GDPR enforcement in 2026: large fines and new procedures

Published 19 October 2026 · Updated 22 October 2026 · By Dazr

Google fined EUR 403 million over location data, faster cross-border procedures from April 2027, and GDPR changes that are still only proposals.

Eight years after the GDPR started to apply, enforcement keeps producing large decisions, and the way cross-border cases are handled is about to change.

Recent decisions

Uber, EUR 824.99 million (published 8 October 2026). The Dutch Data Protection Authority (AP) found that Uber deactivated drivers' accounts through fully automated decisions, temporarily over suspected fraud or low ratings and permanently over persistently low ratings, in breach of Article 22, and did not inform drivers sufficiently (Article 13). The case began with complaints from 171 French drivers filed with the CNIL and covers 2018 to 2022. Uber has appealed, so the decision is not final.
Google, EUR 403 million (21 September 2026). The Irish Data Protection Commission (DPC), as lead supervisory authority, found that Google infringed the GDPR in the way it processed location data in Web & App Activity, Location History and Location Accuracy: lawfulness and fairness, transparency, accountability and retention. Google must bring the processing into compliance within six months.
TikTok, EUR 530 million (2 May 2025). The DPC found that TikTok did not show that the data of EEA users, accessed remotely by staff in China, had essentially equivalent protection (Article 46(1)), and that its privacy notice did not name the countries involved (Article 13(1)(f)).

Together they show that automated decisions, international transfers, transparency and keeping data no longer than needed are where large fines come from.

Faster cross-border procedures from 2 April 2027

Regulation (EU) 2025/2518 adds procedural rules for cross-border GDPR cases. It was published on 12 December 2025 and applies from 2 April 2027. It harmonises when a complaint is admissible, gives complainants and companies the right to be heard and to see preliminary findings, and sets time limits: in principle 15 months for an investigation, extendable by 12 months for complex cases, and a simpler procedure for straightforward ones. The GDPR's substantive rules do not change.

The Digital Omnibus that the Commission proposed in November 2025 includes changes to the GDPR, such as a higher threshold and a longer deadline for notifying personal data breaches to authorities, and a single reporting point for incidents. The EDPB and the EDPS supported parts of it and raised concerns about others in their joint opinion of February 2026. These are proposals: today's 72-hour breach notification rule still applies.

What to check

Your records of processing and retention periods, especially for location and other sensitive data.
Transfer assessments for any access from outside the EEA, including remote support.
Privacy notices that name recipients and countries clearly.
A breach procedure that meets the 72-hour deadline.
Where software decides about people, such as blocking an account, meaningful human review and a clear explanation for the people affected.

Sources

For information only, not legal advice. Last updated 22 October 2026.

Topics: GDPR, Enforcement, EU

Also available in: Nederlands, Italiano, Deutsch, Français, Español, Polski, Português, Română, Čeština, Slovenčina, Dansk, Svenska, Norsk bokmål