Monthly report · in progress
Data protection fines so far in October 2026
- Actions
- 27
- Total (USD, approx.)
- $1.67B
- Largest
- €825M
- Uber
- Most active regulator
- Italian Data Protection Authority
- 3 actions
October 2026 in brief
- How many data protection and cybersecurity fines have been reported so far in October 2026?
- Compliance Signal recorded 27 fines and penalties so far in October 2026, worth about $1.67B in total (US dollars at approximate exchange rates), from 16 regulators in 9 countries.
- What was the largest fine so far in October 2026?
- The largest was €825M against Uber by Autoriteit Persoonsgegevens (Netherlands).
- Which framework had the most enforcement so far in October 2026?
- GDPR, with 14 actions worth about $1.31B.
- What were organisations most often fined for so far in October 2026?
- Security failure — 10 actions out of 27.
Largest actions
- Uber€825M
Autoriteit Persoonsgegevens · Netherlands · Unlawful processing
- Google€325M
French data protection authority · France · Unlawful processing
- General Motors$220M
Coalition of state attorneys general · United States · Unlawful processing
- Conduent Business Services LLC$80M
SEC · United States · Security failure
- $32M
By framework
| Name | Actions | Total (USD, approx.) |
|---|---|---|
| GDPR | 14 actions | $1.31B |
| NIST CSF | 1 action | $220M |
| HIPAA | 9 actions | $131.8M |
| CCPA | 4 actions | $89.2M |
By country
| Name | Actions | Total (USD, approx.) |
|---|---|---|
| United States | 13 actions | $360.9M |
| Italy | 4 actions | $13.9M |
| France | 2 actions | $361.9M |
| Norway | 2 actions | $18.6M |
| United Kingdom | 2 actions | $16.5M |
| Netherlands | 1 action | $899.2M |
| Ireland | 1 action | $3.5M |
| Greece | 1 action | $218K |
and 1 more
By violation
| Name | Actions | Total (USD, approx.) |
|---|---|---|
| Security failure | 10 actions | $108.1M |
| Unlawful processing | 7 actions | $1.5B |
| Data subject rights | 3 actions | $7.4M |
| Consent | 2 actions | $9.4M |
| Children's data | 1 action | $16.3M |
| Breach notification | 1 action | $800K |
| Transparency | 1 action | $196.2K |
By regulator
| Name | Actions | Total (USD, approx.) |
|---|---|---|
| Italian Data Protection Authority | 3 actions | $13.8M |
| Norwegian Data Protection Authority | 2 actions | $18.6M |
| Information Commissioner’s Office | 2 actions | $16.5M |
| California Attorney General's Office | 2 actions | $7.8M |
| Autoriteit Persoonsgegevens | 1 action | $899.2M |
| French data protection authority | 1 action | $354.3M |
| Coalition of state attorneys general | 1 action | $220M |
| SEC | 1 action | $80M |
and 8 more
All 27 actions
| Date | Organisation | Regulator | Violation | Amount | Details |
|---|---|---|---|---|---|
Uber GDPRTransportation | Autoriteit Persoonsgegevens Netherlands | Unlawful processing | €825M | ||
GDPRTechnology | French data protection authority France | Unlawful processing | €325M | ||
General Motors NIST CSFautomotive | Coalition of state attorneys general United States | Unlawful processing | $220M | ||
Conduent Business Services LLC HIPAACCPAHealthcare services | SEC United States | Security failure | $80M | ||
GoodRx and Criteo settle data breach class action for $32 million HIPAA | — United States | — | $32M | ||
TikTok Information Technologies UK Limited and TikTok Inc GDPRTechnology | Information Commissioner’s Office United Kingdom | Children's data | £12.7M | ||
Xandr Inc GDPRAdvertising technology | Norwegian Data Protection Authority Norway | Unlawful processing | €8.6M | ||
Xandr (Microsoft) GDPRAdvertising technology | Norwegian Data Protection Authority Norway | Unlawful processing | €8.5M | ||
Fnac Darty GDPRRetail | CNIL France | Consent | €7M | ||
IQVIA Solutions Italy S.r.l. GDPRhealth data analytics | Italian Data Protection Authority Italy | Unlawful processing | €7M | ||
American Collection Medical Agency agrees $6.44 million settlement over 27 million data breach HIPAAMedical debt collection | — United States | Security failure | $6.4M | ||
BBVA GDPRBanking | Italian Data Protection Authority Italy | Data subject rights | €5.5M | ||
Chrome Holding Co. CCPAGenetic testing | California Attorney General's Office United States | Security failure | $6M | ||
Washington Gastroenterology HIPAAHealthcare | — United States | Security failure | $4.6M | ||
XTIUM and Boston Children’s Health Physicians HIPAAHealthcare | New York Attorney General and Connecticut Attorney General United States | Security failure | $4M | ||
Coinbase Ireland GDPRCryptocurrency exchange | Irish Data Protection Commission Ireland | Security failure | €3.3M | ||
Jefferson County Health Department HIPAApublic health | — United States | Security failure | $2.3M | ||
Lyft CCPARide‑share | California Attorney General's Office United States | Consent | $1.8M | ||
Tractor Supply Company CCPARetail | California Privacy Protection Agency United States | Data subject rights | $1.4M | ||
Innovative Renal Care settles $900,000 data breach lawsuit HIPAAHealthcare | — United States | Security failure | $900K | ||
Pennsylvania health system HIPAAhealthcare | U.S. Department of Health and Human Services United States | Breach notification | $800K | ||
Lehigh Valley Health Network HIPAAhealthcare | — United States | — | $800K | ||
Elderly Aids Ltd GDPRTelemarketing | Information Commissioner’s Office United Kingdom | Unlawful processing | £190K | ||
Ministry of Social Cohesion and Family Affairs; E.E.T.A.A. GDPRgovernment | Hellenic Data Protection Authority Greece | Security failure | €200K | ||
Emirates GDPRAviation | Italian Data Protection Authority Italy | Transparency | €180K | ||
Miljödata i Karlskrona GDPRIT services | IMY Sweden | Security failure | €160K | ||
La Patria S.p.A. GDPRSecurity | Garante (Italian Data Protection Authority) Italy | Data subject rights | €39K |
Counted from the fines, penalties and settlements in our stories, by the month each was first reported. Amounts are as reported; USD totals use approximate exchange rates. Violation, sector and country are classified automatically — check the source before relying on them. One action can count under more than one framework. This month is still in progress, so the figures will change.