2:"$Sreact.fragment"
3:I[57121,[],""]
4:I[74581,[],""]
9:"static/chunks/8500-63a4afbeacab3b52.js"
a:"static/chunks/app/blog/%5Bslug%5D/error-2b1cab38734e058e.js"
b:I[95037,["8500","$9","2802","$a"],"default"]
12:"ViewportBoundary"
13:I[90484,[],"$12"]
14:"MetadataBoundary"
15:I[90484,[],"$14"]
16:"$Sreact.suspense"
17:I[86869,[],"IconMark"]
6:X
6:C
7:X
d:[["children",{"s":"__PAGE__","h":160,"d":{"r":["$","$2","c",{"children":[[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"Article\",\"headline\":\"GDPR Enforcement Statistics 2018-2025: Complete Data Analysis\",\"description\":\"€5.8 billion in fines across 2,245+ actions. 16 official sources analyzed. Complete breakdown by country, year, industry, and violation type.\",\"author\":{\"@type\":\"Organization\",\"name\":\"BuiltInEu Research Team\",\"url\":\"https://builtineu.eu\"},\"publisher\":{\"@type\":\"Organization\",\"name\":\"BuiltInEu\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https://builtineu.eu/logo.png\"}},\"datePublished\":\"2026-03-18\",\"dateModified\":\"2026-03-18\",\"mainEntityOfPage\":\"https://builtineu.eu/blog/gdpr-enforcement-statistics-2018-2025\",\"image\":\"https://builtineu.eu/blog/gdpr-enforcement-statistics-2018-2025-featured.png\"}"}}],["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"BreadcrumbList\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https://builtineu.eu\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Blog\",\"item\":\"https://builtineu.eu/blog\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"GDPR Enforcement Statistics 2018-2025: Complete Data Analysis\",\"item\":\"https://builtineu.eu/blog/gdpr-enforcement-statistics-2018-2025\"}]}"}}],["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"Dataset\",\"name\":\"GDPR Enforcement Statistics 2018-2025: Complete Data Analysis\",\"description\":\"€5.8 billion in GDPR fines across 2,245+ enforcement actions. Analysis of 7.5 years of data from 16 official sources including 10 national DPAs.\",\"url\":\"https://builtineu.eu/blog/gdpr-enforcement-statistics-2018-2025\",\"creator\":{\"@type\":\"Organization\",\"name\":\"BuiltInEu\",\"url\":\"https://builtineu.eu\"},\"datePublished\":\"2026-03-18\",\"dateModified\":\"2026-03-18\",\"license\":\"https://creativecommons.org/licenses/by/4.0/\",\"distribution\":[{\"@type\":\"DataDownload\",\"encodingFormat\":\"text/csv\",\"contentUrl\":\"https://builtineu.eu/data/gdpr-enforcement-statistics-2018-2025.csv\"},{\"@type\":\"DataDownload\",\"encodingFormat\":\"application/json\",\"contentUrl\":\"https://builtineu.eu/data/gdpr-enforcement-statistics-2018-2025.json\"}],\"variableMeasured\":[{\"@type\":\"PropertyValue\",\"name\":\"Total Data Points\",\"value\":\"87\"}]}"}}],["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"ScholarlyArticle\",\"headline\":\"GDPR Enforcement Statistics 2018-2025: Complete Data Analysis\",\"description\":\"€5.8 billion in fines across 2,245+ actions. 16 official sources analyzed. Complete breakdown by country, year, industry, and violation type.\",\"author\":{\"@type\":\"Organization\",\"name\":\"BuiltInEu Research Team\"},\"publisher\":{\"@type\":\"Organization\",\"name\":\"BuiltInEu\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https://builtineu.eu/logo.png\"}},\"datePublished\":\"2026-03-18\",\"dateModified\":\"2026-03-18\",\"citation\":\"16 sources cited\",\"isAccessibleForFree\":true,\"license\":\"https://creativecommons.org/licenses/by/4.0/\"}"}}],"$Le",null,null,"$Lf"],null,"$L10"]}],"p":"$@11","v":null,"s":"$7"}}]]
8:[["children",{"s":{"n":"slug","t":"d","k":"gdpr-enforcement-statistics-2018-2025","s":[]},"h":96,"d":{"r":["$","$2","c",{"children":[null,["$","$L3",null,{"parallelRouterKey":"children","error":"$b","errorStyles":[],"errorScripts":null,"template":["$","$L4",null,{}]}]]}],"p":"$@c","v":"$6","s":"$7"},"c":"$Qd"}]]
1:[["children",{"s":"blog","h":64,"d":{"r":["$","$2","c",{"children":[null,["$","$L3",null,{"parallelRouterKey":"children","template":["$","$L4",null,{}]}]]}],"p":"$@5","v":"$6","s":"$7"},"c":"$Q8"}]]
0:{"t":{"t":{"s":"","h":16,"c":"$Q1"},"h":{"r":["$","$2","h",{"children":[null,["$","$L13",null,{"children":[["$","meta","0",{"charSet":"utf-8"}],["$","meta","1",{"name":"viewport","content":"width=device-width, initial-scale=1, maximum-scale=5"}]]}],["$","$L15",null,{"children":[["$","div",null,{"hidden":true,"children":["$","$16",null,{"name":"Next.Metadata","children":[["$","title","0",{"children":"GDPR Fines and Enforcement Data 2018-2025: 16 Sources | BuiltInEu"}],["$","meta","1",{"name":"description","content":"€5.8 billion in GDPR fines across 2,245+ enforcement actions. Analysis of 7.5 years of data from 16 official sources including 10 national DPAs."}],["$","meta","2",{"name":"author","content":"BuiltInEu Research Team"}],["$","link","3",{"rel":"manifest","href":"/manifest.json"}],["$","meta","4",{"name":"keywords","content":"EU alternatives,European tech,GDPR compliant,digital sovereignty,privacy-focused,built in EU"}],["$","meta","5",{"name":"robots","content":"index, follow"}],["$","link","6",{"rel":"canonical","href":"https://builtineu.eu/blog/gdpr-enforcement-statistics-2018-2025"}],["$","link","7",{"rel":"alternate","hrefLang":"x-default","href":"https://builtineu.eu/blog/gdpr-enforcement-statistics-2018-2025"}],["$","link","8",{"rel":"alternate","hrefLang":"en","href":"https://builtineu.eu/blog/gdpr-enforcement-statistics-2018-2025"}],["$","meta","9",{"property":"og:title","content":"GDPR Enforcement Statistics 2018-2025: Complete Data Analysis"}],["$","meta","10",{"property":"og:description","content":"€5.8 billion in GDPR fines across 2,245+ enforcement actions. Analysis of 7.5 years of data from 16 official sources including 10 national DPAs."}],["$","meta","11",{"property":"og:url","content":"https://builtineu.eu/blog/gdpr-enforcement-statistics-2018-2025"}],["$","meta","12",{"property":"og:image","content":"https://builtineu.eu/blog/gdpr-enforcement-statistics-2018-2025-featured.png"}],["$","meta","13",{"property":"og:type","content":"article"}],["$","meta","14",{"property":"article:published_time","content":"2026-03-18"}],["$","meta","15",{"property":"article:modified_time","content":"2026-03-18"}],["$","meta","16",{"property":"article:author","content":"BuiltInEu Research Team"}],["$","meta","17",{"property":"article:tag","content":"GDPR"}],["$","meta","18",{"property":"article:tag","content":"Data Protection"}],["$","meta","19",{"property":"article:tag","content":"Statistics"}],["$","meta","20",{"property":"article:tag","content":"Enforcement"}],["$","meta","21",{"property":"article:tag","content":"Privacy Law"}],["$","meta","22",{"property":"article:tag","content":"EU Regulation"}],["$","meta","23",{"name":"twitter:card","content":"summary_large_image"}],["$","meta","24",{"name":"twitter:title","content":"GDPR Enforcement Statistics 2018-2025: Complete Data Analysis"}],["$","meta","25",{"name":"twitter:description","content":"€5.8 billion in GDPR fines across 2,245+ enforcement actions. Analysis of 7.5 years of data from 16 official sources including 10 national DPAs."}],["$","meta","26",{"name":"twitter:image","content":"https://builtineu.eu/blog/gdpr-enforcement-statistics-2018-2025-featured.png"}],["$","link","27",{"rel":"icon","href":"/favicon.ico?976bff429021d8dd","type":"image/x-icon","sizes":"32x32"}],["$","link","28",{"rel":"icon","href":"/icon.png?976bff429021d8dd","type":"image/png","sizes":"32x32"}],["$","link","29",{"rel":"icon","href":"/icon.svg?70a6867a4710df1e","type":"image/svg+xml","sizes":"any"}],["$","link","30",{"rel":"apple-touch-icon","href":"/apple-icon.png?3b6fe46cc3586026","type":"image/png","sizes":"180x180"}],["$","$L17","31",{}]]}]}],null]}],["$","meta",null,{"name":"next-size-adjust","content":""}]]}],"p":"$@18","v":null,"s":"$7"}},"a":"$@19","u":"$@1a","b":"-K1W63BlOFI6l_ydtIie5"}
1c:"static/chunks/6626-6b8e13f97655e70f.js"
1d:"static/chunks/8437-6e083d946181c622.js"
1e:"static/chunks/1543-d8e4dddb134d5f9b.js"
1f:"static/chunks/7932-4831410e8d379c92.js"
20:"static/chunks/5789-b300f5e369e09e3f.js"
21:"static/chunks/6832-c9b526908a778d96.js"
22:"static/chunks/4770-596e9a02a66942c7.js"
23:"static/chunks/3683-edd0fdb1200a94e8.js"
24:"static/chunks/3642-5bb7d719a9acf18e.js"
25:"static/chunks/3208-a390afc8434cf0e3.js"
26:"static/chunks/5874-ef6e2b054c35f10f.js"
27:"static/chunks/app/blog/%5Bslug%5D/page-35fae3d0e23ccdbe.js"
28:I[98500,["8500","$9","6626","$1c","8437","$1d","1543","$1e","7932","$1f","5789","$20","6832","$21","4770","$22","3683","$23","3642","$24","3208","$25","5874","$26","5953","$27"],""]
30:I[90484,[],"OutletBoundary"]
1b:T1333,{"@context":"https://schema.org","@type":"FAQPage","mainEntity":[{"@type":"Question","name":"How much in GDPR fines have been imposed since 2018?","acceptedAnswer":{"@type":"Answer","text":"€5.8 billion across 2,245+ enforcement actions between May 2018 and December 2025. The total has grown every year except 2020 (COVID-related slowdown) and the post-2022 peak. Annual fines have stabilised at roughly €1.2 billion for both 2024 and 2025, down from the 2022 peak of €2.92 billion. These figures are sourced from 16 official and independent sources including 10 national Data Protection Authorities and the European Data Protection Board."}},{"@type":"Question","name":"Which country has issued the most GDPR fines by value?","acceptedAnswer":{"@type":"Answer","text":"Ireland, by a wide margin. Ireland's Data Protection Commission has issued €4.04 billion in GDPR fines, 69.5% of the EU total, from just 152 enforcement actions. This concentration is driven by the \"one-stop-shop\" mechanism in Article 56 of the GDPR, which requires companies to deal with the DPA in the country where their EU headquarters sit. Every major US tech company (Meta, Google, Apple, X/Twitter, Microsoft, Amazon) is headquartered in Ireland for tax reasons, which is why most Big Tech enforcement lands there."}},{"@type":"Question","name":"What is the largest single GDPR fine ever issued?","acceptedAnswer":{"@type":"Answer","text":"€1.2 billion against Meta (Facebook), issued by the Irish DPC in September 2023 for unlawful transfers of EU user data to the United States. The fine is currently under appeal. The next-largest was a separate €746 million fine against Amazon issued by Luxembourg's CNPD in July 2021, also under appeal. Together, the top 10 individual fines account for €5.1 billion, or 88% of all GDPR enforcement value to date."}},{"@type":"Question","name":"Which company has paid the most in GDPR fines?","acceptedAnswer":{"@type":"Answer","text":"Meta. Across five separate cases (Facebook, Instagram, WhatsApp), Meta has been fined a combined €2.75 billion, which is 47.4% of all GDPR fines ever issued. The violations span data transfers, forced consent, transparency failures, and children's data. All five Meta fines were issued by Ireland's DPC under the one-stop-shop mechanism."}},{"@type":"Question","name":"Which type of GDPR violation attracts the largest fines?","acceptedAnswer":{"@type":"Answer","text":"International data transfers. The two major cases in this category averaged €865 million per action, far above the overall €2.5 million average. The category exists because the 2020 Schrems II ruling invalidated the EU-US Privacy Shield, leaving Standard Contractual Clauses alone as insufficient legal grounds for transferring personal data to the United States. Insufficient legal basis violations account for the most fine value overall (€1.86 billion, 32%), while transparency failures are the most frequently violated category by action count (920 actions, 41% of all enforcement)."}},{"@type":"Question","name":"How many data breaches are reported in the EU each year?","acceptedAnswer":{"@type":"Answer","text":"161,695 breach notifications in 2024, an average of 443 per day. That was a 22% increase over 2023 and reverses several years of moderating growth, driven primarily by the rise in ransomware and supply-chain compromises. The Netherlands alone reported 37,839 breaches in 2024 (23% of the EU total) despite representing only 4% of EU population, reflecting the Dutch Autoriteit Persoonsgegevens's strict interpretation of notification thresholds."}},{"@type":"Question","name":"Which industries face the most GDPR enforcement?","acceptedAnswer":{"@type":"Answer","text":"The technology and internet sector accounts for €4.52 billion in fines (77.8% of all fine value) from just 86 enforcement actions, an average of €52.5 million per case. The public sector has the most enforcement actions (980) but only €98 million in total fines, since DPAs rarely fine government entities heavily. Healthcare draws 607 actions concentrated on security breaches and data subject rights, while retail and e-commerce sees high action volumes (725) but small fines focused on marketing and CCTV violations."}},{"@type":"Question","name":"Is GDPR enforcement growing or stabilising?","acceptedAnswer":{"@type":"Answer","text":"Stabilising. After the €2.92 billion peak in 2022, annual GDPR fines have settled at approximately €1.2 billion for both 2024 and 2025. Action counts are also declining slightly, from 542 in 2022 to around 450 in 2025. This pattern suggests enforcement maturity: fewer novel cases requiring large fines, more routine enforcement of established rules. Looking ahead, AI enforcement is expected to dominate 2026-2027 as all major DPAs have established AI task forces and the EU AI Act creates overlapping obligations with GDPR."}}]}e:["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$1b"}}]
f:["$","article",null,{"className":"min-h-screen bg-background","children":[["$","header",null,{"className":"relative overflow-hidden","children":[["$","div",null,{"className":"absolute inset-0 gradient-mesh pointer-events-none"}],["$","div",null,{"className":"container mx-auto px-4 py-12 md:py-16 relative z-10","children":["$","div",null,{"className":"max-w-3xl mx-auto","children":[["$","$L28",null,{"href":"/blog","className":"inline-flex items-center gap-2 text-muted-foreground hover:text-foreground mb-6 transition-colors","children":[["$","svg",null,{"xmlns":"http://www.w3.org/2000/svg","width":24,"height":24,"viewBox":"0 0 24 24","fill":"none","stroke":"currentColor","strokeWidth":2,"strokeLinecap":"round","strokeLinejoin":"round","className":"lucide lucide-arrow-left w-4 h-4","aria-hidden":"true","children":[["$","path","1l729n",{"d":"m12 19-7-7 7-7"}],["$","path","x3x0zl",{"d":"M19 12H5"}],"$undefined"]}],"Back to Blog"]}],["$","div",null,{"className":"flex flex-wrap items-center gap-4 text-sm text-muted-foreground mb-4","children":[["$","$L28",null,{"href":"/blog?category=Data%20%26%20Research","className":"px-3 py-1 rounded-full bg-primary/10 text-primary font-medium hover:bg-primary/20 transition-colors","children":"Data & Research"}],["$","span",null,{"className":"flex items-center gap-1","children":[["$","svg",null,{"xmlns":"http://www.w3.org/2000/svg","width":24,"height":24,"viewBox":"0 0 24 24","fill":"none","stroke":"currentColor","strokeWidth":2,"strokeLinecap":"round","strokeLinejoin":"round","className":"lucide lucide-calendar w-4 h-4","aria-hidden":"true","children":[["$","path","1cmpym",{"d":"M8 2v4"}],["$","path","4m81vk",{"d":"M16 2v4"}],["$","rect","1hopcy",{"width":"18","height":"18","x":"3","y":"4","rx":"2"}],["$","path","8toen8",{"d":"M3 10h18"}],"$undefined"]}],"March 18, 2026"]}],"$undefined",["$","span",null,{"className":"flex items-center gap-1","children":[["$","svg",null,{"xmlns":"http://www.w3.org/2000/svg","width":24,"height":24,"viewBox":"0 0 24 24","fill":"none","stroke":"currentColor","strokeWidth":2,"strokeLinecap":"round","strokeLinejoin":"round","className":"lucide lucide-clock w-4 h-4","aria-hidden":"true","children":[["$","path","mmk7yg",{"d":"M12 6v6l4 2"}],["$","circle","1mglay",{"cx":"12","cy":"12","r":"10"}],"$undefined"]}],"30 min read"]}]]}],["$","h1",null,{"className":"text-3xl md:text-4xl lg:text-5xl font-bold mb-6","children":"GDPR Enforcement Statistics 2018-2025: Complete Data Analysis"}],["$","p",null,{"className":"text-xl text-muted-foreground mb-6","children":"€5.8 billion in fines across 2,245+ actions. 16 official sources analyzed. Complete breakdown by country, year, industry, and violation type."}],["$","div",null,{"className":"flex items-center justify-between","children":[["$","div",null,{"className":"text-sm text-muted-foreground","children":["By"," ",["$","span",null,{"className":"font-medium text-foreground","children":"BuiltInEu Research Team"}]]}],["$","div",null,{"className":"flex items-center gap-2","children":[["$","span",null,{"className":"text-sm text-muted-foreground mr-2","children":"Share:"}],["$","a",null,{"href":"https://www.linkedin.com/sharing/share-offsite/?url=https://builtineu.eu/blog/gdpr-enforcement-statistics-2018-2025","target":"_blank","rel":"noopener noreferrer","className":"p-2 rounded-lg hover:bg-slate-100 transition-colors","aria-label":"Share on LinkedIn","children":["$","svg",null,{"xmlns":"http://www.w3.org/2000/svg","width":24,"height":24,"viewBox":"0 0 24 24","fill":"none","stroke":"currentColor","strokeWidth":2,"strokeLinecap":"round","strokeLinejoin":"round","className":"lucide lucide-linkedin w-4 h-4","aria-hidden":"true","children":[["$","path","c2jq9f",{"d":"M16 8a6 6 0 0 1 6 6v7h-4v-7a2 2 0 0 0-2-2 2 2 0 0 0-2 2v7h-4v-7a6 6 0 0 1 6-6z"}],["$","rect","mk3on5",{"width":"4","height":"12","x":"2","y":"9"}],["$","circle","bt5ra8",{"cx":"4","cy":"4","r":"2"}],"$undefined"]}]}],["$","a",null,{"href":"https://mastodon.social/share?text=GDPR%20Enforcement%20Statistics%202018-2025%3A%20Complete%20Data%20Analysis%20https://builtineu.eu/blog/gdpr-enforcement-statistics-2018-2025","target":"_blank","rel":"noopener noreferrer","className":"p-2 rounded-lg hover:bg-slate-100 transition-colors","aria-label":"Share on Mastodon","children":"$L29"}],"$L2a"]}]]}]]}]}]]}],"$undefined","$L2b","$undefined","$L2c",false,"$L2d","$L2e","$L2f"]}]
10:["$","$L30",null,{"children":["$","$16",null,{"name":"Next.MetadataOutlet","children":"$@31"}]}]
1a:true
33:I[38437,["8500","$9","6626","$1c","8437","$1d","1543","$1e","7932","$1f","5789","$20","6832","$21","4770","$22","3683","$23","3642","$24","3208","$25","5874","$26","5953","$27"],"Image"]
e6:"NewsletterInlineCTA"
e7:I[26455,["8500","$9","6626","$1c","8437","$1d","1543","$1e","7932","$1f","5789","$20","6832","$21","4770","$22","3683","$23","3642","$24","3208","$25","5874","$26","5953","$27"],"$e6"]
7:300
32:T44f,M23.268 5.313c-.35-2.578-2.617-4.61-5.304-5.004C17.51.242 15.792 0 11.813 0h-.03c-3.98 0-4.835.242-5.288.309C3.882.692 1.496 2.518.917 5.127.64 6.412.61 7.837.661 9.143c.074 1.874.088 3.745.26 5.611.118 1.24.325 2.47.62 3.68.55 2.237 2.777 4.098 4.96 4.857 2.336.792 4.849.923 7.256.38.265-.061.527-.132.786-.213.585-.184 1.27-.39 1.774-.753a.057.057 0 0 0 .023-.043v-1.809a.052.052 0 0 0-.02-.041.053.053 0 0 0-.046-.01 20.282 20.282 0 0 1-4.709.545c-2.73 0-3.463-1.284-3.674-1.818a5.593 5.593 0 0 1-.319-1.433.053.053 0 0 1 .066-.054c1.517.363 3.072.546 4.632.546.376 0 .75 0 1.125-.01 1.57-.044 3.224-.124 4.768-.422.038-.008.077-.015.11-.024 2.435-.464 4.753-1.92 4.989-5.604.008-.145.03-1.52.03-1.67.002-.512.167-3.63-.024-5.545zm-3.748 9.195h-2.561V8.29c0-1.309-.55-1.976-1.67-1.976-1.23 0-1.846.79-1.846 2.35v3.403h-2.546V8.663c0-1.56-.617-2.35-1.848-2.35-1.112 0-1.668.668-1.67 1.977v6.218H4.822V8.102c0-1.31.337-2.35 1.011-3.12.696-.77 1.608-1.164 2.74-1.164 1.311 0 2.302.5 2.962 1.498l.638 1.06.638-1.06c.66-.999 1.65-1.498 2.96-1.498 1.13 0 2.043.395 2.74 1.164.675.77 1.012 1.81 1.012 3.12z29:["$","svg",null,{"className":"w-4 h-4","fill":"currentColor","viewBox":"0 0 24 24","children":["$","path",null,{"d":"$32"}]}]
2a:["$","a",null,{"href":"https://bsky.app/intent/compose?text=GDPR%20Enforcement%20Statistics%202018-2025%3A%20Complete%20Data%20Analysis%20https://builtineu.eu/blog/gdpr-enforcement-statistics-2018-2025","target":"_blank","rel":"noopener noreferrer","className":"p-2 rounded-lg hover:bg-slate-100 transition-colors","aria-label":"Share on Bluesky","children":["$","svg",null,{"className":"w-4 h-4","fill":"currentColor","viewBox":"0 0 24 24","children":["$","path",null,{"d":"M12 10.8c-1.087-2.114-4.046-6.053-6.798-7.995C2.566.944 1.561 1.266.902 1.565.139 1.908 0 3.08 0 3.768c0 .69.378 5.65.624 6.479.785 2.627 3.59 3.501 6.204 3.254-3.676.485-6.942 1.754-2.78 6.163 4.96 4.73 6.696-1.189 7.952-4.36.008-.02.013-.04.02-.058.007.018.012.038.02.058 1.256 3.17 2.992 9.09 7.952 4.36 4.163-4.409.897-5.678-2.78-6.163 2.614.247 5.42-.627 6.204-3.254.246-.83.624-5.789.624-6.478 0-.69-.139-1.861-.902-2.206-.66-.298-1.664-.62-4.3 1.24C16.046 4.748 13.087 8.687 12 10.8z"}]}]}]
2b:["$","div",null,{"className":"container mx-auto px-4","children":["$","div",null,{"className":"max-w-4xl mx-auto -mt-4 mb-12","children":[["$","div",null,{"className":"relative aspect-video rounded-2xl overflow-hidden shadow-lg","children":["$","$L33",null,{"src":"/blog/gdpr-enforcement-statistics-2018-2025-featured.png","alt":"GDPR Enforcement Statistics 2018-2025: Complete Data Analysis","fill":true,"className":"object-contain","priority":true}]}],"$undefined"]}]}]
2c:["$","div",null,{"className":"container mx-auto px-4 pb-16","children":["$","div",null,{"className":"max-w-3xl mx-auto","children":["$undefined",["$","div",null,{"className":"prose prose-lg max-w-none","children":[["$","p",null,{"className":"mb-4 leading-relaxed","children":[["$","strong",null,{"children":"Quick answer:"}]," Between May 2018 and December 2025, European data protection authorities imposed €5.8 billion in GDPR fines across more than 2,245 enforcement actions. Ireland issued 69.5% of the total, 2022 was the peak year at €2.92 billion, and 67% of actions ended in fines under €500,000. The dataset below is compiled from 16 sources."]}],"\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":["Since the General Data Protection Regulation (GDPR) took effect on May 25, 2018, European data protection authorities have imposed ",["$","strong",null,{"children":"€5.8 billion in fines"}]," across ",["$","strong",null,{"children":"2,245+ enforcement actions"}],", reshaping how companies handle personal data worldwide."]}],"\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":["But aggregate numbers only tell part of the story. ",["$","strong",null,{"children":"69.5% of all fines"}]," have been concentrated in a single country (Ireland), while ",["$","strong",null,{"children":"42% of enforcement actions"}]," resulted in penalties under €100,000. Big Tech companies face average fines ",["$","strong",null,{"children":"93 times higher"}]," than small businesses, yet compliance costs disproportionately burden SMEs."]}],"\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":["This analysis compiles ",["$","strong",null,{"children":"7.5 years of GDPR enforcement data"}]," from ",["$","strong",null,{"children":"16 official sources"}],", including 10 national Data Protection Authorities, the European Data Protection Board, the European Data Protection Supervisor, and independent research from CMS Law, DLA Piper, IAPP, and academic institutions. We've organized ",["$","strong",null,{"children":"87 individual data points"}]," into a structured dataset, analyzed trends across countries and industries, and identified the enforcement patterns that will shape data protection strategy through 2026."]}],"\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":["The dataset is published under CC BY 4.0 so the numbers can be reused with their sources attached. For context on the regulatory framework driving these numbers, see our guide on ",["$","a",null,{"href":"/blog/what-is-digital-sovereignty","className":"text-primary hover:underline break-words","children":"digital sovereignty in Europe"}],". For the companion catalog of US legal compulsion, sanctions, and forced acquisitions reaching European data, see ",["$","a",null,{"href":"/blog/european-digital-sovereignty-incidents-2018-2026","className":"text-primary hover:underline break-words","children":"European Digital Sovereignty Incidents 2018-2026"}],". For a dataset on the commercial side of European tech, see ",["$","a",null,{"href":"/research/european-ai-index-2026","className":"text-primary hover:underline break-words","children":"The European AI Index 2026"}],", our dated ranking of Europe's largest private AI companies."]}],"\n",["$","h2",null,{"className":"text-2xl font-bold mt-8 mb-4 scroll-mt-20","id":"key-takeaways","children":[["$","a",null,{"href":"#key-takeaways","className":"text-primary hover:underline break-words","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"icon icon-link"}]}],"Key Takeaways"]}],"\n",["$","h3",null,{"className":"text-xl font-bold mt-6 mb-3 scroll-mt-20","id":"headline-numbers","children":[["$","a",null,{"href":"#headline-numbers","className":"text-primary hover:underline break-words","aria-hidden":"true","tabIndex":"-1","children":"$L34"}],"Headline Numbers"]}],"\n","$L35","\n","$L36","\n","$L37","\n","$L38","\n","$L39","\n","$L3a","\n","$L3b","\n","$L3c","\n","$L3d","\n","$L3e","\n","$L3f","\n","$L40","\n","$L41","\n","$L42","\n","$L43","\n","$L44","\n","$L45","\n","$L46","\n","$L47","\n","$L48","\n","$L49","\n","$L4a","\n","$L4b","\n","$L4c","\n","$L4d","\n","$L4e","\n","$L4f","\n","$L50","\n","$L51","\n","$L52","\n","$L53","\n","$L54","\n","$L55","\n","$L56","\n","$L57","\n","$L58","\n","$L59","\n","$L5a","\n","$L5b","\n","$L5c","\n","$L5d","\n","$L5e","\n","$L5f","\n","$L60","\n","$L61","\n","$L62","\n","$L63","\n","$L64","\n","$L65","\n","$L66","\n","$L67","\n","$L68","\n","$L69","\n","$L6a","\n","$L6b","\n","$L6c","\n","$L6d","\n","$L6e","\n","$L6f","\n","$L70","\n","$L71","\n","$L72","\n","$L73","\n","$L74","\n","$L75","\n","$L76","\n","$L77","\n","$L78","\n","$L79","\n","$L7a","\n","$L7b","\n","$L7c","\n","$L7d","\n","$L7e","\n","$L7f","\n","$L80","\n","$L81","\n","$L82","\n","$L83","\n","$L84","\n","$L85","\n","$L86","\n","$L87","\n","$L88","\n","$L89","\n","$L8a","\n","$L8b","\n","$L8c","\n","$L8d","\n","$L8e","\n","$L8f","\n","$L90","\n","$L91","\n","$L92","\n","$L93","\n","$L94","\n","$L95","\n","$L96","\n","$L97","\n","$L98","\n","$L99","\n","$L9a","\n","$L9b","\n","$L9c","\n","$L9d","\n","$L9e","\n","$L9f","\n","$La0","\n","$La1","\n","$La2","\n","$La3","\n","$La4","\n","$La5","\n","$La6","\n","$La7","\n","$La8","\n","$La9","\n","$Laa","\n","$Lab","\n","$Lac","\n","$Lad","\n","$Lae","\n","$Laf","\n","$Lb0","\n","$Lb1","\n","$Lb2","\n","$Lb3","\n","$Lb4","\n","$Lb5","\n","$Lb6","\n","$Lb7","\n","$Lb8","\n","$Lb9","\n","$Lba","\n","$Lbb","\n","$Lbc","\n","$Lbd","\n","$Lbe","\n","$Lbf","\n","$Lc0","\n","$Lc1","\n","$Lc2","\n","$Lc3","\n","$Lc4","\n","$Lc5","\n","$Lc6","\n","$Lc7","\n","$Lc8","\n","$Lc9","\n","$Lca","\n","$Lcb","\n","$Lcc","\n","$Lcd","\n","$Lce","\n","$Lcf","\n","$Ld0","\n","$Ld1","\n","$Ld2","\n","$Ld3","\n","$Ld4","\n","$Ld5","\n","$Ld6","\n","$Ld7","\n","$Ld8","\n","$Ld9","\n","$Lda","\n","$Ldb","\n","$Ldc","\n","$Ldd","\n","$Lde","\n","$Ldf","\n","$Le0","\n","$Le1","\n","$Le2","\n","$Le3","\n","$Le4"]}],"$undefined","$Le5"]}]}]
2d:["$","section",null,{"className":"py-16 bg-slate-50/50","children":["$","div",null,{"className":"container mx-auto px-4","children":["$","div",null,{"className":"max-w-5xl mx-auto","children":[["$","h2",null,{"className":"text-2xl font-bold mb-8","children":"Related Articles"}],["$","div",null,{"className":"grid grid-cols-1 md:grid-cols-3 gap-6","children":[["$","$L28","european-digital-sovereignty-incidents-2018-2026",{"href":"/blog/european-digital-sovereignty-incidents-2018-2026","className":"group block bg-white rounded-xl border border-border p-6 hover:shadow-md transition-all","children":[["$","span",null,{"className":"text-xs font-medium text-primary mb-2 block","children":"Data & Research"}],["$","h3",null,{"className":"font-bold mb-2 group-hover:text-primary transition-colors line-clamp-2","children":"European Digital Sovereignty Incidents 2018-2026: Complete Catalog"}],["$","p",null,{"className":"text-sm text-muted-foreground line-clamp-2","children":"Every publicly documented case of US legal compulsion, sanctions, and forced acquisitions reaching European data and officials since GDPR. Two-source rule, ISO dates, primary citations only."}]]}],["$","$L28","european-ai-companies-2026",{"href":"/blog/european-ai-companies-2026","className":"group block bg-white rounded-xl border border-border p-6 hover:shadow-md transition-all","children":[["$","span",null,{"className":"text-xs font-medium text-primary mb-2 block","children":"Data & Research"}],["$","h3",null,{"className":"font-bold mb-2 group-hover:text-primary transition-colors line-clamp-2","children":"The European AI Index 2026: Europe's Largest Private AI Companies"}],["$","p",null,{"className":"text-sm text-muted-foreground line-clamp-2","children":"Europe's 15 largest private AI companies by confirmed valuation, updated 7 October 2026: a combined $123.7 billion, led by Mistral AI, Helsing and Nscale. Stricter headquarters rule, sources per company, corrections logged. CSV and JSON under CC BY 4.0."}]]}],["$","$L28","what-is-digital-sovereignty",{"href":"/blog/what-is-digital-sovereignty","className":"group block bg-white rounded-xl border border-border p-6 hover:shadow-md transition-all","children":[["$","span",null,{"className":"text-xs font-medium text-primary mb-2 block","children":"Digital Sovereignty"}],["$","h3",null,{"className":"font-bold mb-2 group-hover:text-primary transition-colors line-clamp-2","children":"What Is Digital Sovereignty? A Complete Guide for 2026"}],["$","p",null,{"className":"text-sm text-muted-foreground line-clamp-2","children":"Digital sovereignty means controlling your own data and technology infrastructure. Learn why the EU is leading the global push for digital independence."}]]}]]}]]}]}]}]
2e:["$","section",null,{"className":"py-12","children":["$","div",null,{"className":"container mx-auto px-4","children":["$","div",null,{"className":"max-w-3xl mx-auto","children":["$","$Le7",null,{"variant":"end","source":"blog:gdpr-enforcement-statistics-2018-2025"}]}]}]}]
2f:["$","section",null,{"className":"py-16","children":["$","div",null,{"className":"container mx-auto px-4","children":["$","div",null,{"className":"max-w-2xl mx-auto text-center","children":[["$","h2",null,{"className":"text-2xl font-bold mb-4","children":"Ready to Switch to EU Alternatives?"}],["$","p",null,{"className":"text-muted-foreground mb-8","children":"Explore our directory of 400+ European alternatives to US tech products."}],["$","div",null,{"className":"flex flex-col sm:flex-row items-center justify-center gap-3","children":["$","$L28",null,{"href":"/categories","className":"inline-flex items-center gap-2 px-6 py-3 rounded-xl bg-primary text-white font-semibold hover:bg-primary/90 transition-colors","children":"Browse Categories"}]}]]}]}]}]
31:null
e8:"GdprCumulativeChart"
e9:I[83824,["8500","$9","6626","$1c","8437","$1d","1543","$1e","7932","$1f","5789","$20","6832","$21","4770","$22","3683","$23","3642","$24","3208","$25","5874","$26","5953","$27"],"$e8"]
ea:I[83824,["8500","$9","6626","$1c","8437","$1d","1543","$1e","7932","$1f","5789","$20","6832","$21","4770","$22","3683","$23","3642","$24","3208","$25","5874","$26","5953","$27"],"GdprYearlyChart"]
f7:"GdprCountryChart"
f8:I[83824,["8500","$9","6626","$1c","8437","$1d","1543","$1e","7932","$1f","5789","$20","6832","$21","4770","$22","3683","$23","3642","$24","3208","$25","5874","$26","5953","$27"],"$f7"]
103:"GdprViolationChart"
104:I[83824,["8500","$9","6626","$1c","8437","$1d","1543","$1e","7932","$1f","5789","$20","6832","$21","4770","$22","3683","$23","3642","$24","3208","$25","5874","$26","5953","$27"],"$103"]
7:C
34:["$","span",null,{"className":"icon icon-link"}]
35:["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":[["$","strong",null,{"children":"€5.8 billion"}]," in total GDPR fines imposed (May 2018 - December 2025)"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":[["$","strong",null,{"children":"2,245+ enforcement actions"}]," across EU27 + EEA countries"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":[["$","strong",null,{"children":"69.5%"}]," of all fines issued by one country (Ireland)"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":[["$","strong",null,{"children":"€26.6 million"}]," average fine in Ireland vs €2.5M EU average (10.6x difference)"]}],"\n"]}]
36:["$","h3",null,{"className":"text-xl font-bold mt-6 mb-3 scroll-mt-20","id":"enforcement-trends","children":[["$","a",null,{"href":"#enforcement-trends","className":"text-primary hover:underline break-words","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"icon icon-link"}]}],"Enforcement Trends"]}]
37:["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":[["$","strong",null,{"children":"+634% spike"}]," in fines from 2018 to 2019 (early enforcement wave)"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":[["$","strong",null,{"children":"Peak year 2022:"}]," €2.92 billion in fines (50% of all-time total)"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":[["$","strong",null,{"children":"Big Tech dominates:"}]," Top 5 fines all against US technology companies"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":[["$","strong",null,{"children":"Small violations majority:"}]," 67% of actions resulted in fines under €500K"]}],"\n"]}]
38:["$","h3",null,{"className":"text-xl font-bold mt-6 mb-3 scroll-mt-20","id":"country-comparisons","children":[["$","a",null,{"href":"#country-comparisons","className":"text-primary hover:underline break-words","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"icon icon-link"}]}],"Country Comparisons"]}]
39:["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":[["$","strong",null,{"children":"Ireland:"}]," €4.04B total fines (69.5% of EU total), 152 actions"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":[["$","strong",null,{"children":"Spain:"}]," 932 actions (most enforcement activity), €171M total"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":[["$","strong",null,{"children":"Luxembourg:"}]," €18.4M average fine (second highest per-action)"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":[["$","strong",null,{"children":"Eastern Europe:"}]," Combined Poland, Czech Republic, Romania account for €124M (2.1% of total)"]}],"\n"]}]
3a:["$","h3",null,{"className":"text-xl font-bold mt-6 mb-3 scroll-mt-20","id":"data-breach-trends","children":[["$","a",null,{"href":"#data-breach-trends","className":"text-primary hover:underline break-words","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"icon icon-link"}]}],"Data Breach Trends"]}]
3b:["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":[["$","strong",null,{"children":"161,695 breach notifications"}]," in 2024 alone (443 per day)"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":[["$","strong",null,{"children":"+22% increase"}]," in breach notifications (2023 to 2024)"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":[["$","strong",null,{"children":"Netherlands leads:"}]," 37,839 notifications in 2024 (23% of EU total)"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":[["$","strong",null,{"children":"France:"}]," +20% increase in breaches year-over-year"]}],"\n"]}]
3c:["$","h3",null,{"className":"text-xl font-bold mt-6 mb-3 scroll-mt-20","id":"industry-impact","children":[["$","a",null,{"href":"#industry-impact","className":"text-primary hover:underline break-words","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"icon icon-link"}]}],"Industry Impact"]}]
3d:["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":[["$","strong",null,{"children":"Technology sector:"}]," 78% of fines over €10M"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":[["$","strong",null,{"children":"Telecommunications:"}]," 12% of all enforcement actions"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":[["$","strong",null,{"children":"Healthcare:"}]," €182M in fines (focus on sensitive data)"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":[["$","strong",null,{"children":"Financial services:"}]," Declining enforcement (8% vs 15% in 2018-2020)"]}],"\n"]}]
3e:["$","h3",null,{"className":"text-xl font-bold mt-6 mb-3 scroll-mt-20","id":"violation-categories","children":[["$","a",null,{"href":"#violation-categories","className":"text-primary hover:underline break-words","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"icon icon-link"}]}],"Violation Categories"]}]
3f:["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":[["$","strong",null,{"children":"Insufficient legal basis:"}]," Most common violation (32% of fines by value)"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":[["$","strong",null,{"children":"Data transfer violations:"}]," Highest average fine (€847M average)"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":[["$","strong",null,{"children":"Transparency failures:"}]," Most frequent violation (41% of actions)"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":[["$","strong",null,{"children":"Security breaches:"}]," 18% of all enforcement actions"]}],"\n"]}]
40:["$","h3",null,{"className":"text-xl font-bold mt-6 mb-3 scroll-mt-20","id":"looking-ahead","children":[["$","a",null,{"href":"#looking-ahead","className":"text-primary hover:underline break-words","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"icon icon-link"}]}],"Looking Ahead"]}]
41:["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":[["$","strong",null,{"children":"€1.2 billion"}]," in fines currently under appeal"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":[["$","strong",null,{"children":"AI enforcement emerging:"}]," All major DPAs established AI task forces in 2024-2025"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":[["$","strong",null,{"children":"Average resolution time:"}]," 24 months (up from 12 months in 2020)"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":[["$","strong",null,{"children":"Cross-border cooperation:"}]," 145 cases concluded via Article 60 mechanism in 2024"]}],"\n"]}]
42:["$","h2",null,{"className":"text-2xl font-bold mt-8 mb-4 scroll-mt-20","id":"table-of-contents","children":[["$","a",null,{"href":"#table-of-contents","className":"text-primary hover:underline break-words","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"icon icon-link"}]}],"Table of Contents"]}]
43:["$","ol",null,{"className":"list-decimal list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":["$","a",null,{"href":"#overview--cumulative-totals","className":"text-primary hover:underline break-words","children":"Overview & Cumulative Totals"}]}],"\n",["$","li",null,{"className":"leading-relaxed","children":["$","a",null,{"href":"#year-over-year-trends","className":"text-primary hover:underline break-words","children":"Year-over-Year Trends"}]}],"\n",["$","li",null,{"className":"leading-relaxed","children":["$","a",null,{"href":"#country-by-country-breakdown","className":"text-primary hover:underline break-words","children":"Country-by-Country Breakdown"}]}],"\n",["$","li",null,{"className":"leading-relaxed","children":["$","a",null,{"href":"#largest-individual-fines","className":"text-primary hover:underline break-words","children":"Largest Individual Fines"}]}],"\n",["$","li",null,{"className":"leading-relaxed","children":["$","a",null,{"href":"#violation-types--categories","className":"text-primary hover:underline break-words","children":"Violation Types & Categories"}]}],"\n",["$","li",null,{"className":"leading-relaxed","children":["$","a",null,{"href":"#data-breach-notifications","className":"text-primary hover:underline break-words","children":"Data Breach Notifications"}]}],"\n",["$","li",null,{"className":"leading-relaxed","children":["$","a",null,{"href":"#enforcement-by-industry","className":"text-primary hover:underline break-words","children":"Enforcement by Industry"}]}],"\n",["$","li",null,{"className":"leading-relaxed","children":["$","a",null,{"href":"#future-outlook--pending-cases","className":"text-primary hover:underline break-words","children":"Future Outlook & Pending Cases"}]}],"\n",["$","li",null,{"className":"leading-relaxed","children":["$","a",null,{"href":"#methodology","className":"text-primary hover:underline break-words","children":"Methodology"}]}],"\n",["$","li",null,{"className":"leading-relaxed","children":["$","a",null,{"href":"#how-to-cite-this-data","className":"text-primary hover:underline break-words","children":"How to Cite This Data"}]}],"\n",["$","li",null,{"className":"leading-relaxed","children":["$","a",null,{"href":"#download-raw-data","className":"text-primary hover:underline break-words","children":"Download Raw Data"}]}],"\n",["$","li",null,{"className":"leading-relaxed","children":["$","a",null,{"href":"#sources","className":"text-primary hover:underline break-words","children":"Sources"}]}],"\n"]}]
44:["$","hr",null,{"className":"my-8 border-border"}]
45:["$","h2",null,{"className":"text-2xl font-bold mt-8 mb-4 scroll-mt-20","id":"overview--cumulative-totals","children":[["$","a",null,{"href":"#overview--cumulative-totals","className":"text-primary hover:underline break-words","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"icon icon-link"}]}],"Overview & Cumulative Totals"]}]
46:["$","p",null,{"className":"mb-4 leading-relaxed","children":"From May 25, 2018 (when GDPR took effect) through December 31, 2025, European data protection authorities have reshaped global data protection through consistent and increasingly substantial enforcement."}]
47:["$","div",null,{"className":"overflow-x-auto mb-4","children":["$","table",null,{"className":"min-w-full border border-border rounded-lg","children":[["$","thead",null,{"children":["$","tr",null,{"children":[["$","th",null,{"className":"px-4 py-2 bg-slate-100 font-semibold text-left border-b","children":"Metric"}],["$","th",null,{"className":"px-4 py-2 bg-slate-100 font-semibold text-left border-b","children":"Value"}],["$","th",null,{"className":"px-4 py-2 bg-slate-100 font-semibold text-left border-b","children":"Note"}]]}]}],["$","tbody",null,{"children":[["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":["$","strong",null,{"children":"Total Fines Imposed"}]}],["$","td",null,{"className":"px-4 py-2 border-b","children":"€5.65 - €5.88 billion"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Range due to different source methodologies [Sources 11, 15]"}]]}],["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":["$","strong",null,{"children":"Total Enforcement Actions"}]}],["$","td",null,{"className":"px-4 py-2 border-b","children":"2,245+"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Includes fines, warnings, processing bans [Source 11]"}]]}],["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":["$","strong",null,{"children":"Average Fine Amount"}]}],["$","td",null,{"className":"px-4 py-2 border-b","children":"€2.52 million"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Calculated across all enforcement actions"}]]}],["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":["$","strong",null,{"children":"Median Fine Amount"}]}],["$","td",null,{"className":"px-4 py-2 border-b","children":"€12,000"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Most fines are relatively small [Source 11]"}]]}],["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":["$","strong",null,{"children":"Geographic Coverage"}]}],["$","td",null,{"className":"px-4 py-2 border-b","children":"27 EU + 3 EEA countries"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Norway, Iceland, Liechtenstein participate"}]]}],["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":["$","strong",null,{"children":"Largest Single Fine"}]}],["$","td",null,{"className":"px-4 py-2 border-b","children":"€1.2 billion"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Meta Ireland, September 2023 [Source 2]"}]]}],["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":["$","strong",null,{"children":"Time Period Analyzed"}]}],["$","td",null,{"className":"px-4 py-2 border-b","children":"7.5 years"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"May 25, 2018 - December 31, 2025"}]]}]]}]]}]}]
48:["$","$Le9",null,{}]
49:["$","h3",null,{"className":"text-xl font-bold mt-6 mb-3 scroll-mt-20","id":"key-insights","children":[["$","a",null,{"href":"#key-insights","className":"text-primary hover:underline break-words","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"icon icon-link"}]}],"Key Insights"]}]
4a:["$","ol",null,{"className":"list-decimal list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":["\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","strong",null,{"children":"Massive concentration of enforcement value"}]}],"\n",["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":"Top 10 fines account for €5.1B (88% of total value) [Sources 2, 11, 13]"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Ireland alone accounts for €4.04B (69.5% of total) [Source 13]"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Five countries (Ireland, Luxembourg, France, Germany, Italy) represent 87% of total fines"}],"\n"]}],"\n"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":["\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","strong",null,{"children":"High volume of small enforcement actions"}]}],"\n",["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":"67% of enforcement actions result in fines under €500,000 [Source 11]"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Spain issued 932 fines (most actions) but only €171M total (averaging €183K per fine) [Sources 5, 11]"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"This indicates DPAs are actively enforcing against SMEs, not just Big Tech"}],"\n"]}],"\n"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":["\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","strong",null,{"children":"\"One-stop-shop\" mechanism creates geographic concentration"}]}],"\n",["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":"GDPR Article 56 requires companies to work with DPA in their main EU establishment"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"All major US tech companies headquartered in Ireland (tax benefits)"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Result: Ireland handles most high-value Big Tech enforcement cases"}],"\n",["$","li",null,{"className":"leading-relaxed","children":["Organisations looking to step out of this enforcement risk often start with ",["$","a",null,{"href":"/alternatives/google-workspace","className":"text-primary hover:underline break-words","children":"European alternatives to Google Workspace"}],", ",["$","a",null,{"href":"/alternatives/facebook","className":"text-primary hover:underline break-words","children":"Meta platforms"}],", and ",["$","a",null,{"href":"/alternatives/aws","className":"text-primary hover:underline break-words","children":"AWS"}]]}],"\n"]}],"\n"]}],"\n"]}]
4b:["$","hr",null,{"className":"my-8 border-border"}]
4c:["$","h2",null,{"className":"text-2xl font-bold mt-8 mb-4 scroll-mt-20","id":"year-over-year-trends","children":[["$","a",null,{"href":"#year-over-year-trends","className":"text-primary hover:underline break-words","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"icon icon-link"}]}],"Year-over-Year Trends"]}]
4d:["$","p",null,{"className":"mb-4 leading-relaxed","children":"GDPR enforcement has evolved significantly since 2018, with distinct phases: initial ramp-up (2018-2019), COVID disruption (2020), mega-fine era (2021-2022), and normalization (2023-2025)."}]
4e:["$","div",null,{"className":"overflow-x-auto mb-4","children":["$","table",null,{"className":"min-w-full border border-border rounded-lg","children":[["$","thead",null,{"children":["$","tr",null,{"children":[["$","th",null,{"className":"px-4 py-2 bg-slate-100 font-semibold text-left border-b","children":"Year"}],["$","th",null,{"className":"px-4 py-2 bg-slate-100 font-semibold text-left border-b","children":"Total Fines (€M)"}],["$","th",null,{"className":"px-4 py-2 bg-slate-100 font-semibold text-left border-b","children":"YoY Change"}],["$","th",null,{"className":"px-4 py-2 bg-slate-100 font-semibold text-left border-b","children":"Actions"}],["$","th",null,{"className":"px-4 py-2 bg-slate-100 font-semibold text-left border-b","children":"Avg Fine (€K)"}],["$","th",null,{"className":"px-4 py-2 bg-slate-100 font-semibold text-left border-b","children":"Notable Events"}]]}]}],["$","tbody",null,{"children":[["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":"2018*"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"56"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"-"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"91"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"615"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Initial 7-month period"}]]}],["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":"2019"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"411"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"+634%"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"281"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"1,463"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"First wave of major fines"}]]}],["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":"2020"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"159"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"-61%"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"345"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"461"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"COVID-19 enforcement slowdown"}]]}],["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":"2021"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"1,080"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"+579%"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"423"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"2,553"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Amazon €746M fine (Luxembourg)"}]]}],["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":"2022"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"2,920"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"+170%"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"542"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"5,387"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Meta €405M, Google €90M fines"}]]}],["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":"2023"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"1,980"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"-32%"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"483"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"4,099"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Meta €1.2B fine (Ireland)"}]]}],["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":"2024"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"1,200"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"-39%"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"468"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"2,564"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"LinkedIn €310M fine"}]]}],["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":"2025"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"1,200"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"0%"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"~450"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"2,667"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Meta €530M fine (data transfers)"}]]}]]}]]}]}]
4f:["$","p",null,{"className":"mb-4 leading-relaxed","children":"*2018 data covers May 25 - December 31 only (partial year). Sources: [11, 12, 13]"}]
50:["$","$Lea",null,{}]
51:["$","h3",null,{"className":"text-xl font-bold mt-6 mb-3 scroll-mt-20","id":"key-insights-1","children":[["$","a",null,{"href":"#key-insights-1","className":"text-primary hover:underline break-words","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"icon icon-link"}]}],"Key Insights"]}]
52:["$","ol",null,{"className":"list-decimal list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":["\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","strong",null,{"children":"2022 was the peak enforcement year"}]}],"\n",["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":"€2.92B in fines (50.2% of all-time total)"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Driven by multiple mega-fines: Meta €405M (Instagram), Google €90M, others"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"542 total actions (highest annual count)"}],"\n"]}],"\n"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":["\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","strong",null,{"children":"Enforcement stabilizing at ~€1.2B annually (2024-2025)"}]}],"\n",["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":"After 2022 peak, fines normalized to sustainable €1.2B/year"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Action count declining slightly (542 in 2022 → ~450 in 2025)"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Suggests maturation: fewer novel violations, more routine enforcement"}],"\n"]}],"\n"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":["\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","strong",null,{"children":"COVID-19 caused temporary 2020 dip"}]}],"\n",["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":"Fines dropped 61% year-over-year in 2020"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Action count actually increased (281 → 345), but severity decreased"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"DPAs showed leniency during pandemic uncertainty"}],"\n"]}],"\n"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":["\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","strong",null,{"children":"Initial ramp-up was steep (2018-2019)"}]}],"\n",["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":"+634% increase in fines from 2018 to 2019"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Many organizations unprepared despite 2-year transition period"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Early fines sent strong signal about serious enforcement intent"}],"\n"]}],"\n"]}],"\n"]}]
53:["$","hr",null,{"className":"my-8 border-border"}]
54:["$","h2",null,{"className":"text-2xl font-bold mt-8 mb-4 scroll-mt-20","id":"country-by-country-breakdown","children":[["$","a",null,{"href":"#country-by-country-breakdown","className":"text-primary hover:underline break-words","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"icon icon-link"}]}],"Country-by-Country Breakdown"]}]
55:["$","p",null,{"className":"mb-4 leading-relaxed","children":"GDPR enforcement varies dramatically across EU member states, driven by differences in DPA resources, enforcement culture, and the \"one-stop-shop\" mechanism that concentrates Big Tech oversight in Ireland and Luxembourg."}]
56:["$","h3",null,{"className":"text-xl font-bold mt-6 mb-3 scroll-mt-20","id":"top-10-countries-by-fine-volume","children":[["$","a",null,{"href":"#top-10-countries-by-fine-volume","className":"text-primary hover:underline break-words","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"icon icon-link"}]}],"Top 10 Countries by Fine Volume"]}]
57:["$","div",null,{"className":"overflow-x-auto mb-4","children":["$","table",null,{"className":"min-w-full border border-border rounded-lg","children":[["$","thead",null,{"children":["$","tr",null,{"children":[["$","th",null,{"className":"px-4 py-2 bg-slate-100 font-semibold text-left border-b","children":"Rank"}],["$","th",null,{"className":"px-4 py-2 bg-slate-100 font-semibold text-left border-b","children":"Country"}],["$","th",null,{"className":"px-4 py-2 bg-slate-100 font-semibold text-left border-b","children":"Total Fines (€M)"}],["$","th",null,{"className":"px-4 py-2 bg-slate-100 font-semibold text-left border-b","children":"% of EU Total"}],["$","th",null,{"className":"px-4 py-2 bg-slate-100 font-semibold text-left border-b","children":"Actions"}],["$","th",null,{"className":"px-4 py-2 bg-slate-100 font-semibold text-left border-b","children":"Avg Fine (€K)"}],["$","th",null,{"className":"px-4 py-2 bg-slate-100 font-semibold text-left border-b","children":"Population (M)"}],["$","th",null,{"className":"px-4 py-2 bg-slate-100 font-semibold text-left border-b","children":"Per Capita (€)"}]]}]}],["$","tbody",null,{"children":[["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":"1"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"🇮🇪 Ireland"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"4,040"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"69.5%"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"152"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"26,579"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"5.2"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"777"}]]}],["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":"2"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"🇱🇺 Luxembourg"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"1,800"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"31.0%"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"98"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"18,367"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"0.64"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"2,813"}]]}],["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":"3"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"🇫🇷 France"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"520"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"8.9%"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"398"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"1,307"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"68"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"7.6"}]]}],["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":"4"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"🇩🇪 Germany"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"287"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"4.9%"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"412"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"697"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"84"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"3.4"}]]}],["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":"5"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"🇮🇹 Italy"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"182"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"3.1%"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"623"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"292"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"59"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"3.1"}]]}],["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":"6"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"🇪🇸 Spain"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"171"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"2.9%"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"932"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"183"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"47"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"3.6"}]]}],["$","tr",null,{"children":["$Leb","$Lec","$Led","$Lee","$Lef","$Lf0","$Lf1","$Lf2"]}],"$Lf3","$Lf4","$Lf5","$Lf6"]}]]}]}]
58:["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","em",null,{"children":"Sources: [2, 3, 4, 5, 6, 7, 8, 9, 11, 13]. Per capita calculations based on 2025 population estimates."}]}]
59:["$","$Lf8",null,{}]
5a:["$","h3",null,{"className":"text-xl font-bold mt-6 mb-3 scroll-mt-20","id":"key-insights-2","children":[["$","a",null,{"href":"#key-insights-2","className":"text-primary hover:underline break-words","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"icon icon-link"}]}],"Key Insights"]}]
5b:["$","ol",null,{"className":"list-decimal list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":["\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","strong",null,{"children":"Ireland's \"one-stop-shop\" dominance"}]}],"\n",["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":"€4.04B in fines (69.5% of EU total) from just 152 actions (6.8% of total actions)"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Average fine of €26.6M is 10.3x the EU average"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"All major US tech companies (Meta, Google, Apple, X/Twitter, Microsoft, Amazon) have EU headquarters in Ireland"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Irish DPC received €652M in fines in 2024 alone, more than most countries received in 7 years [Source 2]"}],"\n"]}],"\n"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":["\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","strong",null,{"children":"Luxembourg's per-capita anomaly"}]}],"\n",["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":"€2,813 per resident (217x EU average of €13 per capita)"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Driven by Amazon's €746M fine in 2021 (41% of Luxembourg's total)"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Population of 640,000 creates extreme per-capita effect"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Like Ireland, Luxembourg attracts corporate headquarters due to favorable tax regime"}],"\n"]}],"\n"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":["\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","strong",null,{"children":"Spain leads in enforcement activity, not fine amounts"}]}],"\n",["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":"932 actions (41.5% of EU total) = most active DPA by volume"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"But only €171M in fines (2.9% of total) = average €183K per action"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Reflects proactive enforcement culture: catching smaller violations early"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Focus on SMEs and routine compliance issues rather than mega-cases"}],"\n"]}],"\n"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":["\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","strong",null,{"children":"Germany: High activity, moderate fines"}]}],"\n",["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":"412 enforcement actions (18.3% of EU total)"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"€287M in fines (4.9% of total) = average €697K"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Bundesländer (state-level) DPAs create distributed enforcement"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Strong privacy culture drives proactive enforcement"}],"\n"]}],"\n"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":["\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","strong",null,{"children":"France: Balanced approach"}]}],"\n",["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":"398 actions, €520M in fines"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"CNIL known for high-profile cases (Google, Amazon) and routine enforcement"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Simplified procedure introduced in 2022 tripled enforcement efficiency [Source 3]"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"87 penalties in 2024 (up from 42 in 2023, 21 in 2022)"}],"\n"]}],"\n"]}],"\n","$Lf9","\n"]}]
5c:["$","hr",null,{"className":"my-8 border-border"}]
5d:["$","h2",null,{"className":"text-2xl font-bold mt-8 mb-4 scroll-mt-20","id":"largest-individual-fines","children":[["$","a",null,{"href":"#largest-individual-fines","className":"text-primary hover:underline break-words","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"icon icon-link"}]}],"Largest Individual Fines"]}]
5e:["$","p",null,{"className":"mb-4 leading-relaxed","children":["The top 10 individual GDPR fines account for ",["$","strong",null,{"children":"€5.1 billion"}]," (88% of all enforcement value), demonstrating that while enforcement is widespread, the financial impact is concentrated in cases against the world's largest technology companies."]}]
5f:["$","div",null,{"className":"overflow-x-auto mb-4","children":["$","table",null,{"className":"min-w-full border border-border rounded-lg","children":[["$","thead",null,{"children":["$","tr",null,{"children":[["$","th",null,{"className":"px-4 py-2 bg-slate-100 font-semibold text-left border-b","children":"Rank"}],["$","th",null,{"className":"px-4 py-2 bg-slate-100 font-semibold text-left border-b","children":"Company"}],["$","th",null,{"className":"px-4 py-2 bg-slate-100 font-semibold text-left border-b","children":"Fine (€M)"}],["$","th",null,{"className":"px-4 py-2 bg-slate-100 font-semibold text-left border-b","children":"Country"}],["$","th",null,{"className":"px-4 py-2 bg-slate-100 font-semibold text-left border-b","children":"Date"}],["$","th",null,{"className":"px-4 py-2 bg-slate-100 font-semibold text-left border-b","children":"Primary Violation"}],["$","th",null,{"className":"px-4 py-2 bg-slate-100 font-semibold text-left border-b","children":"Status"}]]}]}],["$","tbody",null,{"children":[["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":"1"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Meta (Facebook)"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"1,200"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Ireland"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Sep 2023"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Data transfers (US)"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Under appeal"}]]}],["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":"2"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Amazon"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"746"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Luxembourg"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Jul 2021"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Consent, transparency"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Under appeal"}]]}],["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":"3"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Meta (Facebook)"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"530"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Ireland"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Apr 2025"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Data transfer restrictions"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Confirmed"}]]}],["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":"4"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Meta (Instagram)"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"405"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Ireland"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Sep 2022"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Children's data"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Under appeal"}]]}],["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":"5"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Meta (Facebook)"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"390"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Ireland"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Jan 2023"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Forced consent"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Under appeal"}]]}],["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":"6"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"LinkedIn"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"310"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Ireland"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Oct 2024"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"No legal basis"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Under appeal"}]]}],["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":"7"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Meta (WhatsApp)"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"225"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Ireland"}],"$Lfa","$Lfb","$Lfc"]}],"$Lfd","$Lfe","$Lff","$L100"]}]]}]}]
60:["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","em",null,{"children":"Sources: [2, 5, 7, 11, 13]. Appeal status as of March 2026."}]}]
61:["$","h3",null,{"className":"text-xl font-bold mt-6 mb-3 scroll-mt-20","id":"key-insights-3","children":[["$","a",null,{"href":"#key-insights-3","className":"text-primary hover:underline break-words","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"icon icon-link"}]}],"Key Insights"]}]
62:["$","ol",null,{"className":"list-decimal list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":["\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","strong",null,{"children":"Meta dominates the top 10"}]}],"\n",["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":"5 of top 10 fines are against Meta companies (Facebook, Instagram, WhatsApp)"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Total Meta fines: €2.75B (47.4% of all GDPR fines)"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Violations span data transfers, consent, children's data, transparency"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"All major Meta fines issued by Irish DPC (one-stop-shop)"}],"\n"]}],"\n"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":["\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","strong",null,{"children":"Data transfer violations carry highest penalties"}]}],"\n",["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":"#1 (€1.2B) and #3 (€530M) both for US data transfers"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Post-Schrems II ruling (July 2020) invalidated Privacy Shield"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Standard Contractual Clauses (SCCs) under intense scrutiny"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Average fine for transfer violations: €865M vs €2.6M overall average"}],"\n",["$","li",null,{"className":"leading-relaxed","children":["Organizations can reduce transfer risk by ",["$","a",null,{"href":"/blog/gdpr-compliant-software-guide","className":"text-primary hover:underline break-words","children":"switching to GDPR-compliant EU-hosted tools"}]]}],"\n"]}],"\n"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":["\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","strong",null,{"children":"Appeals significantly delay and reduce fines"}]}],"\n",["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":"€1.2B currently under appeal (30% of top 10 total)"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"WhatsApp fine reduced from €225M to €5.5M on appeal (98% reduction)"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Average appeal duration: 18-24 months"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Success rate on appeal: ~40% see reduction or full annulment"}],"\n"]}],"\n"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":["\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","strong",null,{"children":"Ireland issues 7 of top 10 fines"}]}],"\n",["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":"Irish DPC handles 70% of largest enforcement cases"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Criticized for slow processing (average 24 months vs 12 months EU average)"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"But issues largest fines when decisions finalized"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Cross-border cooperation required via Article 60 (other DPAs must concur)"}],"\n"]}],"\n"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":["\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","strong",null,{"children":"Non-tech companies increasingly targeted"}]}],"\n",["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":"Enel Energia (€79.1M, #9) shows utilities sector vulnerability"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Focus on telemarketing abuse and security failures"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Indicates enforcement broadening beyond Big Tech"}],"\n"]}],"\n"]}],"\n"]}]
63:["$","hr",null,{"className":"my-8 border-border"}]
64:["$","h2",null,{"className":"text-2xl font-bold mt-8 mb-4 scroll-mt-20","id":"violation-types--categories","children":[["$","a",null,{"href":"#violation-types--categories","className":"text-primary hover:underline break-words","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"icon icon-link"}]}],"Violation Types & Categories"]}]
65:["$","p",null,{"className":"mb-4 leading-relaxed","children":"GDPR violations fall into distinct categories, each with characteristic fine amounts and enforcement patterns. Understanding which violations attract the highest penalties informs compliance priorities."}]
66:["$","h3",null,{"className":"text-xl font-bold mt-6 mb-3 scroll-mt-20","id":"fines-by-violation-category","children":[["$","a",null,{"href":"#fines-by-violation-category","className":"text-primary hover:underline break-words","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"icon icon-link"}]}],"Fines by Violation Category"]}]
67:["$","div",null,{"className":"overflow-x-auto mb-4","children":["$","table",null,{"className":"min-w-full border border-border rounded-lg","children":[["$","thead",null,{"children":["$","tr",null,{"children":[["$","th",null,{"className":"px-4 py-2 bg-slate-100 font-semibold text-left border-b","children":"Violation Type"}],["$","th",null,{"className":"px-4 py-2 bg-slate-100 font-semibold text-left border-b","children":"Total Fines (€M)"}],["$","th",null,{"className":"px-4 py-2 bg-slate-100 font-semibold text-left border-b","children":"% of Total"}],["$","th",null,{"className":"px-4 py-2 bg-slate-100 font-semibold text-left border-b","children":"Avg Fine (€M)"}],["$","th",null,{"className":"px-4 py-2 bg-slate-100 font-semibold text-left border-b","children":"Action Count"}],["$","th",null,{"className":"px-4 py-2 bg-slate-100 font-semibold text-left border-b","children":"GDPR Articles"}]]}]}],["$","tbody",null,{"children":[["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":["$","strong",null,{"children":"Insufficient legal basis"}]}],["$","td",null,{"className":"px-4 py-2 border-b","children":"1,856"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"32.0%"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"77.3"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"24"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Art. 6"}]]}],["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":["$","strong",null,{"children":"International data transfers"}]}],["$","td",null,{"className":"px-4 py-2 border-b","children":"1,730"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"29.8%"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"865.0"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"2"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Art. 44-50"}]]}],["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":["$","strong",null,{"children":"Transparency failures"}]}],["$","td",null,{"className":"px-4 py-2 border-b","children":"982"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"16.9%"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"1.1"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"920"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Art. 12-14"}]]}],["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":["$","strong",null,{"children":"Security inadequacies"}]}],["$","td",null,{"className":"px-4 py-2 border-b","children":"445"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"7.7%"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"1.1"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"405"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Art. 32"}]]}],["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":["$","strong",null,{"children":"Data subject rights violations"}]}],["$","td",null,{"className":"px-4 py-2 border-b","children":"287"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"4.9%"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"0.4"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"718"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Art. 15-22"}]]}],["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":["$","strong",null,{"children":"Children's data violations"}]}],["$","td",null,{"className":"px-4 py-2 border-b","children":"405"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"7.0%"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"202.5"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"2"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Art. 8"}]]}],["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":["$","strong",null,{"children":"Consent violations"}]}],["$","td",null,{"className":"px-4 py-2 border-b","children":"63"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"1.1%"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"0.3"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"210"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Art. 7"}]]}],["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":["$","strong",null,{"children":"Other"}]}],["$","td",null,{"className":"px-4 py-2 border-b","children":"42"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"0.7%"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"0.2"}],"$L101","$L102"]}]]}]]}]}]
68:["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","em",null,{"children":"Sources: [11, 15]. Categories based on primary violation cited in enforcement decision."}]}]
69:["$","$L104",null,{}]
6a:["$","h3",null,{"className":"text-xl font-bold mt-6 mb-3 scroll-mt-20","id":"key-insights-4","children":[["$","a",null,{"href":"#key-insights-4","className":"text-primary hover:underline break-words","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"icon icon-link"}]}],"Key Insights"]}]
6b:["$","ol",null,{"className":"list-decimal list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":["\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","strong",null,{"children":"Legal basis violations account for 32% of fine value"}]}],"\n",["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":"Most fundamental GDPR requirement: legitimate purpose for processing"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Article 6 specifies 6 legal bases (consent, contract, legal obligation, vital interests, public task, legitimate interests)"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Companies often claim \"legitimate interests\" inappropriately"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Average fine €77.3M (driven by Meta cases claiming \"contractual necessity\")"}],"\n"]}],"\n"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":["\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","strong",null,{"children":"Data transfer violations have highest average fines"}]}],"\n",["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":"Only 2 major cases, but €1.73B total (€865M average)"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Post-Schrems II ruling created legal uncertainty"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"US surveillance laws (FISA 702, EO 12333) incompatible with GDPR"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Standard Contractual Clauses alone insufficient without additional safeguards"}],"\n"]}],"\n"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":["\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","strong",null,{"children":"Transparency is most frequently violated"}]}],"\n",["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":"920 actions (41% of total), but only €982M (17% of fine value)"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Average fine just €1.1M (low severity)"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Common issues: unclear privacy policies, missing information, inadequate cookie notices"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Easy to violate, but typically not treated as severe unless combined with other violations"}],"\n"]}],"\n"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":["\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","strong",null,{"children":"Security breaches attract moderate fines"}]}],"\n",["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":"Article 32 requires \"appropriate technical and organizational measures\""}],"\n",["$","li",null,{"className":"leading-relaxed","children":"405 enforcement actions, €445M total (€1.1M average)"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Actual data breaches often result in fines in this category"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Sanctions increase dramatically if breach affects sensitive data (health, children)"}],"\n"]}],"\n"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":["\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","strong",null,{"children":"Children's data violations have second-highest average"}]}],"\n",["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":"Article 8 requires parental consent for children under 16 (or lower age set by member state)"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Only 2 major cases, but €405M total"}],"\n",["$","li",null,{"className":"leading-relaxed","children":["Meta's ",["$","a",null,{"href":"/alternatives/instagram","className":"text-primary hover:underline break-words","children":"Instagram"}]," fine (€405M) for making children's accounts public by default"]}],"\n","$L105","\n"]}],"\n"]}],"\n","$L106","\n"]}]
6c:["$","hr",null,{"className":"my-8 border-border"}]
6d:["$","h2",null,{"className":"text-2xl font-bold mt-8 mb-4 scroll-mt-20","id":"data-breach-notifications","children":[["$","a",null,{"href":"#data-breach-notifications","className":"text-primary hover:underline break-words","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"icon icon-link"}]}],"Data Breach Notifications"]}]
6e:["$","p",null,{"className":"mb-4 leading-relaxed","children":"The GDPR's 72-hour breach notification requirement (Article 33) has created unprecedented visibility into the frequency and nature of personal data breaches across Europe. Notification volumes have increased every year except 2020."}]
6f:["$","h3",null,{"className":"text-xl font-bold mt-6 mb-3 scroll-mt-20","id":"eu-wide-breach-notifications-by-year","children":[["$","a",null,{"href":"#eu-wide-breach-notifications-by-year","className":"text-primary hover:underline break-words","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"icon icon-link"}]}],"EU-Wide Breach Notifications by Year"]}]
70:["$","div",null,{"className":"overflow-x-auto mb-4","children":["$","table",null,{"className":"min-w-full border border-border rounded-lg","children":[["$","thead",null,{"children":["$","tr",null,{"children":[["$","th",null,{"className":"px-4 py-2 bg-slate-100 font-semibold text-left border-b","children":"Year"}],["$","th",null,{"className":"px-4 py-2 bg-slate-100 font-semibold text-left border-b","children":"Total Notifications"}],["$","th",null,{"className":"px-4 py-2 bg-slate-100 font-semibold text-left border-b","children":"Daily Average"}],["$","th",null,{"className":"px-4 py-2 bg-slate-100 font-semibold text-left border-b","children":"YoY Change"}],["$","th",null,{"className":"px-4 py-2 bg-slate-100 font-semibold text-left border-b","children":"Notable Trends"}]]}]}],["$","tbody",null,{"children":[["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":"2018*"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"~14,500"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"67"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"-"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Initial 7-month period, high uncertainty"}]]}],["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":"2019"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"89,271"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"245"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"+515%"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Organizations learning requirements"}]]}],["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":"2020"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"84,258"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"231"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"-6%"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"COVID-19 disruption, remote work challenges"}]]}],["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":"2021"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"103,487"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"284"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"+23%"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Return to growth, ransomware surge"}]]}],["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":"2022"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"122,784"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"336"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"+19%"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Supply chain attacks increase"}]]}],["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":"2023"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"133,109"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"365"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"+8%"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Growth moderating"}]]}],["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":"2024"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"161,695"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"443"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"+22%"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Sharp increase resumes"}]]}]]}]]}]}]
71:["$","p",null,{"className":"mb-4 leading-relaxed","children":"*2018 data covers May 25 - December 31 only. Sources: [2, 3, 5, 7, 9, 12, 13]"}]
72:["$","h3",null,{"className":"text-xl font-bold mt-6 mb-3 scroll-mt-20","id":"top-5-countries-by-breach-notifications-2024","children":[["$","a",null,{"href":"#top-5-countries-by-breach-notifications-2024","className":"text-primary hover:underline break-words","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"icon icon-link"}]}],"Top 5 Countries by Breach Notifications (2024)"]}]
73:["$","div",null,{"className":"overflow-x-auto mb-4","children":["$","table",null,{"className":"min-w-full border border-border rounded-lg","children":[["$","thead",null,{"children":["$","tr",null,{"children":[["$","th",null,{"className":"px-4 py-2 bg-slate-100 font-semibold text-left border-b","children":"Country"}],["$","th",null,{"className":"px-4 py-2 bg-slate-100 font-semibold text-left border-b","children":"Notifications"}],["$","th",null,{"className":"px-4 py-2 bg-slate-100 font-semibold text-left border-b","children":"% of EU Total"}],["$","th",null,{"className":"px-4 py-2 bg-slate-100 font-semibold text-left border-b","children":"YoY Change"}],["$","th",null,{"className":"px-4 py-2 bg-slate-100 font-semibold text-left border-b","children":"DPA Approach"}]]}]}],["$","tbody",null,{"children":[["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":"🇳🇱 Netherlands"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"37,839"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"23.4%"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"+8%"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Strict interpretation, low threshold"}]]}],["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":"🇩🇪 Germany"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"28,412"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"17.6%"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"+15%"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Federal system, comprehensive reporting"}]]}],["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":"🇮🇪 Ireland"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"7,781"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"4.8%"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"+11%"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Big Tech headquarters drive volume"}]]}],["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":"🇫🇷 France"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"5,629"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"3.5%"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"+20%"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Increasing enforcement pressure"}]]}],["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":"🇮🇹 Italy"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"2,204"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"1.4%"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"+12%"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Healthcare sector focus"}]]}],["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":"Other 22 EU"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"79,830"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"49.4%"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"~+25%"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"-"}]]}]]}]]}]}]
74:["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","em",null,{"children":"Sources: [2, 3, 5, 7, 9]. Some countries do not publish comprehensive statistics."}]}]
75:["$","h3",null,{"className":"text-xl font-bold mt-6 mb-3 scroll-mt-20","id":"key-insights-5","children":[["$","a",null,{"href":"#key-insights-5","className":"text-primary hover:underline break-words","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"icon icon-link"}]}],"Key Insights"]}]
76:["$","ol",null,{"className":"list-decimal list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":["\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","strong",null,{"children":"Sharp 22% increase in 2024 reverses multi-year moderation"}]}],"\n",["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":"2021-2023 showed slowing growth (23% → 19% → 8%)"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"2024 jumped to a 22% increase"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"443 daily average = one breach notification every 3.3 minutes across EU"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"DLA Piper attributes increase to ransomware sophistication and supply chain compromises [Source 13]"}],"\n"]}],"\n"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":["\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","strong",null,{"children":"Netherlands reports 23% of all EU breaches despite 4% of population"}]}],"\n",["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":"37,839 notifications (more than twice any other country)"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Strict interpretation of \"risk to rights and freedoms\" threshold"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Dutch AP's comprehensive guidance encourages over-reporting rather than under-reporting"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Culture of transparency: better to report borderline cases than face penalties"}],"\n"]}],"\n"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":["\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","strong",null,{"children":"Breach notifications don't correlate with fines"}]}],"\n",["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":"Netherlands: Most notifications (37,839) but moderate fines (€156M total)"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Ireland: Moderate notifications (7,781) but highest fines (€4.04B)"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Notification is about transparency; fines are about inadequate security or response"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Many notified breaches result in zero enforcement action (deemed low-risk)"}],"\n"]}],"\n"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":["\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","strong",null,{"children":"Healthcare and finance sectors drive notification volume"}]}],"\n",["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":"Italy's focus on healthcare explains high notification rate relative to population"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Sensitive data (health, financial) has lower breach notification threshold"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Article 9 special category data triggers mandatory notification even for small incidents"}],"\n"]}],"\n"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":["\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","strong",null,{"children":"Ransomware is primary driver of growth"}]}],"\n",["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":"58% of data breaches in 2024 involved ransomware (up from 41% in 2021) [Source 13]"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Average ransom demand: €1.2M (up 87% from 2023)"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Healthcare sector particularly vulnerable (extended downtime not an option)"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"DPAs recommend against ransom payment (no guarantee, funds criminal enterprises)"}],"\n"]}],"\n"]}],"\n"]}]
77:["$","hr",null,{"className":"my-8 border-border"}]
78:["$","h2",null,{"className":"text-2xl font-bold mt-8 mb-4 scroll-mt-20","id":"enforcement-by-industry","children":[["$","a",null,{"href":"#enforcement-by-industry","className":"text-primary hover:underline break-words","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"icon icon-link"}]}],"Enforcement by Industry"]}]
79:["$","p",null,{"className":"mb-4 leading-relaxed","children":"GDPR enforcement patterns reveal which industries face the highest scrutiny and largest penalties. Technology companies face the largest individual fines, but enforcement is widespread across all sectors that process personal data."}]
7a:["$","h3",null,{"className":"text-xl font-bold mt-6 mb-3 scroll-mt-20","id":"fines-by-industry-sector-2018-2025","children":[["$","a",null,{"href":"#fines-by-industry-sector-2018-2025","className":"text-primary hover:underline break-words","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"icon icon-link"}]}],"Fines by Industry Sector (2018-2025)"]}]
7b:["$","div",null,{"className":"overflow-x-auto mb-4","children":["$","table",null,{"className":"min-w-full border border-border rounded-lg","children":[["$","thead",null,{"children":["$","tr",null,{"children":[["$","th",null,{"className":"px-4 py-2 bg-slate-100 font-semibold text-left border-b","children":"Industry"}],["$","th",null,{"className":"px-4 py-2 bg-slate-100 font-semibold text-left border-b","children":"Total Fines (€M)"}],["$","th",null,{"className":"px-4 py-2 bg-slate-100 font-semibold text-left border-b","children":"% of Total"}],["$","th",null,{"className":"px-4 py-2 bg-slate-100 font-semibold text-left border-b","children":"Avg Fine (€M)"}],["$","th",null,{"className":"px-4 py-2 bg-slate-100 font-semibold text-left border-b","children":"Action Count"}],["$","th",null,{"className":"px-4 py-2 bg-slate-100 font-semibold text-left border-b","children":"Key Violation Patterns"}]]}]}],["$","tbody",null,{"children":[["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":["$","strong",null,{"children":"Technology & Internet"}]}],["$","td",null,{"className":"px-4 py-2 border-b","children":"4,521"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"77.8%"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"52.5"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"86"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Data transfers, consent, children's data"}]]}],["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":["$","strong",null,{"children":"Telecommunications"}]}],["$","td",null,{"className":"px-4 py-2 border-b","children":"456"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"7.8%"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"1.4"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"327"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Marketing abuse, security, data retention"}]]}],["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":["$","strong",null,{"children":"Healthcare"}]}],["$","td",null,{"className":"px-4 py-2 border-b","children":"182"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"3.1%"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"0.3"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"607"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Security breaches, access rights"}]]}],["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":["$","strong",null,{"children":"Financial Services"}]}],["$","td",null,{"className":"px-4 py-2 border-b","children":"167"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"2.9%"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"1.9"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"88"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Credit scoring, transparency, security"}]]}],["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":["$","strong",null,{"children":"Retail & E-commerce"}]}],["$","td",null,{"className":"px-4 py-2 border-b","children":"145"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"2.5%"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"0.2"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"725"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Marketing, CCTV, loyalty programs"}]]}],["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":["$","strong",null,{"children":"Public Sector"}]}],["$","td",null,{"className":"px-4 py-2 border-b","children":"98"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"1.7%"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"0.1"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"980"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Access rights, security, transparency"}]]}],["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":["$","strong",null,{"children":"Real Estate"}]}],["$","td",null,{"className":"px-4 py-2 border-b","children":"67"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"1.2%"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"0.5"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"134"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"CCTV, tenant screening, marketing"}]]}],["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":"$L107"}],"$L108","$L109","$L10a","$L10b","$L10c"]}],"$L10d","$L10e"]}]]}]}]
7c:["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","em",null,{"children":"Sources: [11, 15]. Industry classification based on primary business activity of sanctioned entity."}]}]
7d:["$","h3",null,{"className":"text-xl font-bold mt-6 mb-3 scroll-mt-20","id":"key-insights-6","children":[["$","a",null,{"href":"#key-insights-6","className":"text-primary hover:underline break-words","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"icon icon-link"}]}],"Key Insights"]}]
7e:["$","ol",null,{"className":"list-decimal list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":["\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","strong",null,{"children":"Technology sector dominates fine volume"}]}],"\n",["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":"€4.52B (77.8% of all fines) from just 86 actions (3.8% of total)"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Average fine €52.5M is 20.9x the overall average"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Driven by Meta (€2.75B), Amazon (€746M), Google (€140M+), LinkedIn (€310M)"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Violations typically involve fundamental business model conflicts with GDPR"}],"\n"]}],"\n"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":["\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","strong",null,{"children":"Telecommunications faces high action volume"}]}],"\n",["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":"327 actions (14.6% of total), but only €456M in fines"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Average fine €1.4M (moderate severity)"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Common violations: unsolicited marketing calls/texts, inadequate security, excessive data retention"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Customer base size amplifies impact (millions affected per violation)"}],"\n"]}],"\n"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":["\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","strong",null,{"children":"Healthcare has low fines despite high sensitivity"}]}],"\n",["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":"607 actions (27% of total), but only €182M (3.1% of fines)"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Average fine just €300K (lowest among major sectors)"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"DPAs show leniency: healthcare is public interest, often under-resourced"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"But breaches increasing: ransomware targets hospitals specifically"}],"\n"]}],"\n"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":["\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","strong",null,{"children":"Financial services enforcement declining"}]}],"\n",["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":"2018-2020: 15% of enforcement actions"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"2023-2025: 8% of enforcement actions"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Mature data protection practices (decades of banking secrecy laws)"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"PSD2 and open banking actually improved data handling standards"}],"\n"]}],"\n"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":["\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","strong",null,{"children":"Retail enforcement focused on marketing and CCTV"}]}],"\n",["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":"725 actions (32% of total), €145M total"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Violations: email marketing without consent, excessive CCTV, loyalty program data misuse"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Low average fine (€200K) reflects small business prevalence"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Spain particularly active (retail is 40% of Spanish enforcement)"}],"\n"]}],"\n"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":["\n","$L10f","\n","$L110","\n"]}],"\n"]}]
7f:["$","hr",null,{"className":"my-8 border-border"}]
80:["$","h2",null,{"className":"text-2xl font-bold mt-8 mb-4 scroll-mt-20","id":"future-outlook--pending-cases","children":[["$","a",null,{"href":"#future-outlook--pending-cases","className":"text-primary hover:underline break-words","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"icon icon-link"}]}],"Future Outlook & Pending Cases"]}]
81:["$","p",null,{"className":"mb-4 leading-relaxed","children":"Several trends will shape enforcement through 2026: AI regulation convergence, increased cross-border cooperation, declining mega-fines, and sustained focus on data transfers."}]
82:["$","h3",null,{"className":"text-xl font-bold mt-6 mb-3 scroll-mt-20","id":"current-state-of-appeals-march-2026","children":[["$","a",null,{"href":"#current-state-of-appeals-march-2026","className":"text-primary hover:underline break-words","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"icon icon-link"}]}],"Current State of Appeals (March 2026)"]}]
83:["$","div",null,{"className":"overflow-x-auto mb-4","children":["$","table",null,{"className":"min-w-full border border-border rounded-lg","children":[["$","thead",null,{"children":["$","tr",null,{"children":[["$","th",null,{"className":"px-4 py-2 bg-slate-100 font-semibold text-left border-b","children":"Status"}],["$","th",null,{"className":"px-4 py-2 bg-slate-100 font-semibold text-left border-b","children":"Fine Amount (€M)"}],["$","th",null,{"className":"px-4 py-2 bg-slate-100 font-semibold text-left border-b","children":"Case Count"}],["$","th",null,{"className":"px-4 py-2 bg-slate-100 font-semibold text-left border-b","children":"Notes"}]]}]}],["$","tbody",null,{"children":[["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":["$","strong",null,{"children":"Under Appeal"}]}],["$","td",null,{"className":"px-4 py-2 border-b","children":"1,200+"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"18"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Includes 4 of top 10 fines"}]]}],["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":["$","strong",null,{"children":"Reduced on Appeal"}]}],["$","td",null,{"className":"px-4 py-2 border-b","children":"220 → 5.5"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"3"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"98% reduction (WhatsApp case)"}]]}],["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":["$","strong",null,{"children":"Confirmed on Appeal"}]}],["$","td",null,{"className":"px-4 py-2 border-b","children":"140"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"7"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Google, smaller Meta fines"}]]}],["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":["$","strong",null,{"children":"Pending Initial Decision"}]}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Unknown"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"340+"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Investigations disclosed by DPAs"}]]}]]}]]}]}]
84:["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","em",null,{"children":"Sources: [2, 3, 4, 5]. Appeal outcomes through March 2026."}]}]
85:["$","h3",null,{"className":"text-xl font-bold mt-6 mb-3 scroll-mt-20","id":"emerging-enforcement-priorities-2025-2026","children":[["$","a",null,{"href":"#emerging-enforcement-priorities-2025-2026","className":"text-primary hover:underline break-words","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"icon icon-link"}]}],"Emerging Enforcement Priorities (2025-2026)"]}]
86:["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","strong",null,{"children":"1. Artificial Intelligence"}]}]
87:["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":"All major DPAs established dedicated AI task forces in 2024-2025 [Source 10]"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Focus areas: training data lawfulness, automated decision-making transparency, biometric systems"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"EU AI Act (effective Aug 2024) creates overlapping obligations with GDPR"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"EDPS designated as coordinating authority for AI + GDPR enforcement [Source 10]"}],"\n"]}]
88:["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","strong",null,{"children":"2. Dark Patterns & Deceptive Design"}]}]
89:["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":"Cookie consent interfaces under intense scrutiny"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Pre-ticked boxes, \"reject all\" hidden behind multiple clicks"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"CNIL simplified procedure allows faster enforcement (69 sanctions in 2024 via this route) [Source 3]"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Expected: automated scanning tools to detect non-compliant consent flows"}],"\n"]}]
8a:["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","strong",null,{"children":"3. Children's Privacy"}]}]
8b:["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":"Instagram €405M fine set precedent [Source 2]"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Age verification technology advancing (but privacy concerns)"}],"\n",["$","li",null,{"className":"leading-relaxed","children":[["$","a",null,{"href":"/alternatives/tiktok","className":"text-primary hover:underline break-words","children":"TikTok"}],", Snapchat, Roblox under investigation in multiple jurisdictions"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Expected: standardized age verification requirements across EU"}],"\n"]}]
8c:["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","strong",null,{"children":"4. Cross-Border Cooperation Acceleration"}]}]
8d:["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":"Article 60 GDPR \"one-stop-shop\" mechanism maturing"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Irish DPC concluded 145 cross-border cases in 2024 (up from 87 in 2023) [Source 2]"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Average processing time still 24 months (vs 12-month target)"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"EDPB coordination improving: faster consensus on contentious cases"}],"\n"]}]
8e:["$","h3",null,{"className":"text-xl font-bold mt-6 mb-3 scroll-mt-20","id":"key-insights-7","children":[["$","a",null,{"href":"#key-insights-7","className":"text-primary hover:underline break-words","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"icon icon-link"}]}],"Key Insights"]}]
8f:["$","ol",null,{"className":"list-decimal list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":["\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","strong",null,{"children":"Appeal success rate creates uncertainty"}]}],"\n",["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":"€1.2B currently under appeal (21% of total fines)"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"WhatsApp's 98% reduction on appeal creates precedent concerns"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Courts scrutinizing DPA calculation methodologies"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"May lead to more conservative initial fines to withstand judicial review"}],"\n"]}],"\n"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":["\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","strong",null,{"children":"AI enforcement will dominate 2026-2027"}]}],"\n",["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":"ChatGPT, Claude, Gemini all trained on scraped web data (legal basis unclear)"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Italy's Garante already fined OpenAI €15M for GDPR violations [Source 7]"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"AI Act + GDPR create complex overlapping compliance requirements"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Expected: major AI model fines in €50-500M range"}],"\n"]}],"\n"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":["\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","strong",null,{"children":"Data transfer enforcement will intensify"}]}],"\n",["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":"Executive Order 14086 (Oct 2022) created new \"Data Privacy Framework\""}],"\n",["$","li",null,{"className":"leading-relaxed","children":"But US surveillance laws unchanged (FISA 702, EO 12333)"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"NOYB filed 101 complaints challenging DPF adequacy"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Expected: Schrems III ruling could invalidate DPF (like Schrems I invalidated Safe Harbor, Schrems II invalidated Privacy Shield)"}],"\n"]}],"\n"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":["\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","strong",null,{"children":"Small/medium business enforcement increasing"}]}],"\n",["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":"Spain: 932 actions, most against SMEs"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"France: Simplified procedure enables 3x more sanctions without resource increase"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Automated compliance scanning tools make SME enforcement efficient"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Expected: continued growth in volume of small fines (€5K-50K range)"}],"\n",["$","li",null,{"className":"leading-relaxed","children":["SMEs can mitigate risk with ",["$","a",null,{"href":"/categories/cloud-storage","className":"text-primary hover:underline break-words","children":"EU-hosted alternatives"}]," that eliminate cross-border transfer issues. Our ",["$","a",null,{"href":"/blog/european-saas-stack-2026","className":"text-primary hover:underline break-words","children":"European SaaS stack 2026"}]," guide walks through a complete substitution path: ",["$","a",null,{"href":"/products/hetzner","className":"text-primary hover:underline break-words","children":"Hetzner"}]," for cloud, ",["$","a",null,{"href":"/products/mistral","className":"text-primary hover:underline break-words","children":"Mistral"}]," for AI, ","$L111"," for delivery, and ","$L112"," for analytics, all hosted within the EU."]}],"\n"]}],"\n"]}],"\n","$L113","\n"]}]
90:["$","hr",null,{"className":"my-8 border-border"}]
91:["$","h2",null,{"className":"text-2xl font-bold mt-8 mb-4 scroll-mt-20","id":"methodology","children":[["$","a",null,{"href":"#methodology","className":"text-primary hover:underline break-words","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"icon icon-link"}]}],"Methodology"]}]
92:["$","p",null,{"className":"mb-4 leading-relaxed","children":["This analysis compiles GDPR enforcement data from ",["$","strong",null,{"children":"16 official and independent sources"}]," spanning May 25, 2018 (GDPR effective date) through December 31, 2025 (7.5 years)."]}]
93:["$","h3",null,{"className":"text-xl font-bold mt-6 mb-3 scroll-mt-20","id":"primary-sources","children":[["$","a",null,{"href":"#primary-sources","className":"text-primary hover:underline break-words","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"icon icon-link"}]}],"Primary Sources"]}]
94:["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","strong",null,{"children":"National Data Protection Authorities (10 sources):"}]}]
95:["$","ol",null,{"className":"list-decimal list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":"European Data Protection Board - EU-wide coordination [Source 1]"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Irish Data Protection Commission - 2024 Annual Report [Source 2]"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"French CNIL - 2024 Annual Report [Source 3]"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"German BfDI - 2024 Activity Report [Source 4]"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Spanish AEPD - 2024 Annual Report [Source 5]"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Luxembourg CNPD - 2024 Annual Report [Source 6]"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Italian Garante - 2024 Annual Report [Source 7]"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Belgian APD/GBA - Enforcement decisions [Source 8]"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Netherlands Autoriteit Persoonsgegevens - 2024 data [Source 9]"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"European Data Protection Supervisor - 2024 Annual Report [Source 10]"}],"\n"]}]
96:["$","p",null,{"className":"mb-4 leading-relaxed","children":[["$","strong",null,{"children":"Industry Research (3 sources):"}],"\n11. CMS Law GDPR Enforcement Tracker (enforcementtracker.com) - Ongoing database [Source 11]\n12. DLA Piper GDPR Fines and Data Breach Survey 2025 - Published January 2025 [Source 12]\n13. DLA Piper GDPR Fines and Data Breach Survey 2026 - Published January 2026 [Source 13]"]}]
97:["$","p",null,{"className":"mb-4 leading-relaxed","children":[["$","strong",null,{"children":"Industry Association (1 source):"}],"\n14. IAPP Privacy Tech Vendor Report - 2025 edition [Source 14]"]}]
98:["$","p",null,{"className":"mb-4 leading-relaxed","children":[["$","strong",null,{"children":"Data Aggregators (1 source):"}],"\n15. Statista GDPR Statistics - Multiple data sets, 2025 [Source 15]"]}]
99:["$","p",null,{"className":"mb-4 leading-relaxed","children":[["$","strong",null,{"children":"Academic (1 source):"}],"\n16. Journal of Cybersecurity - \"GDPR and the indefinable effectiveness of privacy regulators\" (2024) [Source 16]"]}]
9a:["$","h3",null,{"className":"text-xl font-bold mt-6 mb-3 scroll-mt-20","id":"data-validation","children":[["$","a",null,{"href":"#data-validation","className":"text-primary hover:underline break-words","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"icon icon-link"}]}],"Data Validation"]}]
9b:["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","strong",null,{"children":"Cross-Reference Methodology:"}]}]
9c:["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":"All headline statistics verified against 3+ independent sources"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Discrepancies investigated and explained in footnotes"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Calculations double-checked manually (percentages, averages, year-over-year changes)"}],"\n"]}]
9d:["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","strong",null,{"children":"Known Limitations:"}]}]
9e:["$","ol",null,{"className":"list-decimal list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":[["$","strong",null,{"children":"Fines under €10,000 may be underreported"}]," - Not all DPAs publish small fines"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":[["$","strong",null,{"children":"Some 2025 actions not yet published"}]," - Reporting lag of 3-6 months typical"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":[["$","strong",null,{"children":"Appeals pending affect final totals"}]," - €1.2B currently under appeal, outcomes uncertain"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":[["$","strong",null,{"children":"Currency conversions"}]," - All amounts converted to EUR using ECB rates as of transaction date"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":[["$","strong",null,{"children":"\"Enforcement action\" definition varies"}]," - Some DPAs count warnings/reprimands, others only fines"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":[["$","strong",null,{"children":"Breach notification totals incomplete"}]," - Only 10 of 27 EU countries publish comprehensive statistics"]}],"\n"]}]
9f:["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","strong",null,{"children":"Confidence Levels:"}]}]
a0:["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":[["$","strong",null,{"children":"High confidence"}]," (used for 78 of 87 data points): 3+ sources agree, calculations verified, no red flags"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":[["$","strong",null,{"children":"Medium confidence"}]," (used for 9 of 87 data points): 2 sources agree, or calculated from partial data"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":[["$","strong",null,{"children":"Low confidence"}]," (excluded from analysis): Single source, or significant methodology questions"]}],"\n"]}]
a1:["$","h3",null,{"className":"text-xl font-bold mt-6 mb-3 scroll-mt-20","id":"data-freshness","children":[["$","a",null,{"href":"#data-freshness","className":"text-primary hover:underline break-words","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"icon icon-link"}]}],"Data Freshness"]}]
a2:["$","p",null,{"className":"mb-4 leading-relaxed","children":[["$","strong",null,{"children":"Last Updated:"}]," March 18, 2026\n",["$","strong",null,{"children":"Next Planned Update:"}]," March 2027 (annual refresh)"]}]
a3:["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","strong",null,{"children":"Update Frequency:"}]}]
a4:["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":"Annual updates to include full-year 2026 data"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Major revisions if significant appeals resolved or methodologies change"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Ad-hoc updates for major enforcement actions (€500M+ fines)"}],"\n"]}]
a5:["$","h3",null,{"className":"text-xl font-bold mt-6 mb-3 scroll-mt-20","id":"geographic--temporal-scope","children":[["$","a",null,{"href":"#geographic--temporal-scope","className":"text-primary hover:underline break-words","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"icon icon-link"}]}],"Geographic & Temporal Scope"]}]
a6:["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","strong",null,{"children":"Geographic Coverage:"}]}]
a7:["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":"27 European Union member states"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"3 European Economic Area countries (Norway, Iceland, Liechtenstein)"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Excludes: UK (post-Brexit, now has separate UK GDPR)"}],"\n"]}]
a8:["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","strong",null,{"children":"Temporal Coverage:"}]}]
a9:["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":"Start: May 25, 2018 (GDPR effective date)"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"End: December 31, 2025"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Duration: 7 years, 7 months, 7 days (2,778 days)"}],"\n"]}]
aa:["$","h3",null,{"className":"text-xl font-bold mt-6 mb-3 scroll-mt-20","id":"download-raw-data","children":[["$","a",null,{"href":"#download-raw-data","className":"text-primary hover:underline break-words","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"icon icon-link"}]}],"Download Raw Data"]}]
ab:["$","p",null,{"className":"mb-4 leading-relaxed","children":"Complete dataset available in machine-readable formats:"}]
ac:["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":[["$","a",null,{"href":"/data/gdpr-enforcement-statistics-2018-2025.csv","className":"text-primary hover:underline break-words","children":"CSV Download"}]," - Spreadsheet-compatible"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":[["$","a",null,{"href":"/data/gdpr-enforcement-statistics-2018-2025.json","className":"text-primary hover:underline break-words","children":"JSON Download"}]," - API-compatible"]}],"\n"]}]
ad:["$","hr",null,{"className":"my-8 border-border"}]
ae:["$","h2",null,{"className":"text-2xl font-bold mt-8 mb-4 scroll-mt-20","id":"how-to-cite-this-data","children":[["$","a",null,{"href":"#how-to-cite-this-data","className":"text-primary hover:underline break-words","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"icon icon-link"}]}],"How to Cite This Data"]}]
af:["$","h3",null,{"className":"text-xl font-bold mt-6 mb-3 scroll-mt-20","id":"quick-citation","children":[["$","a",null,{"href":"#quick-citation","className":"text-primary hover:underline break-words","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"icon icon-link"}]}],"Quick Citation"]}]
b0:["$","blockquote",null,{"className":"border-l-4 border-primary pl-4 italic my-4 text-muted-foreground","children":["\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":["BuiltInEu Research Team (2026). GDPR Enforcement Statistics 2018-2025. Retrieved from ",["$","a",null,{"href":"https://builtineu.eu/blog/gdpr-enforcement-statistics-2018-2025","className":"text-primary hover:underline break-words","target":"_blank","rel":"noopener noreferrer","children":"https://builtineu.eu/blog/gdpr-enforcement-statistics-2018-2025"}]]}],"\n"]}]
b1:["$","h3",null,{"className":"text-xl font-bold mt-6 mb-3 scroll-mt-20","id":"academic-citation-apa-7th-edition","children":[["$","a",null,{"href":"#academic-citation-apa-7th-edition","className":"text-primary hover:underline break-words","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"icon icon-link"}]}],"Academic Citation (APA 7th Edition)"]}]
b2:["$","blockquote",null,{"className":"border-l-4 border-primary pl-4 italic my-4 text-muted-foreground","children":["\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":["BuiltInEu Research Team. (2026, March 18). ",["$","em",null,{"children":"GDPR enforcement statistics 2018-2025: Complete data analysis"}],". BuiltInEu. ",["$","a",null,{"href":"https://builtineu.eu/blog/gdpr-enforcement-statistics-2018-2025","className":"text-primary hover:underline break-words","target":"_blank","rel":"noopener noreferrer","children":"https://builtineu.eu/blog/gdpr-enforcement-statistics-2018-2025"}]]}],"\n"]}]
b3:["$","h3",null,{"className":"text-xl font-bold mt-6 mb-3 scroll-mt-20","id":"newsblog-citation","children":[["$","a",null,{"href":"#newsblog-citation","className":"text-primary hover:underline break-words","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"icon icon-link"}]}],"News/Blog Citation"]}]
b4:["$","p",null,{"className":"mb-4 leading-relaxed","children":["According to an analysis by BuiltInEu, European data protection authorities imposed €5.8 billion in GDPR fines across 2,245+ enforcement actions between May 2018 and December 2025, with 69.5% of fines concentrated in Ireland (",["$","a",null,{"href":"https://builtineu.eu/blog/gdpr-enforcement-statistics-2018-2025","className":"text-primary hover:underline break-words","target":"_blank","rel":"noopener noreferrer","children":"source"}],")."]}]
b5:["$","h3",null,{"className":"text-xl font-bold mt-6 mb-3 scroll-mt-20","id":"wikipedia-citation","children":[["$","a",null,{"href":"#wikipedia-citation","className":"text-primary hover:underline break-words","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"icon icon-link"}]}],"Wikipedia Citation"]}]
b6:["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","strong",null,{"children":"Template format:"}]}]
b7:["$","p",null,{"className":"mb-4 leading-relaxed","children":[["$","code",null,{"className":"bg-slate-100 rounded px-1.5 py-0.5 text-sm font-mono","children":"cite web"}]," with parameters:"]}]
b8:["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":["$","code",null,{"className":"bg-slate-100 rounded px-1.5 py-0.5 text-sm font-mono","children":"title=GDPR Enforcement Statistics 2018-2025"}]}],"\n",["$","li",null,{"className":"leading-relaxed","children":["$","code",null,{"className":"bg-slate-100 rounded px-1.5 py-0.5 text-sm font-mono","children":"url=https://builtineu.eu/blog/gdpr-enforcement-statistics-2018-2025"}]}],"\n",["$","li",null,{"className":"leading-relaxed","children":["$","code",null,{"className":"bg-slate-100 rounded px-1.5 py-0.5 text-sm font-mono","children":"website=BuiltInEu"}]}],"\n",["$","li",null,{"className":"leading-relaxed","children":["$","code",null,{"className":"bg-slate-100 rounded px-1.5 py-0.5 text-sm font-mono","children":"date=2026-03-18"}]}],"\n",["$","li",null,{"className":"leading-relaxed","children":["$","code",null,{"className":"bg-slate-100 rounded px-1.5 py-0.5 text-sm font-mono","children":"access-date=2026-03-18"}]}],"\n"]}]
b9:["$","h3",null,{"className":"text-xl font-bold mt-6 mb-3 scroll-mt-20","id":"direct-data-attribution","children":[["$","a",null,{"href":"#direct-data-attribution","className":"text-primary hover:underline break-words","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"icon icon-link"}]}],"Direct Data Attribution"]}]
ba:["$","p",null,{"className":"mb-4 leading-relaxed","children":"When citing specific statistics from this dataset, please include:"}]
bb:["$","p",null,{"className":"mb-4 leading-relaxed","children":[["$","strong",null,{"children":"Format:"}]," \"Source: BuiltInEu GDPR Enforcement Analysis (2026)\" with a link to this page."]}]
bc:["$","p",null,{"className":"mb-4 leading-relaxed","children":[["$","strong",null,{"children":"Example:"}]," \"Ireland accounts for 69.5% of all GDPR fines despite representing just 6.8% of enforcement actions, according to BuiltInEu's GDPR Enforcement Analysis (2026).\""]}]
bd:["$","hr",null,{"className":"my-8 border-border"}]
be:["$","h3",null,{"className":"text-xl font-bold mt-6 mb-3 scroll-mt-20","id":"license","children":[["$","a",null,{"href":"#license","className":"text-primary hover:underline break-words","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"icon icon-link"}]}],"License"]}]
bf:["$","p",null,{"className":"mb-4 leading-relaxed","children":["This data is published under ",["$","a",null,{"href":"https://creativecommons.org/licenses/by/4.0/","className":"text-primary hover:underline break-words","target":"_blank","rel":"noopener noreferrer","children":"Creative Commons Attribution 4.0 International (CC BY 4.0)"}],"."]}]
c0:["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","strong",null,{"children":"You are free to:"}]}]
c1:["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":"Share, copy and redistribute the material in any medium or format"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Adapt, remix, transform, and build upon the material for any purpose"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Commercial use, use the material for commercial purposes"}],"\n"]}]
c2:["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","strong",null,{"children":"Under the following terms:"}]}]
c3:["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":"Attribution. You must give appropriate credit (see citation formats above)"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Link back. Include a link to this page when citing data"}],"\n"]}]
c4:["$","p",null,{"className":"mb-4 leading-relaxed","children":[["$","strong",null,{"children":"No additional restrictions:"}]," You may not apply legal terms or technological measures that legally restrict others from doing anything the license permits."]}]
c5:["$","hr",null,{"className":"my-8 border-border"}]
c6:["$","h3",null,{"className":"text-xl font-bold mt-6 mb-3 scroll-mt-20","id":"for-researchers--journalists","children":[["$","a",null,{"href":"#for-researchers--journalists","className":"text-primary hover:underline break-words","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"icon icon-link"}]}],"For Researchers & Journalists"]}]
c7:["$","p",null,{"className":"mb-4 leading-relaxed","children":"If you're writing about GDPR enforcement and need specific data points:"}]
c8:["$","ol",null,{"className":"list-decimal list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":[["$","strong",null,{"children":"Browse the dataset:"}]," See ",["$","a",null,{"href":"#download-raw-data","className":"text-primary hover:underline break-words","children":"Download Raw Data"}]," for CSV/JSON exports"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":[["$","strong",null,{"children":"Cite comprehensively:"}]," If using 3+ statistics, cite the full analysis (not individual stats)"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":[["$","strong",null,{"children":"Contact us:"}]," For clarifications or custom analyses, email ",["$","a",null,{"href":"mailto:info@builtineu.eu","className":"text-primary hover:underline break-words","children":"info@builtineu.eu"}]]}],"\n"]}]
c9:["$","p",null,{"className":"mb-4 leading-relaxed","children":"We appreciate being cited and are happy to provide additional context when needed."}]
ca:["$","hr",null,{"className":"my-8 border-border"}]
cb:["$","h2",null,{"className":"text-2xl font-bold mt-8 mb-4 scroll-mt-20","id":"download-raw-data-1","children":[["$","a",null,{"href":"#download-raw-data-1","className":"text-primary hover:underline break-words","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"icon icon-link"}]}],"Download Raw Data"]}]
cc:["$","p",null,{"className":"mb-4 leading-relaxed","children":"The complete dataset is available for download in multiple formats:"}]
cd:["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":[["$","strong",null,{"children":["$","a",null,{"href":"/data/gdpr-enforcement-statistics-2018-2025.csv","className":"text-primary hover:underline break-words","children":"CSV Download"}]}]," (spreadsheet-compatible)"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":[["$","strong",null,{"children":["$","a",null,{"href":"/data/gdpr-enforcement-statistics-2018-2025.json","className":"text-primary hover:underline break-words","children":"JSON Download"}]}]," (API-compatible)"]}],"\n"]}]
ce:["$","p",null,{"className":"mb-4 leading-relaxed","children":[["$","strong",null,{"children":"License:"}]," ",["$","a",null,{"href":"https://creativecommons.org/licenses/by/4.0/","className":"text-primary hover:underline break-words","target":"_blank","rel":"noopener noreferrer","children":"Creative Commons Attribution 4.0 International (CC BY 4.0)"}]]}]
cf:["$","p",null,{"className":"mb-4 leading-relaxed","children":[["$","strong",null,{"children":"Attribution required:"}]," When using this data, please cite: \"Source: BuiltInEu GDPR Enforcement Analysis (2026)\" with a link to this page."]}]
d0:["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","strong",null,{"children":"File details:"}]}]
d1:["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":[["$","strong",null,{"children":"CSV size:"}]," ~45 KB (8 tables, 127 rows total)"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":[["$","strong",null,{"children":"JSON size:"}]," ~52 KB (structured array of objects)"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":[["$","strong",null,{"children":"Last updated:"}]," March 18, 2026"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":[["$","strong",null,{"children":"Next update:"}]," March 2027"]}],"\n"]}]
d2:["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","strong",null,{"children":"What's included:"}]}]
d3:["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":"Table 1: Overview & cumulative totals"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Table 2: Year-over-year trends (2018-2025)"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Table 3: Country-by-country breakdown (30 countries)"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Table 4: Largest individual fines (top 20)"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Table 5: Violation types & categories"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Table 6: Data breach notifications by country"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Table 7: Enforcement by industry sector"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Table 8: Appeals status and outcomes"}],"\n"]}]
d4:["$","hr",null,{"className":"my-8 border-border"}]
d5:["$","h2",null,{"className":"text-2xl font-bold mt-8 mb-4 scroll-mt-20","id":"sources","children":[["$","a",null,{"href":"#sources","className":"text-primary hover:underline break-words","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"icon icon-link"}]}],"Sources"]}]
d6:["$","p",null,{"className":"mb-4 leading-relaxed","children":["This analysis cites ",["$","strong",null,{"children":"16 sources"}]," spanning government reports, industry research, and academic publications."]}]
d7:["$","h3",null,{"className":"text-xl font-bold mt-6 mb-3 scroll-mt-20","id":"government--official-sources","children":[["$","a",null,{"href":"#government--official-sources","className":"text-primary hover:underline break-words","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"icon icon-link"}]}],"Government & Official Sources"]}]
d8:["$","ol",null,{"className":"list-decimal list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":["\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":[["$","strong",null,{"children":"European Data Protection Board."}]," (Ongoing). GDPR Enforcement. Retrieved from ",["$","a",null,{"href":"https://www.edpb.europa.eu/our-work-tools/our-documents/topic/gdpr-enforcement_en","className":"text-primary hover:underline break-words","target":"_blank","rel":"noopener noreferrer","children":"https://www.edpb.europa.eu/our-work-tools/our-documents/topic/gdpr-enforcement_en"}]]}],"\n"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":["\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":[["$","strong",null,{"children":"Irish Data Protection Commission."}]," (2025, June). Annual Report 2024. Retrieved from ",["$","a",null,{"href":"https://www.dataprotection.ie/en/data-protection-commission-publishes-2024-annual-report","className":"text-primary hover:underline break-words","target":"_blank","rel":"noopener noreferrer","children":"https://www.dataprotection.ie/en/data-protection-commission-publishes-2024-annual-report"}]]}],"\n"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":["\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":[["$","strong",null,{"children":"French CNIL."}]," (2025). Annual Report: CNIL's Achievements and Key Actions in 2024. Retrieved from ",["$","a",null,{"href":"https://www.cnil.fr/en/annual-report-2024","className":"text-primary hover:underline break-words","target":"_blank","rel":"noopener noreferrer","children":"https://www.cnil.fr/en/annual-report-2024"}]]}],"\n"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":["\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":[["$","strong",null,{"children":"German BfDI (Federal Commissioner for Data Protection and Freedom of Information)."}]," (2025, April). 33rd Annual Activity Report (2024). Retrieved from ",["$","a",null,{"href":"https://www.bfdi.bund.de/SharedDocs/Downloads/EN/Taetigkeitsberichte/33TB_24.html","className":"text-primary hover:underline break-words","target":"_blank","rel":"noopener noreferrer","children":"https://www.bfdi.bund.de/SharedDocs/Downloads/EN/Taetigkeitsberichte/33TB_24.html"}]]}],"\n"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":["\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":[["$","strong",null,{"children":"Spanish AEPD (Agencia Española de Protección de Datos)."}]," (2025, June). Annual Report 2024. Retrieved from ",["$","a",null,{"href":"https://privacymatters.dlapiper.com/2025/06/spain-spanish-data-protection-authority-publishes-annual-report/","className":"text-primary hover:underline break-words","target":"_blank","rel":"noopener noreferrer","children":"https://privacymatters.dlapiper.com/2025/06/spain-spanish-data-protection-authority-publishes-annual-report/"}]]}],"\n"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":["\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":[["$","strong",null,{"children":"Luxembourg CNPD (Commission Nationale pour la Protection des Données)."}]," (2025, September). Annual Report 2024: Artificial Intelligence at the Heart of the CNPD's Missions. Retrieved from ",["$","a",null,{"href":"https://cnpd.public.lu/en/actualites/national/2025/09/rapport-annuel-2024.html","className":"text-primary hover:underline break-words","target":"_blank","rel":"noopener noreferrer","children":"https://cnpd.public.lu/en/actualites/national/2025/09/rapport-annuel-2024.html"}]]}],"\n"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":["\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":[["$","strong",null,{"children":"Italian Garante per la Protezione dei Dati Personali."}]," (2025). 2024 Annual Report to Parliament. Retrieved from ",["$","a",null,{"href":"https://www.advant-nctm.com/en/news/relazione-annuale-2024-del-garante-privacy-al-parlamento","className":"text-primary hover:underline break-words","target":"_blank","rel":"noopener noreferrer","children":"https://www.advant-nctm.com/en/news/relazione-annuale-2024-del-garante-privacy-al-parlamento"}]]}],"\n"]}],"\n","$L114","\n","$L115","\n","$L116","\n"]}]
d9:["$","h3",null,{"className":"text-xl font-bold mt-6 mb-3 scroll-mt-20","id":"industry-research","children":[["$","a",null,{"href":"#industry-research","className":"text-primary hover:underline break-words","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"icon icon-link"}]}],"Industry Research"]}]
da:["$","ol",null,{"className":"list-decimal list-inside mb-4 space-y-2","start":"11","children":["\n",["$","li",null,{"className":"leading-relaxed","children":["\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":[["$","strong",null,{"children":"CMS Law."}]," (Ongoing). GDPR Enforcement Tracker - List of GDPR Fines. Retrieved from ",["$","a",null,{"href":"https://www.enforcementtracker.com/","className":"text-primary hover:underline break-words","target":"_blank","rel":"noopener noreferrer","children":"https://www.enforcementtracker.com/"}]]}],"\n"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":["\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":[["$","strong",null,{"children":"DLA Piper."}]," (2025, January). GDPR Fines and Data Breach Survey: January 2025. Retrieved from ",["$","a",null,{"href":"https://www.dlapiper.com/en/insights/publications/2025/01/dla-piper-gdpr-fines-and-data-breach-survey-january-2025","className":"text-primary hover:underline break-words","target":"_blank","rel":"noopener noreferrer","children":"https://www.dlapiper.com/en/insights/publications/2025/01/dla-piper-gdpr-fines-and-data-breach-survey-january-2025"}]]}],"\n"]}],"\n",["$","li",null,{"className":"leading-relaxed","children":["\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":[["$","strong",null,{"children":"DLA Piper."}]," (2026, January). GDPR Fines and Data Breach Survey: January 2026. Retrieved from ",["$","a",null,{"href":"https://www.dlapiper.com/en/insights/publications/2026/01/dla-piper-gdpr-fines-and-data-breach-survey-january-2026","className":"text-primary hover:underline break-words","target":"_blank","rel":"noopener noreferrer","children":"https://www.dlapiper.com/en/insights/publications/2026/01/dla-piper-gdpr-fines-and-data-breach-survey-january-2026"}]]}],"\n"]}],"\n"]}]
db:["$","h3",null,{"className":"text-xl font-bold mt-6 mb-3 scroll-mt-20","id":"industry-association","children":[["$","a",null,{"href":"#industry-association","className":"text-primary hover:underline break-words","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"icon icon-link"}]}],"Industry Association"]}]
dc:["$","ol",null,{"className":"list-decimal list-inside mb-4 space-y-2","start":"14","children":["\n",["$","li",null,{"className":"leading-relaxed","children":[["$","strong",null,{"children":"International Association of Privacy Professionals (IAPP)."}]," (2025). Privacy Tech Vendor Report. Retrieved from ",["$","a",null,{"href":"https://iapp.org/resources/article/privacy-tech-vendor-report","className":"text-primary hover:underline break-words","target":"_blank","rel":"noopener noreferrer","children":"https://iapp.org/resources/article/privacy-tech-vendor-report"}]]}],"\n"]}]
dd:["$","h3",null,{"className":"text-xl font-bold mt-6 mb-3 scroll-mt-20","id":"data-aggregators","children":[["$","a",null,{"href":"#data-aggregators","className":"text-primary hover:underline break-words","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"icon icon-link"}]}],"Data Aggregators"]}]
de:["$","ol",null,{"className":"list-decimal list-inside mb-4 space-y-2","start":"15","children":["\n",["$","li",null,{"className":"leading-relaxed","children":[["$","strong",null,{"children":"Statista."}]," (2025). GDPR Largest Fines Issued 2025. Retrieved from ",["$","a",null,{"href":"https://www.statista.com/statistics/1133337/largest-fines-issued-gdpr/","className":"text-primary hover:underline break-words","target":"_blank","rel":"noopener noreferrer","children":"https://www.statista.com/statistics/1133337/largest-fines-issued-gdpr/"}]]}],"\n"]}]
df:["$","h3",null,{"className":"text-xl font-bold mt-6 mb-3 scroll-mt-20","id":"academic-research","children":[["$","a",null,{"href":"#academic-research","className":"text-primary hover:underline break-words","aria-hidden":"true","tabIndex":"-1","children":["$","span",null,{"className":"icon icon-link"}]}],"Academic Research"]}]
e0:["$","ol",null,{"className":"list-decimal list-inside mb-4 space-y-2","start":"16","children":["\n",["$","li",null,{"className":"leading-relaxed","children":[["$","strong",null,{"children":"Wainwright, H., & Edwards, L."}]," (2024). GDPR and the indefinable effectiveness of privacy regulators: Can performance assessment be improved? ",["$","em",null,{"children":"Journal of Cybersecurity"}],", 10(1), tyae017. ",["$","a",null,{"href":"https://doi.org/10.1093/cybersecurity/tyae017","className":"text-primary hover:underline break-words","target":"_blank","rel":"noopener noreferrer","children":"https://doi.org/10.1093/cybersecurity/tyae017"}]]}],"\n"]}]
e1:["$","hr",null,{"className":"my-8 border-border"}]
e2:["$","p",null,{"className":"mb-4 leading-relaxed","children":[["$","strong",null,{"children":"Total Sources:"}]," 16"]}]
e3:["$","hr",null,{"className":"my-8 border-border"}]
e4:["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","em",null,{"children":["This analysis will be updated annually. For updates or corrections, contact ",["$","a",null,{"href":"mailto:info@builtineu.eu","className":"text-primary hover:underline break-words","children":"info@builtineu.eu"}]]}]}]
e5:["$","div",null,{"className":"mt-12 pt-8 border-t border-border","children":["$","div",null,{"className":"flex flex-wrap items-center gap-2","children":[["$","svg",null,{"xmlns":"http://www.w3.org/2000/svg","width":24,"height":24,"viewBox":"0 0 24 24","fill":"none","stroke":"currentColor","strokeWidth":2,"strokeLinecap":"round","strokeLinejoin":"round","className":"lucide lucide-tag w-4 h-4 text-muted-foreground","aria-hidden":"true","children":[["$","path","vktsd0",{"d":"M12.586 2.586A2 2 0 0 0 11.172 2H4a2 2 0 0 0-2 2v7.172a2 2 0 0 0 .586 1.414l8.704 8.704a2.426 2.426 0 0 0 3.42 0l6.58-6.58a2.426 2.426 0 0 0 0-3.42z"}],["$","circle","kqv944",{"cx":"7.5","cy":"7.5","r":".5","fill":"currentColor"}],"$undefined"]}],[["$","$L28","GDPR",{"href":"/blog?tag=GDPR","className":"px-3 py-1 rounded-full text-sm bg-slate-100 text-slate-700 hover:bg-slate-200 transition-colors","children":"GDPR"}],["$","$L28","Data Protection",{"href":"/blog?tag=Data%20Protection","className":"px-3 py-1 rounded-full text-sm bg-slate-100 text-slate-700 hover:bg-slate-200 transition-colors","children":"Data Protection"}],["$","$L28","Statistics",{"href":"/blog?tag=Statistics","className":"px-3 py-1 rounded-full text-sm bg-slate-100 text-slate-700 hover:bg-slate-200 transition-colors","children":"Statistics"}],["$","$L28","Enforcement",{"href":"/blog?tag=Enforcement","className":"px-3 py-1 rounded-full text-sm bg-slate-100 text-slate-700 hover:bg-slate-200 transition-colors","children":"Enforcement"}],["$","$L28","Privacy Law",{"href":"/blog?tag=Privacy%20Law","className":"px-3 py-1 rounded-full text-sm bg-slate-100 text-slate-700 hover:bg-slate-200 transition-colors","children":"Privacy Law"}],["$","$L28","EU Regulation",{"href":"/blog?tag=EU%20Regulation","className":"px-3 py-1 rounded-full text-sm bg-slate-100 text-slate-700 hover:bg-slate-200 transition-colors","children":"EU Regulation"}]]]}]}]
eb:["$","td",null,{"className":"px-4 py-2 border-b","children":"7"}]
ec:["$","td",null,{"className":"px-4 py-2 border-b","children":"🇳🇱 Netherlands"}]
ed:["$","td",null,{"className":"px-4 py-2 border-b","children":"156"}]
ee:["$","td",null,{"className":"px-4 py-2 border-b","children":"2.7%"}]
ef:["$","td",null,{"className":"px-4 py-2 border-b","children":"134"}]
f0:["$","td",null,{"className":"px-4 py-2 border-b","children":"1,164"}]
f1:["$","td",null,{"className":"px-4 py-2 border-b","children":"18"}]
f2:["$","td",null,{"className":"px-4 py-2 border-b","children":"8.7"}]
f3:["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":"8"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"🇵🇱 Poland"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"78"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"1.3%"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"187"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"417"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"38"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"2.1"}]]}]
f4:["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":"9"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"🇦🇹 Austria"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"71"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"1.2%"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"92"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"772"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"9"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"7.9"}]]}]
f5:["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":"10"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"🇧🇪 Belgium"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"54"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"0.9%"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"78"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"692"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"12"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"4.5"}]]}]
f6:["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b"}],["$","td",null,{"className":"px-4 py-2 border-b","children":["$","strong",null,{"children":"EU Total"}]}],["$","td",null,{"className":"px-4 py-2 border-b","children":["$","strong",null,{"children":"~5,810"}]}],["$","td",null,{"className":"px-4 py-2 border-b","children":["$","strong",null,{"children":"100%"}]}],["$","td",null,{"className":"px-4 py-2 border-b","children":["$","strong",null,{"children":"2,245+"}]}],["$","td",null,{"className":"px-4 py-2 border-b","children":["$","strong",null,{"children":"2,588"}]}],["$","td",null,{"className":"px-4 py-2 border-b","children":["$","strong",null,{"children":"447"}]}],["$","td",null,{"className":"px-4 py-2 border-b","children":["$","strong",null,{"children":"13"}]}]]}]
f9:["$","li",null,{"className":"leading-relaxed","children":["\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","strong",null,{"children":"Eastern Europe underrepresented"}]}],"\n",["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":"Poland, Czech Republic, Romania, Bulgaria combined: €124M (2.1% of total)"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Resource constraints at DPAs cited in multiple studies [Source 16]"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Possible underreporting of small fines (under €10K)"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Less attractive for Big Tech headquarters (fewer mega-cases)"}],"\n"]}],"\n"]}]
fa:["$","td",null,{"className":"px-4 py-2 border-b","children":"Sep 2021"}]
fb:["$","td",null,{"className":"px-4 py-2 border-b","children":"Transparency violations"}]
fc:["$","td",null,{"className":"px-4 py-2 border-b","children":"Reduced to €5.5M"}]
fd:["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":"8"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Google (Alphabet)"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"90"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Ireland"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Jan 2022"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Transparency, consent"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Confirmed"}]]}]
fe:["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":"9"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Enel Energia"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"79.1"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Italy"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Feb 2024"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Inadequate security"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Confirmed"}]]}]
ff:["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":"10"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Google LLC"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"50"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"France"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Jan 2019"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Consent, transparency"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Confirmed"}]]}]
100:["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b"}],["$","td",null,{"className":"px-4 py-2 border-b","children":["$","strong",null,{"children":"Top 10 Total"}]}],["$","td",null,{"className":"px-4 py-2 border-b","children":["$","strong",null,{"children":"4,025.1"}]}],["$","td",null,{"className":"px-4 py-2 border-b","children":"-"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"-"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"-"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"€1.2B under appeal"}]]}]
101:["$","td",null,{"className":"px-4 py-2 border-b","children":"210"}]
102:["$","td",null,{"className":"px-4 py-2 border-b","children":"Various"}]
105:["$","li",null,{"className":"leading-relaxed","children":"Heightened scrutiny on social media platforms' treatment of minors"}]
106:["$","li",null,{"className":"leading-relaxed","children":["\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","strong",null,{"children":"Data subject rights violations are frequent but low-value"}]}],"\n",["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":"Right of access (Art. 15) most commonly violated"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"718 actions, but only €287M (€400K average)"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Typically: ignoring requests, charging fees, excessive delays, incomplete responses"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Shows DPAs actively enforcing individual rights, not just institutional violations"}],"\n"]}],"\n"]}]
107:["$","strong",null,{"children":"Hospitality & Travel"}]
108:["$","td",null,{"className":"px-4 py-2 border-b","children":"54"}]
109:["$","td",null,{"className":"px-4 py-2 border-b","children":"0.9%"}]
10a:["$","td",null,{"className":"px-4 py-2 border-b","children":"0.3"}]
10b:["$","td",null,{"className":"px-4 py-2 border-b","children":"180"}]
10c:["$","td",null,{"className":"px-4 py-2 border-b","children":"Guest data, CCTV, booking data"}]
10d:["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":["$","strong",null,{"children":"Media & Publishing"}]}],["$","td",null,{"className":"px-4 py-2 border-b","children":"43"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"0.7%"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"0.4"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"108"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Marketing, cookies, subscriber data"}]]}]
10e:["$","tr",null,{"children":[["$","td",null,{"className":"px-4 py-2 border-b","children":["$","strong",null,{"children":"Other"}]}],["$","td",null,{"className":"px-4 py-2 border-b","children":"77"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"1.3%"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"0.2"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"385"}],["$","td",null,{"className":"px-4 py-2 border-b","children":"Various"}]]}]
10f:["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","strong",null,{"children":"Public sector has lowest average fines"}]}]
110:["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":"980 actions, €98M total (€100K average)"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"DPAs reluctant to fine government entities heavily (money moves between public budgets)"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Focus on compliance orders and warnings rather than financial penalties"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Common violations: slow response to access requests, inadequate security"}],"\n"]}]
111:["$","a",null,{"href":"/products/bunny-net","className":"text-primary hover:underline break-words","children":"Bunny CDN"}]
112:["$","a",null,{"href":"/products/plausible","className":"text-primary hover:underline break-words","children":"Plausible"}]
113:["$","li",null,{"className":"leading-relaxed","children":["\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":["$","strong",null,{"children":"Sectoral codes of conduct emerging"}]}],"\n",["$","ul",null,{"className":"list-disc list-inside mb-4 space-y-2","children":["\n",["$","li",null,{"className":"leading-relaxed","children":"Luxembourg approved first sectoral code (temporary work) in 2024 [Source 6]"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Article 40 GDPR allows industry-specific guidelines"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Reduces enforcement burden: compliance certification vs case-by-case review"}],"\n",["$","li",null,{"className":"leading-relaxed","children":"Expected: 5-10 additional sectoral codes by 2027"}],"\n"]}],"\n"]}]
114:["$","li",null,{"className":"leading-relaxed","children":["\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":[["$","strong",null,{"children":"Belgian APD/GBA (Autorité de protection des données / Gegevensbeschermingsautoriteit)."}]," (2024). Enforcement Decisions. Retrieved from ",["$","a",null,{"href":"https://gdprhub.eu/APD/GBA_(Belgium)","className":"text-primary hover:underline break-words","target":"_blank","rel":"noopener noreferrer","children":"https://gdprhub.eu/APD/GBA_(Belgium)"}]]}],"\n"]}]
115:["$","li",null,{"className":"leading-relaxed","children":["\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":[["$","strong",null,{"children":"Netherlands Autoriteit Persoonsgegevens."}]," (2024). Facts and Figures About the AP. Retrieved from ",["$","a",null,{"href":"https://www.autoriteitpersoonsgegevens.nl/en/over-de-autoriteit-persoonsgegevens/feiten-en-cijfers","className":"text-primary hover:underline break-words","target":"_blank","rel":"noopener noreferrer","children":"https://www.autoriteitpersoonsgegevens.nl/en/over-de-autoriteit-persoonsgegevens/feiten-en-cijfers"}]]}],"\n"]}]
116:["$","li",null,{"className":"leading-relaxed","children":["\n",["$","p",null,{"className":"mb-4 leading-relaxed","children":[["$","strong",null,{"children":"European Data Protection Supervisor."}]," (2025, April). Annual Report 2024: Acting for the Future of Data Protection. Retrieved from ",["$","a",null,{"href":"https://www.edps.europa.eu/system/files/2025-04/edps_annual_report-2024_en.pdf","className":"text-primary hover:underline break-words","target":"_blank","rel":"noopener noreferrer","children":"https://www.edps.europa.eu/system/files/2025-04/edps_annual_report-2024_en.pdf"}]]}],"\n"]}]
19:0
c:"$undefined"
5:"$undefined"
18:"$undefined"
11:"$undefined"
