By October 2024, GDPR fines had already topped €4.5 billion across 1,728 decisions, and the latest enforcement pressure is still building. At the same time, complaint volumes and breach notifications are shifting in striking ways, from data access rights taking nearly half of all complaints to health data breaches rising to 28% of 2023 cases. This post turns that mix of regulator activity, sanctions, and rights requests into a clear, country by country snapshot of where GDPR scrutiny is landing.
Key Takeaways
- In 2023, the Irish DPC handled 92 cross-border cases leading to fines.
- EU-wide, 1,014,625 complaints were filed with DPAs in 2023.
- Ireland's DPC received 22,019 complaints in 2023, a 15% increase from 2022.
- 85% of organizations appoint DPOs as per 2023 surveys.
- 92% of EU firms conducted DPIAs by 2023 per ENISA.
- Global companies' GDPR compliance spend: €10 billion annually.
- EU-wide, 2,114,827 data breach notifications in 2023.
- Ireland DPC received 13,477 breach notifications in 2023.
- France CNIL was notified of 1,800 breaches in 2023.
- As of October 2024, the total amount of fines imposed under GDPR exceeds €4.5 billion across 1,728 fines.
- In 2023, Ireland's Data Protection Commission (DPC) issued fines totaling €1.45 billion, primarily to Big Tech companies.
- Meta Platforms Ireland Limited received the largest single GDPR fine of €1.2 billion in September 2022 for unlawful data transfers to the US.
- EU DPAs conducted 1,200 investigations in 2023.
- Ireland DPC opened 92 cross-border investigations in 2023.
- France CNIL carried out 450 on-site audits in 2023.
Across the EU in 2023, complaints soared and fines topped €4.5 billion, with 40% of investigations resulting in penalties.
Related reading
01 · Category
Complaints Filed30 stats
01
In 2023, the Irish DPC handled 92 cross-border cases leading to fines.
02
EU-wide, 1,014,625 complaints were filed with DPAs in 2023.
03
Ireland's DPC received 22,019 complaints in 2023, a 15% increase from 2022.
04
France's CNIL logged 1,145,879 tasks in 2023, including 35,843 formal complaints.
05
UK's ICO received 182,845 concerns in 2023/24.
06
Germany's DPAs handled 57,328 complaints in 2022.
07
Spain's AEPD received 36,514 complaints in 2023.
08
Italy's Garante processed 15,978 complaints in 2022.
09
Netherlands DPA received 25,000 complaints in 2023.
10
47% of complaints in 2023 concerned data access rights (Art. 15).
11
In 2023, 22% of EU complaints related to unlawful data processing.
12
Portugal's CNPD received 4,500 complaints in 2023, mostly about marketing.
13
Belgium's APD logged 10,245 complaints in 2023.
14
Austria's DSB handled 5,672 complaints in 2022.
15
Sweden's IMY received 6,800 complaints in 2023.
16
Finland's office processed 2,300 complaints in 2023.
17
Greece HDPA saw 8,200 complaints in 2023, up 20%.
18
Denmark Datatilsynet received 4,100 complaints in 2023.
19
Norway Datatilsynet handled 3,500 complaints in 2023.
20
In 2023, children's data complaints rose 25% EU-wide.
21
18% of 2023 complaints involved right to erasure (Art. 17).
22
Cross-border complaints increased to 1,200 in 2023 per EDPB.
23
Italy saw 1,200 complaints about video surveillance in 2022.
24
France had 4,500 complaints on direct marketing in 2023.
25
Germany reported 12,000 complaints on employee data in 2022.
26
Spain AEPD noted 5,000 health data complaints in 2023.
27
In 2023, EU DPAs closed 850,000 complaints, 82% resolved.
28
Ireland DPC's complaint closure rate was 95% in 2023.
29
Between 2018-2023, 5.5 million complaints filed EU-wide.
30
In 2024 H1, complaints grew 10% YoY to 550,000.
Interpretation
Complaints Filed Interpretation
While EU citizens are increasingly, and with striking specificity, asserting their digital rights—from access requests to complaints about video surveillance—the sheer volume of over a million annual GDPR complaints underscores a fundamental truth: the promise of data privacy is a bustling, global, and often bureaucratic, conversation.
02 · Category
Compliance and Adoption22 stats
01
85% of organizations appoint DPOs as per 2023 surveys.
02
92% of EU firms conducted DPIAs by 2023 per ENISA.
03
Global companies' GDPR compliance spend: €10 billion annually.
04
78% of SMEs achieved basic GDPR compliance by 2022.
05
Training hours per employee on GDPR: average 4 hours in 2023.
06
65% of firms use consent management platforms post-GDPR.
07
Adoption of privacy by design: 70% in EU tech firms 2023.
08
DPO roles filled in 88% of large enterprises in 2023.
09
Vendor risk assessments completed by 82% of firms in 2023.
10
Records of Processing Activities (RoPAs) maintained by 95%.
11
55% of non-EU firms extended GDPR-like measures globally.
12
Employee awareness training coverage: 90% in multinationals.
13
Use of pseudonymisation techniques: 75% adoption rate 2023.
14
Incident response plans updated annually by 85% of firms.
15
Third-party audit frequency: quarterly for 60% of enterprises.
16
Children's data policies implemented by 80% of online services.
17
DPIA completion for high-risk processing: 89% compliance.
18
Borderline one-stop-shop usage: 1,200 cases since 2018.
19
96% of EU websites use cookie banners compliant with GDPR.
20
Privacy impact assessments reduced breach incidents by 30%.
21
Global reach: 500 non-EU countries reference GDPR standards.
22
Cost of compliance averaged €1 million for mid-size firms.
Interpretation
Compliance and Adoption Interpretation
While GDPR has made data protection feel as ubiquitous and carefully choreographed as a cookie banner on a European website, the figures reveal a global, multi-billion-euro performance where the lead roles are widely cast, the rehearsals are mandatory, and an impressive number of actors, from SMEs to giants, now know their lines—though the cost of admission remains steep.
03 · Category
Data Breaches26 stats
01
EU-wide, 2,114,827 data breach notifications in 2023.
02
Ireland DPC received 13,477 breach notifications in 2023.
03
France CNIL was notified of 1,800 breaches in 2023.
04
UK's ICO logged 194,986 breach reports in 2023/24.
05
Germany DPAs received 45,824 breach notifications in 2022.
06
Spain AEPD handled 22,000 breach notifications in 2023.
07
Italy Garante received 28,000 breach reports in 2022.
08
Netherlands DPA got 18,500 notifications in 2023.
09
52% of 2023 breaches involved personal data exposure via hacking.
10
Average breach notification time EU-wide: 48 hours compliance 85%.
11
Portugal CNPD reported 3,200 breaches in 2023.
12
Belgium APD had 7,500 breach notifications in 2023.
13
Austria DSB logged 4,200 breaches in 2022.
14
Sweden IMY received 5,100 breach reports in 2023.
15
Finland processed 1,800 breach notifications in 2023.
16
Greece HDPA saw 6,500 breaches in 2023.
17
Denmark Datatilsynet had 3,000 notifications in 2023.
18
Norway Datatilsynet reported 2,800 breaches in 2023.
19
28% of breaches in 2023 concerned health data.
20
Tech sector accounted for 35% of all breach notifications in 2023.
21
In 2023, 15% of breaches led to DPA investigations.
22
Italy video surveillance breaches: 4,500 in 2022.
23
France cyber breaches notified: 900 in 2023.
24
Germany employee-related breaches: 10,000 in 2022.
25
From 2018-2023, over 10 million breaches notified EU-wide.
26
72-hour notification compliance rate: 92% in 2023.
Interpretation
Data Breaches Interpretation
The EU's data protection authorities have become the world's busiest digital plumbers, fielding a deluge of over two million leak reports last year, which proves we're excellent at spotting the flood but still figuring out how to patch the pipes.
More related reading
04 · Category
Fines and Penalties30 stats
01
As of October 2024, the total amount of fines imposed under GDPR exceeds €4.5 billion across 1,728 fines.
02
In 2023, Ireland's Data Protection Commission (DPC) issued fines totaling €1.45 billion, primarily to Big Tech companies.
03
Meta Platforms Ireland Limited received the largest single GDPR fine of €1.2 billion in September 2022 for unlawful data transfers to the US.
04
Luxembourg's CNPD fined Amazon €746 million in July 2021 for personalized advertising violations.
05
The French CNIL imposed a €100 million fine on Clearview AI in October 2022 for illegal scraping of facial images.
06
TikTok was fined €345 million by the Irish DPC in September 2023 for children's data processing failures.
07
Google's French subsidiary received a €150 million fine from CNIL in 2022 for cookie consent violations.
08
The Dutch DPA fined TikTok €750,000 in 2021, later increased, for insufficient age verification.
09
Spain's AEPD fined WhatsApp €225 million in September 2021 for data sharing practices.
10
Italy's Garante fined Google €10 million in 2020 for data processing transparency issues.
11
Belgium's APD fined Facebook €300,000 in 2018 for tracking non-users via the 'like' button.
12
Germany's BfDI fined 1&1 €9.5 million in 2020 for telecom data breaches.
13
The UK ICO fined British Airways £20 million (approx €23.5m) in 2020 for a 2018 data breach.
14
Portugal's CNPD fined hospital €400,000 in 2019 for patient data exposure.
15
Austria's DSB fined ÖBB €20,000 in 2020 for facial recognition misuse.
16
In 2024 Q1, total GDPR fines reached €127 million across 61 decisions.
17
Meta received 12 fines totaling over €2 billion since 2018.
18
CNIL issued 41 fines in 2023 amounting to €72 million.
19
Italy's Garante issued 298 fines in 2022 totaling €6.5 million.
20
Spain's AEPD imposed 1,161 fines in 2023 for €27.2 million.
21
Netherlands DPA fined 34 organizations €6.7 million in 2023.
22
Germany's DPAs issued 1,013 fines in 2022 totaling €156 million.
23
Ireland DPC's fines averaged €118 million per case in 2023.
24
France CNIL's average fine per decision in 2023 was €1.76 million.
25
UK's ICO issued £4.4 million in fines post-Brexit GDPR equivalent in 2023.
26
Norway's Datatilsynet fined Grindr NOK 100 million (€9.5m) in 2021.
27
Denmark's Datatilsynet fined Copenhagen Municipality DKK 1.75 million in 2023.
28
Sweden's IMY fined Aller Media SEK 30 million in 2022.
29
Finland's Tietosuojavaltuutettu fined Värkkäri €15,000 in 2021.
30
Greece's HDPA fined Viva Wallet €175,000 in 2023 for consent issues.
Interpretation
Fines and Penalties Interpretation
The GDPR's staggering fines, primarily drawn from a few Big Tech piñatas, paint a clear picture: privacy regulators are no longer politely knocking but are now wielding a €4.5 billion battering ram to enforce the rules.
05 · Category
Investigations24 stats
01
EU DPAs conducted 1,200 investigations in 2023.
02
Ireland DPC opened 92 cross-border investigations in 2023.
03
France CNIL carried out 450 on-site audits in 2023.
04
UK ICO conducted 1,200 audits and investigations in 2023/24.
05
Germany DPAs performed 2,500 audits in 2022.
06
Spain AEPD initiated 1,800 investigations in 2023.
07
Italy Garante launched 400 formal investigations in 2022.
08
Netherlands DPA started 300 investigations in 2023.
09
65% of investigations in 2023 focused on Big Tech compliance.
10
EDPB coordinated 50 dispute resolutions in 2023.
11
Portugal CNPD conducted 200 audits in 2023.
12
Belgium APD performed 150 investigations in 2023.
13
Austria DSB carried out 100 audits in 2022.
14
Sweden IMY initiated 250 investigations in 2023.
15
Finland conducted 80 formal probes in 2023.
16
Greece HDPA opened 120 investigations in 2023.
17
Denmark Datatilsynet did 90 audits in 2023.
18
Norway Datatilsynet launched 70 investigations in 2023.
19
40% of 2023 investigations resulted in fines.
20
Cross-border investigations: 15% of total in 2023.
21
Italy's Garante audits on CCTV: 200 in 2022.
22
France CNIL health sector probes: 100 in 2023.
23
Germany's DPO audits: 500 in 2022.
24
Average investigation duration: 12 months in 2023.
Interpretation
Investigations Interpretation
While the sheer volume of GDPR audits and investigations across Europe paints a picture of a regulatory blitzkrieg, the fact that 65% of them are aimed at Big Tech suggests regulators are less concerned with the occasional bakery's cookie banner and more focused on taming the digital titans who treat personal data as their personal playground.
Reference
Cite This Report
This report is designed to be cited. We maintain stable URLs and versioned verification dates. Copy the format appropriate for your publication below.
APA
Rachel Svensson. (2026, February 13). GDPR Statistics. Gitnux. https://gitnux.org/gdpr-statistics
MLA
Rachel Svensson. "GDPR Statistics." Gitnux, 13 Feb 2026, https://gitnux.org/gdpr-statistics.
Chicago
Rachel Svensson. 2026. "GDPR Statistics." Gitnux. https://gitnux.org/gdpr-statistics.
Sources & references
43 datasets cited across this report · attribution is report-level