Regulators by country
EU data protection authorities compared
Short answer
- Complaints to EU authorities
- Over 100,000 a year, Commission report of July 2024 1
- Fines imposed to the 2024 report
- Over 6,680, around €4.2 billion 1
- Highest total by country
- Ireland, €2.8 billion 1
- Most fines by count
- Germany 2,106, Spain 1,596 1
- Lowest totals
- Liechtenstein €9,600, Estonia €201,000, Lithuania €435,000 1
- Largest staff increase, 2020 to 2024
- Ireland, 79% 1
National figures for 2025
Each authority publishes its own annual report, and they do not count things the same way. The DPC counts new cases from individuals, the CNIL and AEPD count complaints, and the CNPD gives complaints received and handled. The table shows each figure as the authority published it for calendar year 2025.
| Authority | Complaints or cases | Breach notifications | Fines |
|---|---|---|---|
| DPC, Ireland 2 | 16,160 new cases 2 | 6,521 valid notifications 2 | Just over €530.77 million 2 |
| CNIL, France 3 | 20,150 complaints 3 | 6,167 3 | 83 sanctions, nearly €487 million 3 |
| AEPD, Spain 5 | 30,931 complaints 5 | Not given in the press release 5 | €48,108,765 5 |
| CNPD, Luxembourg 4 | 846 received, 1,909 handled 4 | 425 4 | Not given in the summary 4 |
Where the large fines come from
A few cases drive most totals. Two DPC fines against TikTok accounted for €530 million of Ireland's 2025 total 2. The CNIL said two significant sanctions made up much of its 2025 total 3. Its published list shows a €325 million fine on a company running several online services and a €150 million fine on an online clothing retailer, both dated 1 September 2025 8.
Many sanctions are small. Most of the CNIL's 83 sanctions in 2025 were under its simplified procedure, with amounts from a few thousand euros 8. In Spain, fines from data breach procedures came to €19,836,603, about 40% of the AEPD's 2025 total 5.
Lead authorities and cross-border cases
Under the GDPR one-stop shop, the authority where a company has its main EU establishment leads a cross-border case and others take part as concerned authorities. The Commission counted almost 2,400 cross-border case entries in the EDPB's system, around 1,500 draft decisions and 990 final decisions finding an infringement 1.
The DPC had 53 cross-border inquiries among 87 on hand at the end of 2025 6. The AEPD led 47 cross-border cases in 2025 and took part in 419 as a concerned authority 5. The CNIL submitted almost 80 decisions to other authorities and adopted 4 sanctions in cooperation 3.
Staff, budgets and handling times
Between 2020 and 2024, staff rose at all but two authorities, by more than 25% in 14 Member States. Budgets rose at all but one authority. Cyprus had the largest budget rise at 130%, and Greece's budget fell by 15% 1.
Median complaint handling times ranged from 1 to 12 months. Denmark had the shortest median at 1 month, followed by Spain at 1.5 months 1. Germany launched the most own-initiative investigations, 7,647 1.
Changes from April 2027
Regulation (EU) 2025/2518 adds common procedures for cross-border cases. It gives lead authorities 15 months to send a draft decision, with one extension of up to 12 months. It applies from 2 April 2027 7.
Common questions
Which EU data protection authority has fined the most?
By total amount, Ireland, at about €2.8 billion in the Commission's July 2024 report. By number of fines, Germany, with 2,106 1.
Which EU authority receives the most complaints?
In the 2022 data used by the Commission, Germany had about 32,300 complaints 1. For 2025, Spain's AEPD reported 30,931 complaints, the highest in its history 5.
Rules and charges change. Check the official source linked on this page before you pay or travel. Spotted an error? Email hello@breachandfinetracker.com.
Sources
- European Commission: Second Report on the application of the General Data Protection Regulation, COM(2024) 357 final (25 July 2024)
- Data Protection Commission: Data Protection Commission Publishes Annual Report for 2025 and Results of "Sharenting" Survey (30 June 2026)
- CNIL: Annual report, CNIL's achievements and key actions in 2025 (19 May 2026)
- CNPD: Annual report 2025, The CNPD strengthens its commitment to a trustworthy digital environment (10 July 2026)
- AEPD: La Agencia recibió más de 30.000 reclamaciones en 2025, un 64% más que el año anterior (6 May 2026)
- Data Protection Commission: Annual Report 2025 (undated)
- EUR-Lex: Regulation (EU) 2025/2518 laying down additional procedural rules on the enforcement of Regulation (EU) 2016/679 (26 November 2025)
- CNIL: Les sanctions prononcées par la CNIL (14 April 2026)
Related
- Largest GDPR fines and their appeal status
Large GDPR fines from regulators' own records, from the €1.2 billion Meta decision to Uber and TikTok, with the appeal status each record shows.
- How GDPR fines are calculated
The GDPR fine ceilings, the Article 83 factors and the EDPB five-step method, with seriousness levels, turnover bands and real decisions.
- How long data protection investigations take
Legal deadlines and recorded timelines for data protection complaints, inquiries and court cases in the EU, Ireland, Norway, Australia and Canada.
- Data breach statistics by sector
Official breach notification counts by sector and cause from regulators in Australia, Canada, Ireland, France, Spain and Luxembourg, with periods.
- Data protection fines reduced or cancelled on appeal
Court rulings that cut, cancelled or upheld privacy fines in Germany, France, Luxembourg, Italy, Ireland, the UK and South Korea, with dates.
- How the GDPR one-stop-shop works
How a single lead supervisory authority handles cross-border GDPR cases, how authorities cooperate and how the EDPB resolves disputes.
- How Ireland's Data Protection Commission enforces the GDPR
The DPC's role as EU lead authority, its 2025 fines including the 530 million euro TikTok decision, and how the EDPB can require a higher fine.