottom Line
Ireland's EUR 4.04 billion in cumulative GDPR fines outweighs every other EU country's total by a wide margin, and that gap is a direct product of which companies are headquartered there under GDPR's one-stop-shop rule, not evidence that Irish regulators are uniquely aggressive. Spain's 1,048 fines tell a different, equally real story: high-volume, lower-value enforcement against smaller businesses. France is the country to watch, since its CNIL only needs a handful more fines the size of the EUR 325 million Google penalty to meaningfully close the gap with Luxembourg's former position and keep climbing toward Ireland's total. For any business handling EU personal data, the practical lesson holds regardless of which country regulates you: cookie consent and legal-basis disclosures are the violations driving both the highest-count and highest-value enforcement right now.
Frequently Asked Questions
Which EU country has issued the most GDPR fines by value? Ireland, by a wide margin. Its Data Protection Commission has issued EUR 4.04 billion in cumulative GDPR fines, more than half of the EUR 7.1 billion European total, according to DLA Piper's GDPR Fines and Data Breach Survey published in January 2026.
Which country has issued the most individual GDPR fines? Spain, for the seventh consecutive year. The Spanish data protection authority has logged 1,048 published fines as of the CMS GDPR Enforcement Tracker Report 2026, far more than any other country, though its average fine is much smaller than Ireland's.
Are most of the largest GDPR fines really all from Ireland? Yes. Nine of the ten largest GDPR fines ever issued now originate from Ireland's Data Protection Commission, per the CMS Enforcement Tracker Report 2026, after Luxembourg's EUR 746 million Amazon fine was set aside on procedural grounds in March 2026.
Is France catching up to Ireland in GDPR fines? France's CNIL passed EUR 1 billion in cumulative GDPR fines in 2025, overtaking Luxembourg to become the only other country above that mark, driven partly by a single EUR 325 million fine against Google in September 2025. It remains far behind Ireland's EUR 4.04 billion.
Where the Numbers Come From
- DLA Piper. (2026). "GDPR Fines and Data Breach Survey: January 2026." Cumulative EU total EUR 7.1 billion since 25 May 2018; Ireland's cumulative total EUR 4.04 billion.
- CMS Law. (2026). "GDPR Enforcement Tracker Report 2026, Numbers and Figures." Spain 1,048 fines (7th consecutive year), EUR 6.11 billion cumulative total, average fine EUR 2.28 million, cutoff 1 March 2026.
- CMS Law. (2026). "GDPR Enforcement Tracker Report 2026, Executive Summary." Ireland's Data Protection Commission responsible for 9 of the 10 largest GDPR fines; Amazon's EUR 746 million fine set aside by Luxembourg's Administrative Court and referred back to the CNPD, March 2026.
- CNIL. (2025). "Cookies and Advertisements Inserted Between Emails: Google Fined 325 Million Euros by the CNIL." 1 September 2025.
- CNIL. (2025). "Cookie Regulation: CNIL Has Imposed Two Fines on Shein and Google." EUR 150 million Shein fine, 1 September 2025.
- CMS Law. (2024). "Six Years of GDPR: Fines Totalling EUR 4.5 Billion." Cutoff 1 March 2024.
- CMS Law. (2023). "Fifth Anniversary of the GDPR: Fines Totalling EUR 2.7 Billion." Cutoff 1 March 2023.
Note: All figures verified as of October 2026. France's cumulative total is an approximate floor compiled from CNIL enforcement summaries rather than a single regulator-confirmed figure, and Luxembourg's total is under active reconsideration following the March 2026 ruling on the Amazon fine. Country-level fine data is refreshed at least twice a year as CMS and DLA Piper publish new editions of their reports.
