Germany's biggest confirmed GDPR fine is EUR 45 million, a combined EUR 15 million and EUR 30 million penalty against Vodafone GmbH that Germany's federal data protection authority, the BfDI, finalized in March 2025 and announced that June. The case ended a six-year run by H&M's EUR 35.3 million Hamburg fine, and it arrived in a country where three of the previous record-holders were later cut to a fraction of what regulators first imposed.
What is Germany's biggest GDPR fine?
EUR 45 million, split into a EUR 15 million penalty for failing to adequately supervise partner sales agencies and a EUR 30 million penalty for authentication weaknesses in Vodafone's online customer portal that let attackers reach eSIM profiles. The Federal Commissioner for Data Protection and Freedom of Information, Germany's federal-level GDPR authority, finalized the decision on March 10, 2025, and it has already been paid, with no appeal reported as of this writing.
Figure 1: Germany's GDPR fine record at a glance. Sources: European Data Protection Board national enforcement register; BfDI decision summary.
Before Vodafone, the title belonged to H&M Hennes & Mauritz, fined EUR 35.3 million by the Hamburg data protection authority in October 2020 for systematically recording employee health details, family circumstances, and religious beliefs gathered during informal workplace conversations. Unlike several of Germany's other large fines, the H&M case was never successfully challenged down, and it still stands at its original amount six years later.
How does Vodafone's fine compare to Germany's other biggest cases?
Outside Vodafone and H&M, Germany's next tier of large fines clusters around the EUR 9 million to EUR 15 million range as originally issued: Deutsche Wohnen's EUR 14.5 million case over unlawful tenant data retention, notebooksbilliger.de's EUR 10.4 million case over years of unlawful employee and customer video surveillance, and 1&1 Telecom's EUR 9.55 million case over weak identity checks on its customer service hotline.
Figure 2: Germany's largest GDPR fines as originally issued, before any appeal. Sources: BfDI, Hamburg, Berlin, and Lower Saxony data protection authorities; CMS GDPR Enforcement Tracker Report 2026.
Sites collecting personal data from German or wider EU visitors run the same legal-basis and consent risks that triggered several of these cases; a privacy policy generator built for GDPR keeps that documentation current without waiting for a regulator to flag the gap.
Why do German courts keep cutting these fines on appeal?
Because German courts have repeatedly rejected the turnover-based formula German authorities have used to calculate fines, arguing it overweights a company's total group revenue rather than the specific violation. Three of Germany's next-largest cases after Vodafone and H&M were each reduced on appeal to exactly EUR 900,000, a coincidence in the final number but not in the pattern: courts in Berlin, Celle, and Bonn all found the original calculation disproportionate.
Figure 3: Original fine versus the amount that survived appeal, for three of Germany's biggest GDPR cases. Sources: Berlin District Court, Higher Regional Court of Celle, Bonn Regional Court rulings, as reported by MLex and Clifford Chance.
Deutsche Wohnen's EUR 14.5 million fine from 2019 was first thrown out entirely on the grounds that a company cannot be a direct party to a fine proceeding, then reinstated after a European Court of Justice referral, and finally set at EUR 900,000 by the Berlin District Court. Notebooksbilliger.de's EUR 10.4 million case followed a similar arc, with the Higher Regional Court of Celle cutting it by roughly 91% in a December 2025 ruling. 1&1 Telecom's EUR 9.55 million fine was cut by about 90% by the Bonn Regional Court back in November 2020, the earliest of the three rulings and the one that first challenged the calculation method the others later rejected too.
What share of Germany's biggest fines actually survive appeal?
Of Germany's five largest confirmed GDPR fines, three have been reduced by a court and only two, Vodafone's 2025 case and H&M's 2020 case, stand at their original amount. That is a 60% reduction rate among the country's highest-profile cases, though it is worth noting neither of the two survivors has yet faced a completed court challenge; Vodafone's case is too recent to have exhausted appeal windows, and H&M's simply was not challenged.
Figure 4: Outcome of Germany's 5 largest confirmed GDPR fines. Source: PrivacyTerms.io compilation of BfDI, state authority, and court records.
For a business estimating exposure, that pattern matters more than the headline number: the amount a German regulator first announces is not a reliable predictor of what a company eventually pays.
How much has Germany fined in total, and how does that compare to the rest of the EU?
There is no single answer, because Germany has no single enforcer to ask. CMS's own 2026 GDPR Enforcement Tracker Report states plainly that there is no comprehensive publication of fines by German authorities, so compliance-tracking aggregators compile individual case disclosures across Germany's 17 authorities to estimate a cumulative total, putting it at just over EUR 200 million even before the 2025 Vodafone case is added in.
Figure 5: Germany's estimated share of the EU-wide GDPR fine total. Sources: CMS GDPR Enforcement Tracker Report 2026 (EUR 6.11 billion EU-wide, data cutoff March 1, 2026); compliance-tracker aggregate estimate for Germany.
That works out to roughly 4% of the EUR 6.11 billion in fines the CMS Enforcement Tracker Report has recorded EU-wide through March 2026 (a separate DLA Piper survey puts the EU-wide aggregate slightly higher, at EUR 7.1 billion as of January 2026, reflecting a broader survey scope). For context on how Germany's total fits into the wider EU picture, see our GDPR fines statistics for 2026, where Ireland's EUR 4.04 billion alone dwarfs Germany's entire disclosed record.
How does Germany's enforcement style compare to other regulators?
Germany's pattern, big initial fines followed by steep court-ordered cuts, looks different from regulators that rarely see their fines challenged down this hard. The UK's Information Commissioner's Office, for instance, issues far fewer eight-figure fines and settles most cases without the multi-year court fights that have defined Germany's biggest three cases; see our breakdown of the average ICO fine in 2026 for how UK penalty sizes and enforcement volume compare.
How does each of Germany's biggest fines compare?
| Company | As issued | After appeal | Year |
|---|---|---|---|
| Vodafone GmbH | EUR 45,000,000 | EUR 45,000,000 (final) | 2025 |
| H&M Hennes & Mauritz | EUR 35,300,000 | EUR 35,300,000 (unchanged) | 2020 |
| Deutsche Wohnen SE | EUR 14,500,000 | EUR 900,000 | 2019 |
| notebooksbilliger.de | EUR 10,400,000 | EUR 900,000 | 2020 |
| 1&1 Telecom GmbH | EUR 9,550,000 | EUR 900,000 | 2019 |
Sources: BfDI; Hamburg, Berlin, and Lower Saxony data protection authorities; Berlin District Court; Higher Regional Court of Celle; Bonn Regional Court.
Two of Germany's five biggest GDPR fines still stand exactly as issued. The other three now all sit at the identical EUR 900,000 figure, which says more about how German courts have re-calculated these penalties than it does about the underlying violations.
The Bottom Line
EUR 45 million is the correct answer to "what is Germany's biggest GDPR fine" as of 2026, but it is a poor guide to what a typical case actually costs once a German court reviews the number. Three of the next-largest fines were cut by roughly 90% each, and Germany's fragmented enforcement structure, 17 separate authorities with no shared national total, means even the cumulative figure has to be estimated rather than quoted from one source. For a business handling data from German or EU users, the practical lesson is not the size of the headline fine but the underlying gap that triggered it: weak legal-basis documentation, unreviewed surveillance, or authentication that lets one customer's data leak to another.
Frequently Asked Questions
What is Germany's biggest GDPR fine? EUR 45 million, combining a EUR 15 million and a EUR 30 million penalty against Vodafone GmbH, finalized by Germany's federal data protection authority (the BfDI) in March 2025 and announced that June. It replaced H&M's EUR 35.3 million Hamburg fine from October 2020 as Germany's largest confirmed case.
How much has Germany collected in GDPR fines in total? No single figure exists, because Germany has no single enforcer. Compliance-tracking aggregators put the cumulative disclosed total at just over EUR 200 million before the 2025 Vodafone case, spread across 17 separate authorities, a small share of the roughly EUR 6.11 billion tracked EU-wide through March 2026.
Why do German courts keep reducing GDPR fines on appeal? German courts have repeatedly rejected the turnover-based formula regulators use to calculate fines. Three of Germany's next-largest cases after Vodafone and H&M, originally worth a combined EUR 34.45 million, were each cut to the same EUR 900,000 once a court reviewed the calculation.
How many authorities enforce GDPR in Germany? 17: the federal BfDI plus one data protection authority in each of Germany's 16 states. They coordinate informally through the Datenschutzkonferenz, but no single one of the 17 publishes a running national total, which is why Germany's cumulative fine figure has to be estimated rather than quoted directly.
Where the Numbers Come From
- European Data Protection Board. (2025). "German Federal SA: Administrative fines in the amount of EUR 15,000,000 and EUR 30,000,000." National enforcement register entry citing the BfDI's final decision of March 10, 2025 against Vodafone GmbH, the basis for this post's headline figure.
- CMS International Law Firm. (2026). "GDPR Enforcement Tracker Report 2025/2026: Germany." Seventh edition, data cutoff March 1, 2026; source for the H&M fine detail and the statement that German authorities publish no comprehensive national fine total.
- MLex. (2026). "Deutsche Wohnen's 2019 GDPR fine cut from EUR 14.5m to EUR 0.9m after appeal saga." Reporting on the Berlin District Court's final ruling.
- Clifford Chance. (2021). "German court slashes GDPR fine to less than 10 percent." Reporting on the Bonn Regional Court's reduction of the 1&1 Telecom fine.
- DLA Piper. (2026). "GDPR Fines and Data Breach Survey: January 2026." Source for the EUR 7.1 billion EU-wide aggregate figure and Germany's data breach notification volume.
Note: All figures verified as of October 2026. Germany's cumulative fine total is an estimate compiled from individually disclosed cases, since no single German data protection authority publishes one national figure; this post will be revisited as new cases and appeal rulings are disclosed.
