Breach Notifications in Europe Rise, While Fines Hold Steady

A global law firm said the volume of data breach notifications received by Europeans increased by one-fifth over the past year – although total fines being imposed by data protection authorities held steady.

See Also: Outcome-Driven Metrics Win Board Support

Global law firm DLA Piper said fines imposed under the EU’s General Data Protection Regulation totaled 1.2 billion euros – $1.4 billion – in 2025, a near-repeat of the total amount imposed by regulators in 2024. The steady level demonstrates “a sustained high level of enforcement rather than a slowdown.”

The law firm characterized the steady enforcement as evidence that data protection authorities will continue to impose substantial fines despite political pressure from outside Europe. Regulators targeted individual technologies such as artificial intelligence as well as supply chain security, said Ross McKean, partner and chair of DLA Piper’s U.K. data protection and cybersecurity practice.

“Regulators remain highly active, particularly in areas such as information security, international data transfers, transparency and the complex interplay between AI innovation and data protection laws,” he said.

As in previous years, in 2025 U.S. tech firms and social media giants paid the greatest amounts – an unsurprising fact, given how many Europeans say American consumer surveillance-driven practices are inherent incompatible with continental privacy practices (see: Total Fines Imposed by EU Privacy Regulators Dropped in 2024).

Many U.S. tech giants have their European operations based in Ireland. Not coincidentally, the biggest GDPR fine imposed in history remains the 1.2 billion euros imposed by the Irish Data Protection Commission against Meta Platforms Ireland in 2023. Still, the Irish Data Protection Commission has come under heavy criticism from EU counterparts for allegedly treating U.S. tech companies with kid gloves.

The Irish DPC in 2025 again dispensed Europe’s biggest GDPR fine, this time against Chinese social media firm TikTok, amounting to 530 million euros. The sanctions stemmed from TikTok storing Europeans’ personal data on Chinese servers from July 2020 through November 2022 without informing users or demonstrating that the data was being adequately protected.

European concerns about data transparency and privacy protections historically centered on data transfers to the United States. The TikTok fine marked the first enforcement action imposed for data that didn’t flow across the Atlantic, but another non-EU country, DLA Piper said.

The report covers Jan. 28, 2025, through Jan. 27, 2026. The latter part of this month is based on extrapolated data. Data for some jurisdictions is also based on estimates, since not all data protection authorities publicly release national data breach statistics. For multiple countries – including Belgium, Germany, Italy and the Netherlands, among others – full-year 2025 data is not available.

Total Fines: Ireland Leads

Ireland leads in the total value of GDPR fines issued to date. Since GDPR enforcement began in May 2018, DPC sanctions have amounted to 4 billion euros, the report says.

France comes a distant second, with its fines totaling 1.1 billion euros, although the report carries this caveat: “In France, it is not always possible to separate fines imposed under the GDPR and those imposed under other regimes, such as e-privacy legislation, therefore the aggregate value of fines issued under the GDPR in France may be inflated.”

Luxembourg placed third with 747 million euros in aggregate fines, mainly due to its National Commission for Data Protection, or CNPD, imposing a 746 million euro fine in 2021 against a previously unnamed U.S. online retailer and e-commerce platform. The country’s data protection law prohibits the CNPD from naming the company, commenting on the case or it’s decision-making. A handful of U.S. companies – most notably Amazon – have European operations based in the country, smaller than the U.S. state of Rhode Island.

The sanctioned business is Amazon Europe Core, which appealed the fine in October 2021, followed by a January 2024 hearing before the Luxembourg Administrative Tribunal. On March 18, 2025, the tribunal dismissed Amazon’s appeal and upheld the fine. Amazon may attempt another appeal.

EU Debates GDPR Changes

The European Commission last November unveiled proposed changes to the pioneering privacy law in the form of a Digital Omnibus proposal designed “to simplify, clarify and improve” the multinational bloc’s data protection laws.

The changes are designed to streamline rules and cut compliance costs, with the proposals including the introduction of a new, single online reporting platform for notifying regulators about incidents, to be maintained by EU cybersecurity agency ENISA. The proposals would also extend the notification deadline from 72 hours to 96 hours, and require the European Data Protection Board – comprised of member states’ data protection authorities – “to prepare and submit to the commission a proposal for a common template for data breach notifications.”

DLA Piper said the proposals, including for a single reporting template, are designed to deliver a “report once, share many” approach, in part to address sometimes overlapping obligations under GDPR, the Network and Information Security Directive 2 and the Digital Operational Resilience Act.

The proposals face “a delicate balancing act: simplifying rules without eroding trust or core rights,” it said, adding that the specifics may change as the European Commission, the European Parliament and the EU Council debate the changes later this year.

Calls for More UK Enforcement

Another enforcement trend: Despite Britain ranking fourth last year in the number of data breach notifications issued, GDPR enforcement by the U.K. Information Commissioner’s Office “has otherwise continued to be limited in the U.K. relative to the EU,” said DLA Piper.

The trend has not gone unremarked on inside Great Britain. More than 70 civil society organizations, academics and data protection experts last November urged Parliament’s Select Committee for Science Information and Technology to investigate “the collapse in enforcement activity” by the ICO.

The letter arrived following the ICO’s decision to not investigate the Ministry of Defense after the so-called Afghan data breach, involving the 2022 leak of a spreadsheet identifying 19,000 people fleeing the Taliban. The data was posted to Facebook. In an unprecedented move, the British government issued a super injunction that prohibited public reporting of the breach.

The letter pointed to a more widespread lack of GDPR enforcement by the ICO.

“We need a strong data regulator which is not afraid to take action against both the government and private sector,” said Mariano delli Santi, legal and policy officer at Open Rights Group, which was a signatory to the letter.

Britain has been retooling its domestic GDPR legislation, known as the Data (Use and Access) Act 2025, or DUA Act, which was passed and received Royal Assent on June 19, 2025. The law makes numerous although “relatively modest” changes to existing data protection and e-privacy laws mainly designed to make it easier for Britons to use AI systems for automated decision-making, DLA Piper said.

The changes are being phased in through this June, and will include changing the structure of the ICO, giving it new powers to help in its investigations, as well as new duties and reporting requirements meant to improve transparency and accountability.