News

German Courts on GDPR Fines Through 2025: A defence Playbook

GDPR fines have matured into a stable enforcement tool, but court decisions increasingly show that the outcome often turns less on “one mistake” and more on governance, attribution and evidence. This note distils the EU and German case-law up to 2025 into a pragmatic defence playbook for controllers and counsel.

By 2025, Art. 83 GDPR can no longer be treated as a purely theoretical deterrent. Publicly available enforcement compilations (including the GDPR Enforcement Tracker) point to a multi-billion-euro fining landscape with thousands of documented decisions in the EU; at the same time, they remind us of an important limitation: publication practices differ across jurisdictions and not every fine is made public, so any aggregates capture the documented—and therefore incomplete—slice of enforcement activity.

In this context, Germany’s relevance is not primarily quantitative. It is doctrinal and practical. German proceedings pushed core questions of corporate fining into the EU legal order, and German courts have continued to show what a defensible compliance posture looks like once it is tested under litigation conditions.

One of the most consequential German proceedings—ultimately triggering a paradigm shift—was Deutsche Wohnen (C-807/21). In its judgment of 5 December 2023, the Court of Justice of the European Union (CJEU) addressed a question that had shaped German defence strategies for years: is a fine against a company conditional upon identifying a specific natural person—typically within senior management—who committed the infringement intentionally or negligently? The Court’s answer re-centres GDPR fining on organisational responsibility. While GDPR obligations are directed at controllers, the Court clarified that an administrative fine imposed on a legal person is not dependent on proving that a particular manager personally committed the infringement under national attribution doctrines. Liability can attach where an infringement occurs in the course of the controller’s activities and within its organisational sphere, including processing carried out on its behalf. At the same time, the Court rejected a strict-liability model: administrative fines under Art. 83 GDPR presuppose that the infringement was committed intentionally or negligently.

This judgment also clarifies the role of the EU-law concept of an “undertaking” in the GDPR fining regime. The Court stressed that the conditions for imposing fines on corporate controllers are exhaustively governed by EU law and cannot be narrowed through national attribution requirements that would weaken the effectiveness and deterrent effect of Art. 83(1) GDPR. Against that backdrop, it explained (by reference to recital 150 and Art. 83(4) to (6) GDPR) that the “undertaking” notion is relevant for the sizing of fines: where the addressee is or forms part of an undertaking within the meaning of Art. 101 and 102 TFEU, the statutory ceiling is calculated by reference to the undertaking’s total worldwide annual turnover. This is not merely terminological. The Court links that approach expressly to the wording of Art. 83(1) GDPR: only a fine that reflects the addressee’s economic capacity can be effective, proportionate and dissuasive. In practical terms, Deutsche Wohnen harmonises the yardstick for fine exposure across the Union and makes group structure—and group-level governance coherence—a genuine compliance variable.

In practice, Deutsche Wohnen shifted the battleground. The question is now less whether a company can be fined only by pinpointing a culpable manager, and more whether exposure and evidence support the authority’s case. For groups, the “undertaking” concept can place turnover-based ceilings in a group-wide context—raising the financial stakes and requiring governance, monitoring and documentation across the group. In contested proceedings, the key issues become whether at least negligence can be established on the facts and whether the organisation can produce a coherent, verifiable governance record that evidences roles, controls and documentation in a way that supports diligence, accountability and proportionality.

German court decisions up to 2025 illustrate how these principles play further out in practice—without reducing each case to a separate “lesson”. The early but still instructive 1&1 decision of the Regional Court of Bonn (LG Bonn, 29 OWi 1/20, 11 November 2020) remains a reference point for judicial scrutiny of fine calibration: courts will not simply endorse administrative fine amounts; they will test fine setting against the specifics of the infringement and the proportionality logic embedded in Art. 83.

By 2025, German case law adds a further, operationally decisive layer: governance evidence can determine outcomes. The Regional Court of Hanover (LG Hannover, 128 OWiLG 1/24, 26 February 2025) is frequently discussed because it illustrates how transparency architecture and documentation discipline—information concepts, internal materials, and demonstrable review processes—can be pivotal where authorities allege deficits in information duties and related compliance arrangements. The point is not that documentation “wins” by itself, but that without it an organisation cannot credibly show diligence, control effectiveness, or the absence of organisational failure once proceedings become adversarial.

Finally, German decisions also underline that fines are not solely an organisational risk. They can become an individual risk where an employee steps outside assigned purposes. The Higher Regional Court of Stuttgart (OLG Stuttgart, 2 ORbs 16 Ss 336/24, 25 February 2025) addresses precisely that boundary: a privately motivated database query may qualify as GDPR-relevant processing and can engage responsibility where a person effectively determines purposes and means for their own ends. For organisations, this has a dual consequence: internal governance must be strong enough to rebut an “organisational failure” narrative, while access governance, logging, and enforcement must be robust enough to isolate genuine “employee excess” scenarios and to demonstrate that controls work in practice.

Taken together, these developments support a simple proposition: the defence playbook is no longer about finding a single doctrinal “silver bullet”. It is about being able to prove—through litigation-grade evidence—that (i) responsibilities were defined and implemented, (ii) risks were assessed and controlled, (iii) transparency obligations were met in a verifiable manner, and (iv) deviations are detected, investigated and remediated.

 

The Defence Playbook (what to build before the authority knocks)

Organisations should assume that any serious fine scenario will be assessed against an evidentiary record. The practical objective is therefore to maintain a standing “defence file” that can be produced quickly and coherently:

1.  Accountability & transparency file: ROPA completeness; lawful-basis rationale; purpose-limitation and retention decisions; recipient disclosures; and Art. 13/14 notices—kept versioned and auditable, with proof of availability at the relevant time.
2. Security & risk dossier: Art. 32 GDPR risk assessment; TOM catalogue mapped to risks; testing/audit outputs; and remediation tickets with timelines.
3. Control environment record: access-control design; privilege reviews; logging coverage; monitoring routines; and documented enforcement actions for policy breaches.
4. Governance mechanics: clear ownership (RACI); DPO involvement where required; escalation routes; management reporting; and internal audit cycles.
5. Group-exposure readiness (where applicable): a clear view of group exposure in turnover-based ceilings and governance alignment across entities, so that compliance reality matches corporate reality.

In 2025 terms, the strategic shift is clear. EU doctrine—shaped in part through German-linked litigation—has strengthened the ability to fine legal persons, while maintaining the requirement of intent or negligence. German courts, in turn, show that this is not a one-way ratchet towards inevitably higher sanctions. Organisations that can evidence functioning governance and compliance processes improve both their liability posture and their leverage on proportionality, mitigation and fine sizing. The most defensible position is therefore not “fine anxiety”, but demonstrable governance capability.

 

Article provided by INPLP members: Juri Knaub and Jens Eckhardt (PITC Legal, Germany)

 

 

Discover more about the INPLP and the INPLP-Members

Dr. Tobias Höllwarth (Managing Director INPLP)