GDPR Fines Analytics 📊

How to read it

Count, total, average and median

Count is the number of published decisions that match, including the ones whose amount was not published. The three money measures use only the decisions that carry an amount. Total is dominated by a handful of very large fines against large technology companies, so it answers the question "where did the money come from" rather than "what does a typical fine look like". For the second question use the median: it is the fine in the middle of the pile, and it is usually in the thousands of euros rather than the millions. The average sits far above the median for the same reason the total is skewed.

Splitting by a second dimension

Choose a second dimension under Split by and each bar is broken into series, for example fines per year split by violation type. Counts and totals are stacked, because they add up. Averages and medians do not add up, so those are drawn side by side instead. At most seven series are drawn with the rest pooled as Other, because more colours than that cannot be told apart reliably.

Articles are counted once per Article

Most decisions cite more than one GDPR Article, usually Art. 5 alongside a more specific one. Grouped by Article, a decision appears under each Article it cites, so the Article bars add up to more than the number of decisions. Only citations of the GDPR itself are counted: a reference to a national statute is left out, and decisions that rest entirely on national law, mostly French cookie cases, show as "No GDPR Article cited".

A log scale for money

Fines run from a few hundred euros to over a billion. On a linear scale one or two bars flatten everything else; the Log option puts each tenfold step at the same distance, so small and large values can be read on one chart. It is offered for the money measures whenever the bars are not stacked.

Downloads and links

Download PNG saves the chart with its title, the active filters and the data date. Download CSV saves the aggregated table behind the chart, not the underlying decisions. Copy link gives you an address that reopens the page on exactly this view, which is the easiest way to share a chart that someone else can then change.

Where the data comes from

Every decision comes from the public GDPR enforcement tracker, which collects fines published by European supervisory authorities since 2018. It is only as complete as what the authorities publish: some countries publish almost everything, some very little, so a high count says as much about publication practice as about enforcement. Two violation labels that the tracker renamed over time, DPO involvement and DPO appointment, are shown as one. The same data sits behind the GDPR Fines Dashboard; to see what a fine might look like at your own organisation's size, use the GDPR Fine Calculator.