The smallest confirmed GDPR fine on record is EUR 500, imposed by Romania's data protection authority, ANSPDCP, in May 2021 against a homeowners' association in the city of Iasi for refusing to cooperate with a data protection investigation. It is one of at least two EUR 500 penalties Romania has issued against homeowners' associations, and it remains the smallest euro-denominated fine identified among the thousands logged since GDPR took effect on 25 May 2018.
What is the smallest GDPR fine ever issued?
The record belongs to a homeowners' association (Asociatia de Proprietari) in Iasi, fined 2,463.30 Romanian lei, the equivalent of EUR 500, on 6 May 2021. The case did not start as a GDPR fine at all: a resident complained that the association had publicly displayed a payment list showing members' names alongside documents the resident called defamatory. When ANSPDCP opened an investigation, the association confirmed receipt of the authority's information requests but never responded to them, which is what triggered the fine, under Articles 58(1)(a), 58(1)(e), and 83(5)(e) of the GDPR.
Figure 1: Every confirmed GDPR-related penalty under EUR 3,500 identified for this piece, smallest at the far right. Sources: see Where the Numbers Come From below.
A related, less-documented case reinforces that EUR 500 functions as something close to a floor rather than a fluke: a second homeowners' association, in Hunedoara county in western Romania, was fined the same EUR 500 (reported as 2,389.05 lei) after failing to carry out measures a previous ANSPDCP order had required, according to legal newswire MLex. MLex sits behind a paywall and this piece could not confirm the exact decision date independently, so treat that second figure as reported rather than fully verified.
Why was Romania's EUR 500 fine so small?
GDPR does not use a flat penalty schedule. Article 83(2) requires every data protection authority to weigh 10 separate factors before setting an amount, including the nature and duration of the infringement, whether it was intentional or negligent, how the controller cooperated with the investigation, and the financial situation of the entity being fined. A volunteer-run homeowners' association with no commercial turnover, fined for a paperwork failure rather than a data breach, sits at the opposite end of that scale from a platform processing hundreds of millions of user records.
Figure 2: A simplified view of how Article 83(2)'s proportionality factors separate the smallest confirmed fines from the largest. Source: Regulation (EU) 2016/679, Article 83(2).
That proportionality requirement is also why the generator you use to publish a privacy policy matters at any size of organization. A privacy policy generator built for GDPR's legal-basis and disclosure requirements keeps the documentation regulators check first current, whether the entity behind it is a homeowners' association or a household-name platform.
What other GDPR fines have landed under EUR 3,500?
Confirmed penalties this small are uncommon in the public record. Among the roughly 50 individually documented cases tracked on Wikipedia's GDPR fines list, cross-checked against primary regulator sources, only a handful fall under EUR 3,500, and just one, the Iasi case, is confirmed under EUR 1,000.
| Entity | Fine | Authority | Year |
|---|---|---|---|
| Homeowners' association, Iasi | EUR 500 | Romania (ANSPDCP) | 2021 |
| Company (cookie consent) | EUR 955 (5,000 RON) | Romania (ANSPDCP) | 2026 |
| Unnamed police officer | EUR 1,400 | Germany (LfDI Baden-Wurttemberg) | 2019 |
| Unnamed bank | EUR 1,560 | Hungary (NAIH) | 2019 |
| Unnamed mayor | EUR 2,000 | Belgium (APD/GBA) | 2019 |
| Natural person (landlord) | EUR 3,000 | Spain (AEPD) | 2021 |
| Miljo- og Kvalitetsledelse AS | EUR 3,500 | Norway (Datatilsynet) | 2021 |
Source: ANSPDCP press releases; Wikipedia's "GDPR fines and notices" list, cross-checked against Datatilsynet and other primary regulator sources, accessed July 2026.
Figure 3: The smallest confirmed fines span three separate years, not a single reporting quirk. Sources: see Where the Numbers Come From below.
Two of the cases above, the Spanish landlord and the Norwegian CCTV-sharing fine, involve video surveillance rather than paperwork, the same violation category covered in more depth in our companion post on GDPR fines for CCTV and surveillance.
Figure 4: Among the seven confirmed sub-EUR-3,500 cases identified for this piece, Romania accounts for the most. Sources: ANSPDCP; Wikipedia's "GDPR fines and notices" list, accessed July 2026.
How does the smallest fine compare to the average GDPR fine?
The gap is enormous. Dividing enforcementtracker.com's cumulative EUR 6.31 billion total by its 3,202 tracked actions implies an average fine of roughly EUR 1.97 million, checked in July 2026. That means the EUR 500 record low sits at about 1/3,940th the size of the average confirmed GDPR fine, a difference driven almost entirely by which end of Article 83(2)'s proportionality scale the fined entity falls on.
Most GDPR enforcement activity clusters much closer to the small end of that range than the average implies, since a handful of billion-euro platform fines pull the average far above what a typical case looks like.
Are individuals ever fined under GDPR?
Yes. Several of the smallest confirmed fines were issued directly against natural persons or small volunteer bodies rather than companies. Germany's Baden-Wurttemberg data protection authority fined an unnamed police officer EUR 1,400 in 2019 for accessing personal data outside his official duties, and Spain's AEPD fined a private landlord EUR 3,000 in 2021 over an apartment building's CCTV system. Belgium's data protection authority fined a sitting mayor EUR 2,000 in 2019, the country's first GDPR enforcement action, for misusing residents' data collected for administrative purposes in an election campaign.
Whether these small fines get reduced further on appeal is a separate, largely unanswered question in the public record, one worth tracking as more GDPR penalties work through national appeals courts.
The Bottom Line
EUR 500 is the smallest confirmed GDPR fine identified in the public record, and it has effectively been issued twice by the same Romanian regulator against two different homeowners' associations, with a near-identical EUR 955 cookie-consent fine following in June 2026. Fines this small are the exception, not a trend: across the confirmed cases checked for this piece, only a handful land under EUR 3,500, and the overall average confirmed fine sits closer to EUR 2 million. What connects the smallest fines to the largest is the same Article 83(2) proportionality test, applied at wildly different scales depending on who is being fined and how they respond to a regulator's questions. For any organization, cooperating promptly with a data protection authority and keeping public-facing disclosures current is what keeps a case in the hundreds-of-euros tier rather than the thousands.
Frequently Asked Questions
What is the smallest GDPR fine ever issued? EUR 500, imposed by Romania's data protection authority, ANSPDCP, in May 2021 against a homeowners' association in Iasi for failing to cooperate with a GDPR investigation into a complaint about publicly posted member data.
Why do some GDPR fines total only a few hundred euros? Article 83(2) of the GDPR requires regulators to weigh 10 separate factors, including the offender's financial situation, before setting a fine, so a small homeowners' association or an individual employee typically receives a fine in the hundreds of euros rather than the millions reserved for large platforms.
How does the smallest GDPR fine compare to the average? The EUR 500 record low is roughly 1/3,940th the size of the estimated EUR 1.97 million average fine, calculated from enforcementtracker.com's 3,202 tracked GDPR actions as of July 2026.
Have regulators issued small GDPR fines recently, in 2026? Yes. Romania's ANSPDCP fined a company 5,000 Romanian lei, about EUR 955 at July 2026 exchange rates, on 26 June 2026 for running non-essential cookies without user consent, the most recent confirmed sub-EUR-1,000 case found for this piece.
Where the Numbers Come From
- ANSPDCP (Romania's National Supervisory Authority for Personal Data Processing). Press release, 19 May 2021: fine of 2,463.30 RON (EUR 500) against a homeowners' association in Iasi for failure to cooperate with an investigation.
- ANSPDCP. Press release, 26 June 2026: fine of 5,000 RON against Aviziero S.R.L. for using non-essential cookies without consent.
- Wikipedia contributors. "GDPR fines and notices." Sourced list of individual fines, cross-checked against Datatilsynet (Norway), CMS Law, and other primary and secondary sources; accessed July 2026.
- enforcementtracker.com. Live GDPR fines database, 3,202 recorded actions, EUR 6.31 billion cumulative, checked July 2026.
- European Central Bank. Euro foreign exchange reference rates, 29 July 2026: EUR 1 = RON 5.2353.
- EUR-Lex. Regulation (EU) 2016/679 (GDPR), Article 83(2): the 10 factors regulators must weigh when calculating a fine.
Note: All figures verified as of July 2026. The Hunedoara case is reported via a paywalled MLex article and could not be independently confirmed against a primary Romanian-language source; treat it as corroborating rather than fully verified. This post will be revisited roughly twice a year as new small-fine cases are confirmed.
