GDPR Enforcement Heat Map Q2 2026: Which DPAs Are Fining, What For, and Who's Next

The headline trend: enforcement is not plateauing. The 22% year-over-year increase in daily breach notifications, combined with EDPB coordination that is broadening fine values across smaller national DPAs, means the H2 2026 fine pipeline is already larger than it was at the same point in 2025.

What the €7.1 billion headline figure actually means — and why it misleads if read flat:

The aggregate is dominated by a small number of mega-fines. Meta's €1.2 billion transfer-violation penalty alone accounts for roughly 17% of all GDPR fine value ever issued. Strip out the five largest decisions on record — Meta (€1.2B), Amazon (€746M, since procedurally annulled), TikTok (€530M), Uber (€290M), and Criteo's predecessor case — and the remaining 2,680 cases average approximately €1.8 million per fine. This distinction matters operationally: a mid-sized organization is statistically far more likely to face a six- or seven-figure enforcement action than a billion-euro one, and compliance planning calibrated only to headline mega-fines will systematically underweight the actual, far more common risk profile.

Key GDPR Enforcement Statistics — Q2 2026 Snapshot:

• Cumulative GDPR fines since May 25, 2018: €7.1 billion
• GDPR fines issued in 2025 alone: €1.2 billion
• Average fine across all 2,685 verified cases: €2.36 million
• Average fine excluding the five largest mega-fines: approximately €1.8 million
• Daily breach notifications received by EU DPAs in 2026: 443 (up 22% year-over-year)
• DPAs participating in the EDPB's 2026 Coordinated Enforcement Framework: 25
• Spain's AEPD 2025 fine total: €40 million across 299 fines (up 14% from 2024)
• Ireland's DPC cumulative fine value: €4.04 billion (the dominant figure cited across nearly every enforcement tracker; one outlier source has reported €2.8 billion without a disclosed methodology, which we treat as unverified pending a published source)

The DPA Heat Map: Scoring Each Authority Q2 2026

Secure Privacy's DPA Heat Map scores each major supervisory authority on three dimensions: Fine Frequency (volume of enforcement actions Q1–Q2 2026), Escalation Signal (whether fine values are increasing, decreasing, or stable), and Forward Focus (whether the DPA has published or signaled a specific enforcement priority for H2 2026).

Reading the heat map:
🔴🔴 Extreme = highest probability of significant enforcement action in H2 2026 based on current trajectory.
🔴 Very High = active enforcement with documented pipeline.
🟠 High = elevated activity with specific sector signals.
🟡 Medium = baseline enforcement, no specific escalation signals identified.

The Q2 2026 Case Register: What Actually Happened

The following Q2 2026 enforcement actions are sourced from verified DPA press releases and the CMS Enforcement Tracker database.

Spain (AEPD) — Q2 2026 Pattern

Spain's AEPD ended Q1 2026 in full acceleration mode and has carried that posture into Q2. The defining enforcement shift: the AEPD has moved beyond its historical pattern of high-volume, low-value consumer complaints into deliberate, high-value strategic enforcement.

Key Q1–Q2 2026 AEPD actions establishing the Q2 pattern:

• FC Barcelona — €500,000 (March 4, 2026): Deficient biometric data DPIA. Significant because it is a sports/entertainment sector case, not telecom or finance — signalling AEPD sector expansion.
• Yoti Ltd — €950,000 (March 10, 2026): UK-based digital identity company fined for three distinct GDPR violations including biometric processing without legal basis and inadequate transparency. Landmark ruling for age verification providers across all sectors.
• AENA — €1.8 million (November 2025, establishing Q2 pattern): Airport operator fined for facial recognition failures — Article 35 DPIA violation, mirroring the pattern that produced Spain's largest-ever fine (€10 million against AENA for insufficient DPIA under Art. 35).

AEPD Q2 2026 signature: Biometric data (Art. 9), DPIA failures (Art. 35), and AI system processing (the AEPD has confirmed it can act under GDPR against prohibited AI systems before Spain's national AI legislation is finalized). In 2025 the AEPD issued 299 fines totaling €40 million — a 14% increase from 2024's record. Q2 2026 is tracking at or above that pace.

The AEPD's largest Q2 2026 action to date reinforces a pattern distinct from biometrics: B2B data reuse without transparency. Amadeus IT Group was fined €18 million (reduced to €14.4 million following voluntary payment) on May 26, 2026, for using airline and travel agency booking data to profile travelers without a valid Art. 6 legal basis and without informing data subjects under Art. 14 — a violation pattern specifically relevant to any B2B platform that receives personal data through intermediaries rather than directly from individuals. Amadeus has stated it will appeal.

Netherlands (AP) — Q2 2026 Pattern

The Dutch AP delivered Q2 2026's most geopolitically significant fine: €100 million against MLU B.V., the European parent of ride-hailing app Yango, announced May 8, 2026, for transferring Finnish and Norwegian users' personal data — including driver's license scans, bank account numbers, and precise location data — to Russia without GDPR-adequate safeguards. The case was investigated jointly with Finnish and Norwegian regulators and represents the first coordinated European GDPR ruling specifically targeting data transfers to Russia.

AP Chair Aleid Wolfsen's public statement on the decision is among the most directly quotable regulatory statements of Q2 2026: "In Russia, personal data is not as well protected as in Europe. This may allow the Russian government to gain access to this data." The fine was calculated against Yandex Group's global turnover of more than €12 billion, illustrating how parent-company revenue — not just the EU subsidiary's revenue — increasingly drives GDPR penalty calculations.

AP Q2 2026 signature: Third-country data transfer adequacy, parent-company turnover-based fine calculation, coordinated multi-DPA investigations. The Yango decision sits alongside the DPC's €530 million TikTok transfer fine as the clearest evidence that cross-border transfer enforcement has shifted from a paperwork exercise to a primary enforcement vector.

Italy (Garante) — Q2 2026 Pattern

The Garante is undergoing a structural enforcement shift. Historically focused on telecommunications, marketing consent, and employment data, it has in Q2 2026 become the most active European DPA on AI-related GDPR enforcement.

Key case establishing the pattern:

• AI provider — €5 million (ETid-2611, 2026): The CMS Enforcement Tracker Report 2026 specifically cites this as the first significant European fine for AI-related GDPR violations. The Garante found unlawful personal data processing in the context of an AI system's training data. This is the opening case of what will likely be a series.

The EDPB's harmonization guidelines — encouraging smaller DPAs to align penalty calculations with Irish and French levels — have been adopted by the Garante faster than any other EU authority. The practical effect: Garante fines that previously maxed out in the low millions are now calibrated to the same frameworks that produced the DPC's €530 million TikTok decision.

Garante Q2 2026 signature: AI training data (GDPR + EU AI Act intersection), telecom marketing consent, employment data processing. The Garante has explicitly signalled that AI governance and GDPR compliance are no longer separable in its enforcement approach.

France (CNIL) — Q2 2026 Pattern

CNIL ended 2025 with two landmark decisions in September — Google €325 million and SHEIN €150 million — both for cookie consent failures and dark patterns. Q2 2026 has been comparatively quieter on major individual decisions, but CNIL's structural enforcement focus has sharpened.

CNIL is the lead European authority on the EDPB's 2026 Coordinated Enforcement Framework (CEF) action on transparency obligations under Articles 12–14 GDPR. This gives CNIL disproportionate influence over how the CEF investigation results translate into enforcement actions across 25 DPAs in H2 2026.

CNIL Q2 2026 signature: Privacy notice adequacy, consent flow transparency, cookie dark patterns. Any organisation receiving a CEF questionnaire from any DPA is effectively participating in a coordinated investigation coordinated by CNIL's approach.

Ireland (DPC) — Q2 2026 Pattern

The DPC's headline enforcement position has not changed: it remains the highest-value enforcer globally, with €4.04 billion in cumulative fines reflecting its One-Stop-Shop role for most major US tech platforms. The Amazon fine annulment in Luxembourg (March 2026) has no bearing on DPC cases — the annulment was on procedural grounds specific to Luxembourg's administrative process.

What has changed in Q2 2026: the DPC has opened investigations specifically targeted at GPAI (General-Purpose AI) transparency obligations under the EU AI Act, which became mandatory in August 2025. These are new enforcement territory — the first GDPR-adjacent AI Act investigations by any EU DPA — and will produce decisions in H2 2026 or early 2027.

DPC Q2 2026 signature: GPAI transparency, cross-border data transfer adequacy, children's data (building on 2023 TikTok precedent). The DPC's pipeline is slower than Spain or Italy but each case is larger.

UK (ICO) — Q2 2026 Pattern

The ICO's Q2 2026 enforcement is defined by two structural changes: the Data (Use and Access) Act 2025, which raised maximum PECR fines from £500,000 to £17.5 million or 4% of global turnover — bringing cookie consent enforcement into the same penalty range as GDPR — and the Reddit £14.47 million fine (February 24, 2026) for children's data failures and absence of age assurance.

The Reddit case has established children's data and age verification as the ICO's primary H2 2026 enforcement theme. Any platform with users under 18 and inadequate age assurance controls is in scope.

ICO Q2 2026 signature: Children's data, age verification, cookie consent (now at GDPR-equivalent fine levels under DUA Act).

The EDPB CEF 2026: The Forward Risk Signal Every Organization Must Act On

This is the single most important forward enforcement signal of H2 2026, and it is being under-reported.

On March 19, 2026, the EDPB formally launched its 2026 Coordinated Enforcement Framework (CEF) action. The topic: compliance with transparency and information obligations under GDPR Articles 12, 13, and 14. Twenty-five DPAs across the EEA are participating. The DPAs are contacting controllers from multiple sectors via enforcement actions and fact-finding questionnaires throughout 2026. Findings will be aggregated and exchanged between DPAs in H2 2026, with follow-up enforcement actions to follow.

What this means in practice:

Articles 12, 13, and 14 cover:

• Art. 12: How information about data processing is presented — in a concise, transparent, intelligible, and easily accessible form, using clear and plain language
• Art. 13: What information must be provided at the point of data collection (purpose, legal basis, retention, rights, international transfers)
• Art. 14: What information must be provided when data is obtained from a source other than the data subject

The CEF investigation is specifically examining whether controllers' privacy notices, consent disclosures, cookie banners, and in-app disclosure flows meet these requirements — in clear and plain language, for real users, not just legal compliance teams.

"The right to be informed is a core element of transparency and data subjects' control over their personal data," the EDPB stated at the March 2026 launch.

The CEF's enforcement trajectory has been consistent across its five years:

Every prior CEF topic has produced enforcement actions. There is no reason to expect 2026 to be different. The difference is that transparency obligations under Arts. 12–14 are universal — they apply to every organization that processes personal data, at every scale, in every sector. This is the broadest CEF sweep since the framework began.

Sector Risk Ranking: H2 2026

Based on Secure Privacy's analysis of DPA enforcement patterns, CEF scope, EDPB harmonization signals, and sector-specific violation frequency from the CMS Enforcement Tracker database, here is the first sector-level risk ranking for GDPR enforcement in H2 2026.

Note on AI sector ranking: This is the fastest-moving category and the one with the least historical enforcement data. The Garante's €5 million AI fine (2026), the DPC's open GPAI investigations, and the EU AI Act's high-risk AI enforcement deadline of August 2, 2026 create a convergent enforcement pressure unlike any other sector. AI companies and AI deployers should treat themselves as operating in the highest-risk regulatory environment in Europe from Q3 2026 onward.

The Four Violation Categories That Will Define H2 2026

Based on DPA signals and CEF 2026 scope, four violation categories will dominate H2 2026 enforcement. These are not predictions — they are the publicly stated priorities of the enforcement bodies themselves, reinforced by the Q2 2026 cases that have already established each pattern.

1. Transparency Failures (Arts. 12–14) — CEF 2026 Direct

The CEF 2026 action is specifically targeting this. What regulators are looking for:

• Privacy notices in legalese rather than clear, plain language
• Notices that describe data categories but not specific purposes or retention periods
• Consent flows that disclose some processing purposes but omit others (particularly AI-related uses, data sharing with third parties, and international transfers)
• Mobile app privacy notices that differ from website notices without justification
• Privacy notices that have not been updated to reflect actual current processing activities

Any organization that has not reviewed its privacy notice architecture since the EDPB launched CEF 2026 (March 19, 2026) is operating in a live investigation environment without having checked its exposure.

2. AI Data Processing — GDPR + AI Act Convergence

The Garante's €5 million AI fine established the category. The pattern being investigated:

• Personal data used to train AI models without a valid GDPR Art. 6 legal basis for that specific purpose
• AI systems that make or materially influence decisions about individuals without meeting Art. 22 transparency requirements
• Biometric data processed by AI systems without Art. 9 explicit consent or equivalent legal basis
• GPAI systems that have not produced the technical documentation required by EU AI Act Art. 53 (mandatory since August 2025)

The convergence risk is compound: a single AI deployment can simultaneously trigger a GDPR Art. 6 violation (insufficient legal basis for training data), an Art. 22 violation (lack of automated decision transparency), an Art. 9 violation (biometric or health data without explicit consent), and an AI Act Art. 53 violation (missing GPAI documentation). Each carries separate fines.

3. Data Subject Rights at Scale — Post-CEF 2025 Pipeline

The CEF 2025 action on the right to erasure (Art. 17) produced its report in February 2026. DPAs are now converting that report's findings into enforcement actions. The most common failure pattern identified:

• Erasure requests acknowledged but not acted on within the 30-day statutory period
• Erasure from primary systems but not from backups, third-party processors, or AI training sets
• Automated systems that cannot process erasure requests (particularly legacy systems and ML pipelines)

Any organization that received a CEF 2025 fact-finding questionnaire and cannot demonstrate that erasure requests reach their AI and data science pipelines — not just their marketing databases — is in the enforcement queue.

4. Third-Country Data Transfers — The Yango Precedent

The Dutch AP's €100 million fine against Yango's European operator (May 2026) establishes a fourth defining H2 2026 enforcement category, distinct from the historic focus on US transfers under Schrems II. The pattern being investigated:

• Personal data transferred to jurisdictions where state security services have legal powers to compel access, without an EU adequacy decision or valid Art. 46 safeguard (standard contractual clauses, binding corporate rules)
• Encryption or pseudonymization claimed as a compliance safe harbor without addressing whether the recipient entity could plausibly re-identify users through organizational means
• Fine calculations based on parent-company global turnover rather than the EU subsidiary's local revenue — a calculation method now established in both the Yango and earlier TikTok decisions

Organizations with data pipelines touching Russia, China, or other third countries without an EU adequacy decision should treat this as an active enforcement vector, not a theoretical risk. The joint Dutch-Finnish-Norwegian investigation model used in the Yango case also signals that cross-border coordination between DPAs — not just within the EU's One-Stop-Shop mechanism, but across EEA members — is becoming a standard enforcement pattern.

What the Enforcement Data Cannot Tell You — A Methodological Note

This analysis is built on verified case data, DPA press releases, and EDPB official communications. It is not a prediction of any specific fine. DPA decision timelines are not deterministic — investigations opened in Q2 2026 may produce decisions in Q4 2026 or Q1 2027 depending on organizational complexity, cross-border cooperation requirements, and DPA resource capacity.

Three things the heat map reflects with high confidence: which DPAs are currently the most active (Spain, Italy, France, Ireland, and now the Netherlands following the Yango decision); which violation categories they are currently investigating (transparency, AI data processing, erasure rights, third-country transfers); and which sectors are statistically over-represented in current investigation pipelines (AI/tech, telecoms, financial services, healthcare).

Three things the heat map cannot predict: the exact timing of specific decisions, whether investigations result in fines or corrective orders, and how individual DPAs will calculate penalty amounts in novel categories like AI system violations.

A note on figure reconciliation: Enforcement statistics vary across secondary sources because trackers use different cutoff dates, different inclusion criteria for fines with incomplete public data, and in some cases undisclosed methodologies. We have found at least one frequently cited figure — Ireland's cumulative fine total — reported at €2.8 billion by one source with no visible citation, against the consistently corroborated €4.04 billion figure from the DLA Piper survey, the CMS Enforcement Tracker, and multiple independent secondary analyses. We report the corroborated figure and flag the discrepancy rather than silently picking one. We recommend the same discipline to any reader cross-referencing enforcement statistics: a figure with no disclosed source or methodology should be treated as unverified, regardless of how widely it circulates.

Primary regulator sources have their own limitations worth noting. CNIL's own public sanctions register, for instance, anonymizes some 2026 entries to organization category rather than company name, meaning even direct primary-source verification sometimes requires cross-referencing the linked legal decision text to resolve full attribution. No single source in this space — primary or secondary — is complete on its own.

The Practical Compliance Checklist: What to Do Before Q3 2026

Based on the CEF 2026 focus and the sector risk ranking above, the following controls are the highest-priority actions before July 1, 2026:

Tier 1 — CEF 2026 Direct Exposure (do immediately)

▢ Audit every privacy notice against Arts. 12, 13, 14 requirements — specifically: are purposes described in plain language, are retention periods specified, are all third-party data sharing arrangements disclosed?

▢ Verify that mobile app privacy notices and website privacy notices are consistent and current

▢ Check that consent flows accurately describe all data uses, including any AI-related processing

▢ Confirm that any processing based on legitimate interest includes an LIA (Legitimate Interest Assessment) and that this basis is correctly disclosed in the privacy notice

Tier 2 — AI Processing Exposure (before August 2, 2026)

▢ Inventory every AI system that processes personal data — including third-party AI tools embedded in your stack

▢ Verify GDPR Art. 6 legal basis for each use of personal data in AI training or inference

▢ Confirm GPAI transparency documentation exists for any GPAI system you deploy (mandatory since August 2025)

▢ Conduct or update DPIAs for high-risk AI systems before August 2, 2026 EU AI Act enforcement deadline

▢ Verify that consent withdrawal signals reach AI pipelines — not just marketing and CRM systems

Tier 3 — Erasure Rights Pipeline (post-CEF 2025)

▢ Test erasure request handling end-to-end — from request receipt to deletion from primary systems, backups, third-party processors, and AI training sets

▢ Document the erasure process with timestamps and evidence

▢ Verify 30-day SLA compliance with a sample of recent erasure requests

Tier 4 — Third-Country Transfer Exposure (the Yango precedent)

▢ Map every data flow to third countries without an EU adequacy decision, including via sub-processors and infrastructure providers

▢ Verify Art. 46 safeguards (SCCs, BCRs) are in place and current for every identified transfer

▢ Confirm any pseudonymization or encryption claimed as a safeguard genuinely prevents re-identification by the receiving entity — not just by an external third party

▢ Review whether any sub-processor or vendor relationship routes data through jurisdictions with state access powers, even if the primary contracting entity is EU-based

Secure Privacy's GDPR compliance platform helps organizations operationalize all three tiers — connecting consent management, DPIA workflows, data subject rights automation, and AI data governance into a single auditable system. Explore Secure Privacy's GDPR compliance tools →

Frequently Asked Questions: GDPR Enforcement H2 2026

Which DPA issues the most GDPR fines?

Spain's AEPD leads by volume with nearly 1,000 fines since 2018 — by far the highest count of any European regulator. Ireland's DPC leads by total fine value at €4.04 billion cumulative, driven by its One-Stop-Shop role for major US tech platforms. Italy's Garante is the fastest-escalating authority in 2026, increasingly aligning its penalty levels with Irish and French decisions under EDPB harmonization guidance.

Which DPA is the most aggressive in 2026?

There is no single answer because "aggressive" means different things depending on the metric. By sheer frequency of enforcement action, Spain's AEPD is the most aggressive — nearly 1,000 fines since 2018 and an accelerating 2025-into-2026 pace. By willingness to issue unprecedented or first-of-category fines, Italy's Garante and the Netherlands' AP are currently the most aggressive — the Garante's first AI-training-data fine and the AP's first coordinated Russia-transfer fine both represent genuinely new enforcement territory rather than incremental escalation of existing patterns. By absolute financial severity per case, Ireland's DPC remains unmatched, though its case volume is comparatively low.

Why is "legitimate interest" as a legal basis so frequently misunderstood, and does it show up in enforcement data?

Yes — legitimate interest (GDPR Art. 6(1)(f)) is one of the most commonly misapplied legal bases in enforcement decisions, and it is a recurring theme in practitioner discussion precisely because the test is fact-specific rather than a simple checkbox. A valid legitimate interest basis requires a documented three-part balancing test: a legitimate purpose, necessity of the processing to achieve it, and confirmation that the organization's interest is not overridden by the individual's rights and freedoms. The Amadeus case illustrates the failure mode clearly — the AEPD found that even where a business rationale existed, the absence of a documented legal basis assessment and adequate transparency under Art. 14 was sufficient grounds for a €18 million fine. Organizations relying on legitimate interest without a documented Legitimate Interest Assessment (LIA) on file are operating with the same exposure that produced this decision.

What is the EDPB CEF 2026 and does it apply to my organization?

The EDPB's 2026 Coordinated Enforcement Framework (CEF) action focuses on GDPR transparency and information obligations under Articles 12, 13, and 14. Twenty-five DPAs across the EEA are participating. The investigation covers controllers in multiple sectors — private and public — and DPAs are contacting organizations directly via fact-finding questionnaires and enforcement actions throughout 2026. If you process personal data of EU residents, you are within scope. If you receive a questionnaire from any participating DPA, you are in an active investigation.

Why is the AI sector rated as the highest risk for H2 2026?

Three factors converge for AI companies and AI deployers in H2 2026: the Garante's €5 million AI-related GDPR fine in 2026 established the violation category; the EU AI Act's high-risk AI system obligations take full effect August 2, 2026, creating a second penalty layer on top of GDPR; and the DPC has opened GPAI-specific investigations that will produce decisions in H2 2026 or early 2027. AI deployments that process personal data are simultaneously exposed to GDPR violations (Arts. 6, 9, 22) and AI Act violations — with each carrying separate fines.

What sectors are most exposed to GDPR enforcement in H2 2026?

Based on Secure Privacy's analysis of the CMS Enforcement Tracker data and DPA forward signals: AI / technology platforms, media and telecoms, financial services, healthcare, and online advertising / adtech represent the five highest-risk sectors. The CEF 2026 transparency action broadens this to include retail, education, and the public sector.

What is the most common GDPR violation leading to fines?

Insufficient legal basis for data processing (Art. 6) is the most frequently cited violation in the CMS Enforcement Tracker database. Transparency failures (Arts. 5, 12–14) are the fastest-growing violation category — reflecting both the CEF 2025 erasure findings and the 2026 CEF transparency focus. In financial value terms, cross-border data transfer violations (Art. 46) dominate, driven by the Meta €1.2 billion and TikTok €530 million decisions.

How does the EU AI Act affect GDPR enforcement from August 2026?

The EU AI Act's high-risk AI system obligations — human oversight, technical robustness, audit logging, and transparency documentation — take full effect August 2, 2026. DPAs enforcing GDPR can simultaneously apply AI Act provisions, creating compound enforcement exposure for organizations deploying high-risk AI systems that process personal data. The Garante and DPC have both explicitly indicated they will coordinate GDPR and AI Act enforcement from Q3 2026 onward.

About This Analysis

This enforcement heat map is produced by Secure Privacy's enforcement intelligence team using the CMS GDPR Enforcement Tracker database (2,685 verified fines, March 2026 edition), EDPB official communications, DPA press releases (including the Dutch AP, Spanish AEPD, and Irish DPC), and the DLA Piper GDPR Fines and Data Breach Survey (January 2026). It is updated quarterly. The next edition will be published in September 2026 covering Q3 enforcement activity.

Secure Privacy's GDPR compliance and consent management platform helps DPOs and legal teams operationalize the controls that enforcement data shows regulators are checking — privacy notice management, consent lifecycle governance, DPIA workflows, data subject rights automation, and AI data governance. Book a compliance review with Secure Privacy →

Related Secure Privacy resources:

• GDPR Fines and Penalties Explained
• AI Governance Framework Tools: Compliance, Risk & Control
• How to Automate Privacy Impact Assessments (PIA & DPIA)
• What Are AI Governance Controls?
• Consent Management Across Websites and Apps