GDPR Fines Reach €1.2 Billion in 2025 Amid Rising Data Breaches
- Securityish
- Privacy & Personal Security
Quick Summary
In 2025, GDPR fines in Europe surpassed €1.2 billion, driven by over 400 daily data breach notifications. The Irish Data Protection Commission issued the largest fine of €530 million against TikTok for unlawful data transfers. This increase in fines and breach reports highlights ongoing cybersecurity challenges and regulatory pressures faced by organizations.
The Securityish Brief
In 2025, GDPR fines across Europe totaled approximately €1.2 billion, marking a slight increase from €996 million in 2024. The DLA Piper GDPR Fines and Data Breach Survey revealed that data protection authorities received an average of 443 personal data breach notifications daily, up 22 percent from the previous year. This surge in breach reports indicates a growing trend in data incidents since the regulation’s inception in May 2018.
The Irish Data Protection Commission remains the most active regulator, with cumulative fines reaching €4.04 billion since GDPR enforcement began. In 2025, they issued a significant €530 million penalty to TikTok for unlawful international data transfers, although this fine did not surpass the record €1.2 billion fine imposed on Meta in 2023. Big tech companies continue to be the primary targets for these penalties, with nine of the ten largest GDPR fines involving them.
Implications for Organizations
The increase in fines and breach notifications serves as a critical warning for organizations to enhance their cybersecurity measures. The combination of geopolitical tensions, frequent cyber incidents, and the availability of attack tools complicates compliance with GDPR and other emerging regulations like NIS2 and DORA. Organizations must now navigate a complex landscape of incident reporting requirements, which raises the stakes for timely and accurate disclosures.
Ross McKean, chair of DLA Piper’s UK data, privacy, and cybersecurity practice, emphasized that these statistics should prompt organizations to optimize their cyber defenses and operational resilience. As regulatory scrutiny intensifies, businesses must be proactive in assessing their risk posture and ensuring compliance with existing and forthcoming laws.
With the rise in personal data breach notifications, organizations should prioritize employee training on data protection and incident response. The current environment necessitates vigilance in monitoring for potential breaches and ensuring that all data handling practices are compliant with GDPR standards.
Key Takeaways
- Review your organization’s data handling practices to ensure compliance with GDPR and other regulations.
- Implement regular training for employees on data protection and incident response protocols.
- Establish a robust incident reporting system to quickly address any data breaches.
- Monitor updates on emerging regulations like NIS2 and DORA that may impact your compliance obligations.
- Conduct regular assessments of your cybersecurity measures to identify and mitigate potential vulnerabilities.
Key Terms & Concepts
- GDPR: In this article, GDPR refers to the General Data Protection Regulation, a comprehensive data privacy law in the European Union.
- DLA Piper: DLA Piper is a global law firm that published the GDPR Fines and Data Breach Survey detailing fines and breach notifications.
- NIS2: NIS2 is a directive aimed at improving cybersecurity across the EU, impacting incident reporting requirements for organizations.
- DORA: DORA stands for the Digital Operational Resilience Act, which sets standards for the digital resilience of financial entities in the EU.
Read the original article here: https://go.theregister.com/feed/www.theregister.com/2026/01/22/europes_gdpr_cops_dished_out/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
