The maximum penalty for GDPR violations is 4% of global revenue or €20 million, whichever is higher. Data protection authorities can also issue sanctions, such as bans on data processing or public reprimands.

Some notable examples of GDPR fines so far:

Fines have been observed in Portugal, Germany, France, Poland, Italy, Norway, Lithuania, Belgium, Spain, Denmark, the UK, Romania, Turkey, Greece, Sweden, Hungary, Austria, and Latvia.