The regulator hit the messaging app with a fine of 225 million euros, about $267 million.
Partly at issue is how WhatsApp share information with parent company Facebook, according to the commission.
The decision brings an end to a GDPR inquiry the privacy regulator started in December 2018.
WhatsApp said it disagrees with the decision and plans to appeal.
