GDPR Enforcement Trends: What Businesses Must Prepare For

The Maturation of GDPR Enforcement

Seven years since GDPR came into force, enforcement has matured significantly from the cautious early years. Total GDPR fines have exceeded €5 billion, with the pace accelerating — the last two years have seen more enforcement action than the first five combined.

Key Enforcement Focus Areas

International Data Transfers

International data transfers have been a dominant enforcement theme. The Schrems II decision invalidated Privacy Shield in 2020. The DPC's 2023 €1.2 billion fine against Meta for Facebook's data transfers to the US — the largest GDPR fine to date — followed the European Data Protection Board's binding decision requiring suspension of the transfers.

The EU-US Data Privacy Framework adopted in 2023 provides a new adequacy basis for transfers to certified US organisations, but its durability depends on continued political commitment and has been legally challenged.

Data Subject Rights

Enforcement of data subject rights — access requests, erasure requests, and objections to processing — has increased significantly. Common enforcement findings: excessive delays in responding to access requests (statutory one-month deadline routinely exceeded), inappropriate refusals of erasure requests without adequate justification.

Purpose Limitation and Legal Basis

Enforcement actions have targeted organisations that collect data for one purpose and process it for another without adequate legal basis, and organisations relying on consent without valid consent mechanisms.

AI and Automated Decision-Making

Article 22 protections against solely automated decision-making with significant effects are receiving increasing attention as AI-powered decision-making becomes more common. Organisations using AI in credit scoring, recruitment, and insurance underwriting face increasing supervisory scrutiny.

Operational Compliance Priorities

Data mapping. Organisations without comprehensive, current records of processing activities — required by Article 30 — cannot demonstrate compliance with any other GDPR requirement. Data mapping must be treated as a living record.

Data subject rights processes. Implement processes reliably meeting the statutory one-month response deadline for all request types.

Breach notification readiness. The 72-hour breach notification deadline leaves no time for investigation before notification if the process isn't pre-established. Incident response plans must specifically address GDPR breach notification.

Third-party data processor management. Data processing agreements with all processors are required. Many organisations lack DPAs with long-standing service providers. Regular assessment of processor compliance is required — passing obligations to processors in a contract doesn't discharge the controller's responsibility.