Luxembourg has collected roughly EUR 1,095 in GDPR fines for every resident since the regulation took effect in May 2018, more than any other country, according to DLA Piper's January 2026 GDPR Fines and Data Breach Survey. Ireland comes second per capita at EUR 740, despite holding the largest absolute total of any country. Both figures trace back to a small number of fines against a handful of large technology companies.
Which country has the highest GDPR fines per capita?
Luxembourg does, by a wide margin. Dividing the country's EUR 746.56 million in cumulative GDPR fines by its population of 681,973 (Luxembourg's statistics office, January 2025) works out to roughly EUR 1,095 per resident, more than any other jurisdiction DLA Piper's survey covers. Almost the entire total comes from a single case.
Figure 1: Luxembourg's per-resident GDPR fine total since 2018. Source: DLA Piper GDPR Fines and Data Breach Survey (January 2026); Luxembourg Statistics Portal population data (January 2025).
That single case is the EUR 746 million fine Luxembourg's data protection authority, the CNPD, imposed on Amazon's European retail and e-commerce arm in 2021 over its advertising practices. Amazon appealed, and on 18 March 2025 Luxembourg's Administrative Court dismissed the appeal and upheld the CNPD's original decision, according to DLA Piper's 2026 survey. Amazon is reportedly considering a further appeal, but the fine currently stands in full.
Why does Ireland collect the most total GDPR fine money?
Ireland's Data Protection Commission has issued EUR 4.04 billion in cumulative GDPR fines since May 2018, more than three-and-a-half times second-place France's EUR 1.13 billion, according to DLA Piper's 2026 survey. That is because most large US technology companies route their EU operations through Ireland, putting the Irish DPC in charge of the continent's biggest privacy cases, including Meta's record EUR 1.2 billion fine in May 2023 and a EUR 530 million fine against a social media company in April 2025 over data transfers to China.
Figure 2: Ireland's share of every euro collected in GDPR fines across the EEA and UK since 2018. Source: DLA Piper GDPR Fines and Data Breach Survey (January 2026).
Businesses that process EU residents' data carry this exposure regardless of where they are based; keeping a privacy policy generator built for GDPR current is one of the few controls a smaller company has over which side of these enforcement numbers it lands on. Ireland's population is only about 5.46 million, according to the Central Statistics Office's April 2025 estimate, which is why the country still ranks second on a per-resident basis despite topping every other enforcement measure.
How do the rest of the EEA countries compare on fines per capita?
Once Luxembourg and Ireland are set aside, the picture looks very different. The Netherlands leads the remaining field at EUR 19.43 per resident, followed by France at EUR 16.33, according to PrivacyTerms.io's calculation from DLA Piper's country totals and Eurostat's 2025 population estimates. Every other surveyed country falls under EUR 5 per resident; see our breakdown of Dutch DPA fines in the Netherlands for the four cases behind that country's total.
Figure 3: GDPR fines per resident since 2018, excluding the two outlier countries. Source: DLA Piper GDPR Fines and Data Breach Survey (January 2026); Eurostat population estimates (2025).
This mirrors a pattern our companion GDPR fines totals and averages post already flags: enforcement value is concentrated in a small number of record-setting cases rather than spread evenly across regulators. Most countries with active data protection authorities still collect single-digit euros per resident even after eight years of GDPR enforcement, including Poland and the rest of Eastern Europe, where even a record national fine barely registers per capita next to Luxembourg or Ireland.
Which are the largest individual GDPR fines ever issued?
Nine of the 10 largest individual GDPR fines on record belong to Ireland's DPC; the tenth is Luxembourg's Amazon case. Ranked from largest to smallest, they run from Ireland's EUR 1.2 billion Meta fine in May 2023 down to a EUR 225 million case, according to DLA Piper's 2026 survey. Every fine on this list exceeds EUR 200 million.
Figure 4: The 10 largest individual GDPR fines ever issued, by country and rank. Source: DLA Piper GDPR Fines and Data Breach Survey (January 2026).
Concentration this heavy means the per-capita rankings above will keep shifting with a single new case. If a supervisory authority in a small country lands one more record fine against a large technology company, that country's per-resident figure can jump overnight in a way a large country's total almost never does.
How is the EUR 7.1 billion in total GDPR fines split by country?
Ireland alone accounts for 57% of the EUR 7.1 billion in cumulative GDPR fines reported across the EEA and UK since 2018, with France (16%) and Luxembourg (11%) making up most of the rest, according to DLA Piper's 2026 survey. The remaining 28 surveyed jurisdictions share only about 16% of the total between them.
Figure 5: Share of the EUR 7.1 billion cumulative GDPR fine total, by country. Source: DLA Piper GDPR Fines and Data Breach Survey (January 2026).
That concentration is the whole reason a per-capita view tells a different story than a totals view. Ireland's absolute lead comes from hosting the most Big Tech cases; Luxembourg's per-capita lead comes from hosting just one, spread across a population smaller than many mid-sized cities.
How do GDPR fines per capita compare across countries?
| Country | Cumulative fines since 2018 | Population | Fines per capita |
|---|---|---|---|
| Luxembourg | EUR 746,558,675 | 681,973 | EUR 1,095 |
| Ireland | EUR 4,038,792,400 | 5,460,000 | EUR 740 |
| Netherlands | EUR 349,689,000 | 18,000,000 | EUR 19.43 |
| France | EUR 1,126,600,100 | 69,000,000 | EUR 16.33 |
| Austria | EUR 44,963,425 | 9,200,000 | EUR 4.89 |
| Italy | EUR 277,110,000 | 59,000,000 | EUR 4.70 |
| Croatia | EUR 14,800,000 | 3,850,000 | EUR 3.84 |
| Greece | EUR 37,077,749 | 10,400,000 | EUR 3.57 |
| Spain | EUR 135,474,494 | 48,900,000 | EUR 2.77 |
| Sweden | EUR 28,342,516 | 10,600,000 | EUR 2.67 |
Source: DLA Piper GDPR Fines and Data Breach Survey (January 2026); population figures from Luxembourg's Statistics Portal, Ireland's Central Statistics Office, and Eurostat's 2025 estimates, compiled by PrivacyTerms.io.
Every country below Luxembourg and Ireland on this table sits closer to the bottom row than the top, which is the clearest sign that the per-capita GDPR story is really a story about two jurisdictions and a handful of fines.
The Bottom Line
EUR 1,095 per resident is the correct answer to "which country punishes hardest under GDPR" if punishment is measured per capita, but it describes Luxembourg's one Amazon case more than it describes Luxembourg's enforcement posture generally. Ireland's EUR 740 per resident is a fairer signal of sustained enforcement pressure, since it comes from nine separate record-setting fines rather than one. For most companies handling EU personal data, the practical lesson is the same regardless of which ranking they cite: a small number of large, well-documented violations account for nearly all GDPR fine money, and a privacy policy generator built for GDPR that stays current with disclosed processing and transfer practices remains the cheapest way to stay off either list.
Frequently Asked Questions
Which country has the highest GDPR fines per capita? Luxembourg, at roughly EUR 1,095 per resident since May 2018, according to DLA Piper's January 2026 GDPR Fines and Data Breach Survey. The figure is driven almost entirely by the EUR 746.56 million fine against Amazon's European retail arm.
Which country has collected the most total GDPR fine money? Ireland, with EUR 4.04 billion in cumulative fines since May 2018, which is 57% of the entire EUR 7.1 billion collected across the EEA and UK, per DLA Piper's 2026 survey.
Why do small countries have such high GDPR fines per capita? Because EU headquarters for large technology companies cluster in small-population jurisdictions. Ireland's single EUR 1.2 billion fine against Meta Platforms Ireland works out to roughly EUR 220 per Irish resident from that one case alone.
Was Luxembourg's Amazon GDPR fine overturned? No. Amazon Europe Core appealed the EUR 746 million fine, but Luxembourg's Administrative Court dismissed the appeal and upheld the original decision on 18 March 2025, according to DLA Piper's 2026 survey and the CNPD's own press release.
Where the Numbers Come From
- DLA Piper. (2026). "GDPR Fines and Data Breach Survey." Country-by-country cumulative fine totals from 25 May 2018 to 10 January 2026, the top 10 individual fines chart, and the EUR 7.1 billion aggregate total this post's per-capita figures are calculated from.
- Commission Nationale pour la Protection des Donnees (CNPD), Luxembourg. (2025). "Amazon Decision." Confirms the Administrative Court's 18 March 2025 dismissal of Amazon's appeal against the EUR 746 million fine.
- Statistics Portal Luxembourg (STATEC). (2025). Population of 681,973 as of 1 January 2025, used to calculate Luxembourg's per-resident fine figure.
- Central Statistics Office Ireland. (2025). Population estimate of 5.46 million as of April 2025, used to calculate Ireland's per-resident fine figure.
- Eurostat. (2025). EU population estimates as of 1 January 2025, used for the remaining countries in this post's per-capita table.
Note: All figures verified as of October 2026. Per-capita figures are PrivacyTerms.io's own calculations, dividing DLA Piper's published country-level GDPR fine totals by the population figures cited above; DLA Piper's survey itself does not publish a per-capita ranking. Country fine totals exclude successfully appealed fines and, per DLA Piper's own methodology note, may run higher than reported where a supervisory authority does not publicly disclose all fines. This data is refreshed at least twice a year as new GDPR fines are disclosed.
