General Data Protection Regulation
The EU's comprehensive data protection framework governing how organisations worldwide collect, store, and process personal data of individuals in the European Economic Area.
The GDPR is an EU law that controls what companies can do with your personal information. Your name, email address, location, browsing history, even the IP address of your phone -- all of it is "personal data" under this law. Any organisation that collects or uses that kind of information about people in Europe must follow the GDPR's rules, no matter where in the world that organisation is based.
The core idea is simple: you own your data, not the company that collected it. You have the right to see what a company knows about you, to have mistakes corrected, and to ask for your data to be deleted entirely. Companies must tell you upfront what they collect, why they need it, and how long they plan to keep it. They cannot just harvest your data and figure out a justification later.
The consequences for breaking these rules are real. Regulators across Europe have handed out over EUR 7 billion in fines since 2018. The biggest penalties have hit household names -- Meta, Amazon, TikTok -- but smaller companies face enforcement too. A fine of even a few thousand euros can be devastating for a small business.
If your company has customers, employees, or website visitors in Europe, the GDPR applies to you. It is not optional, and "we didn't know" is not a defence.
The General Data Protection Regulation (Regulation (EU) 2016/679) is the most significant piece of data protection legislation in history. It replaced the 1995 Data Protection Directive and established a single, directly-applicable set of rules across all EU and EEA member states. Its extraterritorial reach means it also applies to organisations outside the EU that offer goods or services to, or monitor the behaviour of, EU residents.
At its core, the GDPR gives individuals control over their personal data. It establishes rights to access, correct, delete, and port personal data, and requires organisations to have a valid legal basis for every processing activity. It mandates transparency -- organisations must clearly explain what data they collect, why, and how long they keep it.
Enforcement has been vigorous and accelerating. National Data Protection Authorities have collectively issued over EUR 7 billion in fines since 2018, with landmark penalties against major technology companies setting precedent across sectors. Ireland's DPC alone has issued over EUR 4 billion in fines -- nearly four times the next-largest authority -- due to Silicon Valley companies maintaining their European headquarters in Dublin.
The regulatory landscape continues to evolve. The CJEU issued several landmark rulings in 2025 clarifying core GDPR concepts, while the European Commission's Digital Omnibus Package proposes the first substantive amendments to the regulation since its adoption -- including provisions for AI processing and streamlined cross-border enforcement. Separately, Regulation (EU) 2025/2518, adopted in November 2025, introduces binding procedural rules for cross-border enforcement and will apply from April 2027.
Our database tracks 1,051 GDPR enforcement decisions with a combined value of €2.5B. Here is where the money went.
| # | DECISION | AUTHORITY | FINE | DATE |
|---|---|---|---|---|
| 01 | DPC (Ireland) - TikTok | DPC (Ireland) | €530.0M | May 2, 2025 |
| 02 | CNIL (France) - SAN-2025-004 | CNIL (France) | €325.0M | Sep 1, 2025 |
| 03 | DPC (Ireland) - LinkedIn inquiry | DPC (Ireland) | €310.0M | Oct 22, 2024 |
| 04 | AP (The Netherlands) - Uber | AP (The Netherlands) | €290.0M | Jul 22, 2024 |
| 05 | CNIL (France) - SAN-2025-005 | CNIL (France) | €150.0M | Sep 1, 2025 |
| 06 | DPC (Ireland) - Meta Ireland | DPC (Ireland) | €91.0M | Sep 27, 2024 |
| 07 | Garante per la protezione dei dati personali (Italy) - 10097012 | Garante per la protezione dei dati personali (Italy) | €89.3M | Nov 27, 2024 |
| 08 | NAIH (Hungary) - NAIH-3932-5/2024 | NAIH (Hungary) | €80.0M | Jul 2, 2024 |
| 09 | Garante per la protezione dei dati personali (Italy) - 9988710 | Garante per la protezione dei dati personali (Italy) | €79.1M | Feb 8, 2024 |
| 10 | CNIL (France) - SAN-2024-019 | CNIL (France) | €50.0M | Nov 14, 2024 |
The European Commission proposed the first substantive amendments to the GDPR since its adoption. Key changes: narrowed definition of personal data so pseudonymised data may not be personal for recipients who cannot re-identify (codifying the CJEU SRB ruling), new legitimate interest basis for AI model training and operation, right to refuse abusive access requests, raised breach notification threshold to high-risk breaches only, and standardised DPIAs at EU level.
The CJEU confirmed that pseudonymised data is not automatically personal data for all parties. A recipient who cannot reverse the pseudonymisation and has no other means to identify individuals does not process personal data within the meaning of the GDPR.
Ireland's DPC fined TikTok EUR 530 million for unlawful cross-border data transfers to China, making it the second-largest GDPR fine ever. The decision highlighted the risks of transferring data to jurisdictions without adequate protection frameworks.
In Case C-492/23, the CJEU ruled that online marketplace operators qualify as data controllers for personal data in user-generated advertisements, even if they do not create or select the content. Platforms and advertisers are considered joint controllers, and the hosting safe harbour under the e-Commerce Directive does not exempt platforms from GDPR obligations.
The CJEU ruled that data controllers must provide concise, transparent, and easily accessible explanations of the procedure and principles actually applied by automated systems to arrive at a specific result. This strengthens Article 15 access rights in the context of algorithmic decision-making.
Regulation (EU) 2025/2518 was adopted to improve cooperation between supervisory authorities, introducing uniform complaint admissibility criteria, mandatory investigation deadlines (15 months, extendable to 27 for complex cases), and enhanced cooperation files. It will apply from 2 April 2027, addressing long-standing criticism of the one-stop-shop mechanism.
Select your company type for tailored compliance guidance and risk assessment.