GDPR Enforcement Timeline — 2018 to 2026
Timeline of major GDPR enforcement actions from 2018 to 2026. Trends showing increased focus on mid-market non-EU companies.
GDPR enforcement has evolved dramatically since May 2018. The early years targeted Big Tech; recent years show a clear shift toward mid-market companies. Understanding this timeline helps non-EU businesses assess their risk.
2018-2019: The Early Years
2018: The first GDPR fines were modest. Google received EUR 50 million from CNIL (France) for lack of transparency and valid consent — a signal that regulators meant business.
2019: Fines remained focused on major companies. Hungary’s DPA fined a data broker. The UK ICO started major investigations. This period established the enforcement pattern: start with the biggest, then broaden.
2020-2021: Big Tech Focus
2020: EUR 35 million fine for H&M (Germany) for unlawful employee monitoring. EUR 18 million for Italian telecom companies. The Belgian DPA fined IAB Europe EUR 250,000 for Transparency & Consent Framework violations.
2021: The landmark Luxembourg DPA decision fined Amazon EUR 746 million (later reduced on appeal). WhatsApp received EUR 225 million in Ireland. These fines demonstrated the 4% turnover calculation in practice.
2022-2023: Expansion Beyond Tech
2022: Meta received cumulative fines exceeding EUR 1 billion across multiple decisions. TikTok fined EUR 12 million. But more importantly, regulators began targeting non-tech sectors.
2023: Meta’s EUR 1.2 billion fine for US data transfers (Schrems II violation). Clearview AI received cumulative fines exceeding EUR 20 million across multiple EU states. This was the year non-EU companies without EU Representatives started feeling direct enforcement pressure.
2024-2026: Mid-Market Enforcement
2024: EU DPAs explicitly announced mid-market enforcement priorities. Several non-EU SaaS and e-commerce companies received formal inquiries regarding Article 27 compliance.
2025: The trend accelerated. GDPR enforcement saw record total fines exceeding EUR 5 billion. National DPAs increasingly cooperated through the One-Stop-Shop mechanism, and non-EU companies without EU Representatives became a stated priority for several regulators.
2026: The pattern is clear: regulators start with structured enforcement programs targeting specific sectors and regions. Non-EU companies without Article 27 representatives are at increasing risk.
Ready to get compliant?
€490/year. 15-minute setup. Active next business day.