Media, telecoms and broadcasting companies have absorbed roughly 70% of all corporate GDPR fine value, more than every other industry combined, according to CMS's GDPR Enforcement Tracker Report 2026, which covers data through March 1, 2026. That single sector's own reported total, 4.95 billion euros across 358 confirmed fines, dwarfs every other industry CMS tracks. But fine count tells a different story: industry and commerce, not media, has logged the most individual cases.
Which industry has been fined the most under GDPR?
Media, telecoms and broadcasting is the clear leader on fine value. CMS's headline figure states the sector accounts for roughly 70% of all corporate GDPR fine value, and the sector's own chapter in the same report puts the number at 4.95 billion euros across 358 confirmed fines, an average of 13.84 million euros per fine.
Figure 1: Media, telecoms and broadcasting's reported share of corporate GDPR fine value. Source: CMS, GDPR Enforcement Tracker Report 2026.
That 70% figure is worth a brief hedge. CMS's own numbers-and-figures summary reports 2,685 confirmed fines totaling 6.11 billion euros as of March 1, 2026, and against that narrower base, the sector's 4.95 billion euros works out closer to 81%. The 70% figure lines up much more closely against DLA Piper's broader 7.1 billion euro cumulative total across 31 surveyed jurisdictions, which suggests CMS is measuring against a wider pool of disclosed fines than the 2,685 cases with complete public documentation. Either base still points to the same finding: one sector absorbs most of the money.
Businesses outside media and telecoms should not read that concentration as safety. See our companion breakdown of GDPR fines statistics for 2026 for how the overall enforcement total has grown across every sector, not just the largest one.
How does GDPR fine value compare across industries?
Once media, telecoms and broadcasting is set aside, the next-largest sectors by total fine value are industry and commerce at 394.98 million euros and employment at 360.81 million euros, followed by the five remaining tracked sectors combined at roughly 276 million euros, finance, insurance and consulting at 87.65 million euros, and public sector and education at 37 million euros.
Figure 2: GDPR fine value by industry sector, in euro millions. Source: CMS, GDPR Enforcement Tracker Report 2026, sector chapters.
Employment's 360.81 million euro total is driven heavily by a single 290 million euro fine the Dutch data protection authority issued in July 2024 against a mobility service provider over unlawful data transfers, more than 80% of that sector's entire total on its own.
Which industry receives the most individual GDPR fines?
Fine value and fine count point to different sectors entirely. Industry and commerce, which spans retail and e-commerce, has logged 588 confirmed fines, more than any other sector CMS tracks, yet the total value of those cases is only 394.98 million euros.
A 746 million euro fine against Amazon in this sector, issued by Luxembourg's CNPD in 2021, was set aside by the Luxembourg Administrative Court on March 12, 2026 and sent back for reconsideration, which means the sector's current largest confirmed fine is 150 million euros, issued by France's CNIL against Shein's EU entity, Infinite Styles Services Co. Limited, on September 9, 2025.
Frequent enforcement in this sector traces mostly to unlawful tracking and weak legal bases for processing customer data, exactly the gap a privacy policy generator built for GDPR is meant to close before a regulator finds it.
How does fine count break down by industry?
Ranking sectors by case count instead of euro value flips the earlier chart's order. Industry and commerce leads with 588 fines, followed by media, telecoms and broadcasting with 358, public sector and education with 327, finance, insurance and consulting with 307, and employment with 191, out of 2,685 confirmed fines total as of March 1, 2026.
Figure 3: Share of confirmed GDPR fines by industry, measured by case count rather than euro value. Source: CMS, GDPR Enforcement Tracker Report 2026.
A sector showing up often in this count does not mean its fines are large. Industry and commerce and public sector and education together account for more than a third of every confirmed fine, but less than 7% of total fine value.
How large is the average GDPR fine by industry?
Average fine size varies enormously by sector. Media, telecoms and broadcasting's 13.84 million euro average dwarfs every other tracked sector, followed by employment at 1.89 million euros, industry and commerce at 671,734 euros, finance, insurance and consulting at roughly 285,500 euros (PrivacyTerms.io's calculation from CMS's reported total and case count for that sector), and public sector and education at just 113,302 euros.
Figure 4: Average GDPR fine size by industry, in euro thousands. Source: CMS, GDPR Enforcement Tracker Report 2026, sector chapters and PrivacyTerms.io calculations.
A regulator fining a media company and a regulator fining a public sector agency are, in practice, applying very different scales.
GDPR fines by industry: the full sector comparison
| Sector | Confirmed fines | Total fine value | Average fine |
|---|---|---|---|
| Media, telecoms & broadcasting | 358 | 4.95 billion euros | 13.84 million euros |
| Industry & commerce | 588 | 394.98 million euros | 671,734 euros |
| Employment | 191 | 360.81 million euros | 1.89 million euros |
| Finance, insurance & consulting | 307 | 87.65 million euros | ~285,500 euros |
| Public sector & education | 327 | 37 million euros | 113,302 euros |
| All 10 sectors tracked | 2,685 | 6.11 billion euros | 2.28 million euros |
Source: CMS, GDPR Enforcement Tracker Report 2026, sector chapters and numbers-and-figures summary, data through March 1, 2026.
The five sectors in this table account for roughly 5.83 billion euros of the 6.11 billion euro total; the remaining five tracked sectors, life science and healthcare, real estate, transportation and energy, accommodation and hospitality, and individuals and private associations, combine for the rest.
The Bottom Line
70% of corporate GDPR fine value sits in one sector, media, telecoms and broadcasting, but that concentration is a story about the size of a handful of headline penalties, not about where enforcement activity happens most often. Industry and commerce has logged more individual fines than any other sector, and public sector and education organizations get fined more often than employment does, just at far smaller amounts each time. A business outside media and telecoms is not outside GDPR's reach; it is simply more likely to face a fine sized like the 671,734 euro industry and commerce average than the 13.84 million euro media sector average, and the fastest way to stay off that list in either case is a privacy policy that matches what the business does with personal data.
Frequently Asked Questions
Which industry has the highest GDPR fine value? Media, telecoms and broadcasting, which CMS's GDPR Enforcement Tracker Report 2026 credits with roughly 70% of all corporate GDPR fine value. The sector's own chapter in the same report puts the figure at 4.95 billion euros across 358 confirmed fines.
Which industry receives the most individual GDPR fines? Industry and commerce, with 588 confirmed fines as of March 1, 2026, more than any other sector CMS tracks. Those cases total only 394.98 million euros, about 6% of all corporate fine value, because most individual industry and commerce fines are small.
What is the single biggest GDPR fine in any industry? 1.2 billion euros, issued to Meta Platforms Ireland Limited in May 2023 in the media, telecoms and broadcasting sector. A 746 million euro fine against Amazon in industry and commerce was set aside by the Luxembourg Administrative Court on March 12, 2026, leaving a 150 million euro fine against Shein's EU entity as that sector's current record.
How much have public sector organizations been fined under GDPR? 37 million euros across 327 confirmed fines as of the 2026 report, the smallest total of any sector CMS tracks and an average fine of just 113,302 euros, the lowest average of any tracked industry.
Where the Numbers Come From
- CMS International Law Firm. (2026). "Numbers and Figures, GDPR Enforcement Tracker Report 2026." 2,685 confirmed fines totaling roughly 6.11 billion euros, data through March 1, 2026.
- CMS International Law Firm. (2026). "Media, Telecoms and Broadcasting, GDPR Enforcement Tracker Report 2026." 358 fines totaling 4.95 billion euros, average 13.84 million euros.
- CMS International Law Firm. (2026). "Industry and Commerce, GDPR Enforcement Tracker Report 2026." 588 fines totaling 394.98 million euros, including the March 2026 reversal of the Amazon fine.
- CMS International Law Firm. (2026). "Employment, GDPR Enforcement Tracker Report 2026." 191 fines totaling 360.81 million euros.
- CMS International Law Firm. (2026). "Public Sector and Education, GDPR Enforcement Tracker Report 2026." 327 fines totaling 37 million euros.
- DLA Piper. (2026). "GDPR Fines and Data Breach Survey, January 2026." Cross-check total of 7.1 billion euros cumulative across 31 surveyed jurisdictions since May 2018.
Note: All figures verified as of August 2026 against CMS's GDPR Enforcement Tracker Report 2026, cutoff March 1, 2026. The finance, insurance and consulting sector's per-fine average in this post is PrivacyTerms.io's own calculation from CMS's reported total and case count for that sector, since the report's own average figure for that chapter did not reconcile with its total and count. Sector totals are refreshed at least twice a year as CMS updates its Enforcement Tracker database.
