Cumulative GDPR fines since 2018 stand at roughly EUR 7.1 billion or EUR 6.11 billion depending on which tracker you read, and the gap between those two numbers is the most instructive thing about GDPR statistics. CMS counts only directly documented cases with complete records, 2,685 of them; DLA Piper surveys 31 jurisdictions including the UK. Meanwhile the faster-moving metric is not money at all: breach notifications rose 22% to an average of 443 a day, passing 400 for the first time since the regulation took effect. The figures below come from the CMS GDPR Enforcement Tracker and DLA Piper’s January 2026 survey.
TL;DR
- Cumulative GDPR fines reach approximately EUR 7.1 billion (DLA Piper, January 2026)
- The CMS tracker records around EUR 6.11 billion (CMS, 2025/2026)
- CMS documents around 2,685 cases (CMS, 2025/2026)
- That edition added 440 cases on the prior one (CMS)
- It added EUR 487.6 million in newly documented fines (CMS)
- The CMS data cut-off was March 1, 2026 (CMS)
- European authorities issued roughly EUR 1.2 billion in fines during 2025 (DLA Piper)
- That equals roughly USD 1.42 billion or GBP 1.06 billion (DLA Piper)
- The first half of 2026 added more than EUR 600 million (industry tracking)
- Breach notifications rose 22% year over year (DLA Piper)
- Average daily notifications reached 443 (DLA Piper)
- That is the first time the daily average exceeded 400 since 2018 (DLA Piper)
- DLA Piper surveys 31 jurisdictions including the UK (DLA Piper)
1. Two Totals, Both Correct
Any article quoting a single cumulative GDPR figure has silently picked a methodology. DLA Piper’s January 2026 survey puts the total since 2018 at approximately EUR 7.1 billion, while the CMS Enforcement Tracker records around EUR 6.11 billion, a difference of roughly a billion euros. CMS applies a stricter evidentiary standard and a hard cut-off; DLA Piper casts a wider jurisdictional net.
| Metric | Value | Source |
|---|---|---|
| Cumulative fines since 2018 | approx. EUR 7.1 billion | DLA Piper, January 2026 |
| Cumulative documented fines | approx. EUR 6.11 billion | CMS, 2025/2026 |
| Difference between the two figures | approx. EUR 1 billion | Derived |
| CMS counting standard | directly documented, complete records only | CMS |
| CMS data cut-off | March 1, 2026 | CMS |
| DLA Piper jurisdictional scope | 31 jurisdictions including the UK | DLA Piper |
| Documented cases in the CMS tracker | approx. 2,685 | CMS |
| Nature of both publications | law firm research, not official EU statistics | Derived |
Neither figure is authoritative in the way an official statistic would be, because no EU body publishes a consolidated bloc-wide enforcement total. Both trackers exist precisely to fill that gap.
That absence is itself the notable fact. GDPR is enforced by national supervisory authorities in each member state, each publishing on its own schedule, in its own language, at its own level of detail. Some publish full decisions, others announce only the headline penalty, and a few disclose almost nothing until litigation forces it. There is no central register that a regulator, a journalist, or a compliance team can query. The consequence is that the most widely cited numbers about Europe’s flagship privacy regulation come from two commercial law firms doing voluntary aggregation work, and the roughly one billion euro discrepancy between them is the visible cost of that arrangement. Source: DLA Piper GDPR Fines and Data Breach Survey, January 2026.
2. Case Volume Is Growing Faster Than Value
Counting cases rather than euros gives a different picture of enforcement intensity. The CMS tracker added 440 cases and EUR 487.6 million in its most recent edition, reaching around 2,685 documented cases in total. That works out to an average documented fine well under EUR 3 million, which means the cumulative headline is driven by a small number of very large penalties rather than by broad-based severity.
| Metric | Value | Source |
|---|---|---|
| Documented cases, cumulative | approx. 2,685 | CMS |
| Cases added in the latest edition | 440 | CMS |
| Fine value added in the latest edition | EUR 487.6 million | CMS |
| Average fine in the latest tranche | approx. EUR 1.1 million | Derived from CMS figures |
| Cumulative documented fine value | approx. EUR 6.11 billion | CMS |
| Implied average across all cases | approx. EUR 2.3 million | Derived from CMS figures |
| Data cut-off | March 1, 2026 | CMS |
| Distribution shape | driven by a few very large penalties | Derived |
The gap between the EUR 1.1 million average in the newest tranche and the EUR 2.3 million average across all cases suggests recent enforcement has skewed toward smaller, more routine penalties. Source: CMS and DLA Piper enforcement data as compiled in industry analysis.
3. The Annual Pace
Single-year figures are more useful than cumulative ones for judging where enforcement is heading. European supervisory authorities issued approximately EUR 1.2 billion in fines during 2025, and the first six months of 2026 have already added more than EUR 600 million. That first-half pace annualises to roughly the 2025 level, meaning enforcement has plateaued at a high level rather than continuing to accelerate.
| Metric | Value | Source |
|---|---|---|
| Fines issued during 2025 | approx. EUR 1.2 billion | DLA Piper |
| Equivalent in US dollars | approx. USD 1.42 billion | DLA Piper |
| Equivalent in pounds sterling | approx. GBP 1.06 billion | DLA Piper |
| Added in the first half of 2026 | more than EUR 600 million | Industry tracking |
| Implied annualised 2026 pace | roughly EUR 1.2 billion | Derived |
| Direction versus 2025 | broadly flat | Derived |
| Cumulative total, DLA Piper basis | approx. EUR 7.1 billion | DLA Piper |
| Years since the regulation took effect | 8 | Derived |
A flat annual pace at EUR 1.2 billion is arguably the maturity signal for this regime: enforcement is now routine and predictable rather than episodic, which is what compliance teams need in order to budget for it. Regulatory context sits in our AI regulation statistics. Source: Compliance analysis of GDPR enforcement at the 2026 midpoint.
4. Breach Reporting Is the Faster-Moving Metric
Fines get the coverage; notifications describe the actual compliance burden. Breach notifications rose 22% year over year to an average of 443 per day, the first time the daily average has exceeded 400 since the regulation took effect in 2018. For most organisations, notification obligations are a far more frequent GDPR touchpoint than any enforcement action.
| Metric | Value | Source |
|---|---|---|
| Average daily breach notifications | 443 | DLA Piper |
| Year-over-year increase | 22% | DLA Piper |
| Significance of the 400 threshold | first time exceeded since 2018 | DLA Piper |
| Implied annual notifications | approx. 161,700 | Derived from DLA Piper figures |
| Documented enforcement cases, cumulative | approx. 2,685 | CMS |
| Ratio of annual notifications to cumulative cases | roughly 60 to 1 | Derived |
| Jurisdictions surveyed | 31, including the UK | DLA Piper |
| Survey publication | January 2026 | DLA Piper |
That 60-to-1 ratio between a single year of notifications and eight years of documented fines is the clearest statement of what GDPR actually does day to day: it is a reporting regime far more than a penalty regime. Breach context sits in our data breach statistics. Source: DLA Piper GDPR Fines and Data Breach Survey 2026.
5. What the Trackers Cannot Tell You
Both datasets share limitations worth stating before citing either. Neither is an official EU statistic, both depend on what supervisory authorities choose to publish, and fines under appeal are counted differently across sources. A headline penalty announced today may be reduced or annulled years later without the trackers being revised.
| Metric | Value | Source |
|---|---|---|
| Official EU consolidated total | none published | Derived |
| CMS basis | directly documented cases only | CMS |
| DLA Piper basis | survey across 31 jurisdictions | DLA Piper |
| Difference between the two totals | approx. EUR 1 billion | Derived |
| Treatment of fines under appeal | varies by source | Derived |
| CMS cut-off date | March 1, 2026 | CMS |
| DLA Piper publication month | January, annually | DLA Piper |
| Cumulative range across sources | EUR 6.11bn to EUR 7.1bn | CMS, DLA Piper |
The practical guidance is to cite a range rather than a point estimate, and to name the tracker whenever a specific figure is used. There is one further distortion worth knowing about: cumulative totals are dominated by a handful of very large penalties against a few large technology companies, several of which remain under appeal years after announcement. Remove three or four of those cases and the cumulative figure falls by a substantial fraction, which means the headline total describes a small number of exceptional enforcement actions rather than the typical experience of a company subject to the regulation. Privacy attitudes context sits in our digital privacy statistics. Source: EU regulatory enforcement tracking.
Summary: GDPR Fines by the Numbers
| Metric | Value | Source |
|---|---|---|
| Cumulative fines since 2018 | approx. EUR 7.1 billion | DLA Piper |
| Cumulative documented fines | approx. EUR 6.11 billion | CMS |
| Difference between the two | approx. EUR 1 billion | Derived |
| Documented cases | approx. 2,685 | CMS |
| Cases added in the latest edition | 440 | CMS |
| Fine value added | EUR 487.6 million | CMS |
| Average fine in the latest tranche | approx. EUR 1.1 million | Derived |
| Implied average across all cases | approx. EUR 2.3 million | Derived |
| Fines issued during 2025 | approx. EUR 1.2 billion | DLA Piper |
| Added in the first half of 2026 | more than EUR 600 million | Industry tracking |
| Implied annualised 2026 pace | roughly EUR 1.2 billion | Derived |
| Average daily breach notifications | 443 | DLA Piper |
| Year-over-year notification increase | 22% | DLA Piper |
| Implied annual notifications | approx. 161,700 | Derived |
| Jurisdictions in the DLA Piper survey | 31 | DLA Piper |
| CMS data cut-off | March 1, 2026 | CMS |
Methodology and Sources
- Cumulative totals, annual enforcement values, breach notification volumes, and jurisdictional scope come from DLA Piper’s GDPR Fines and Data Breach Survey published January 2026 (survey, survey briefing).
- Case counts, documented fine values, and the March 1, 2026 cut-off come from the CMS GDPR Enforcement Tracker Report 2025/2026 as compiled in industry analysis (Kiteworks, ComplianceHub, PrivacyEngine, EU enforcement tracker).
- Data watch: no EU institution publishes a consolidated enforcement total, so both headline figures are law firm research rather than official statistics, and they are constructed differently. CMS counts only fines it can document completely and applies a hard cut-off; DLA Piper surveys supervisory authorities across 31 jurisdictions including the UK, which is no longer an EU member but retains a GDPR-derived regime. The roughly EUR 1 billion gap between them is methodological, not an error in either. Fines under appeal are treated inconsistently across sources and headline penalties are sometimes reduced or annulled years later without retrospective revision to published totals. The first-half 2026 figure is a running tally rather than a completed period. Rows marked as derived are arithmetic on published figures.
- Last updated: August 2, 2026. We update this roundup quarterly, and the next major refresh is expected when DLA Piper publishes its January 2027 survey.