Cumulative fines levied under the GDPR passed the £5.3bn mark this month – some 8 years after the EU’s landmark regulation came into force. Over this time, Ireland has come to top the table with the highest value of fines to date, at over £3.4bn, whilst Spain has seen the highest volume of fines, at 958.

Tiernan Connolly, managing director in Kroll’s cyber and data resilience team says the 8th anniversary of the GDPR may go unnoticed by some companies, but certainly not by regulators.

“Although GDPR might be considered old news in 2025, the ECB has committed to renewing its focus on areas where persistent sluggishness is seen with compliance to existing regulations (eg. BCBS239, itself now a ten-year old piece of regulation) in the financial industry. This shows that older requirements will not be forgotten or fly under the radar of regulators," he commented.

"While compliance teams may now be more concerned with adherence to newer regulations such as NIS2, DORA and the EU AI Act and how they apply to internal data governance, protection and management, the GDPR’s landmark 4% fines loom in the background for any business that forgets the grandfather of data privacy regulation.”


In numbers: GDPR turns 8 (Source Kroll and CMS Law)

Since coming into force, 2,319 individual GDPR fines have been levied, reaching a cumulative value of £5.3bn as at 12th May 2025.

The volume of fines rose to a peak of 68 in December 2022, but have been declining since. Q1 2025 saw only 32 fines levied, compared with 77 in Q1 2024 and 128 in 2023. This is the second-lowest Q1 for fines since the GDPR came into force, with only Q1 2019 lower (23 fines).

The country that has seen the highest value of fines to date is Ireland, with £3.47bn levied through 31 fines. This was notably above the second-highest country for fine value, Luxembourg, where £641m was raised by 32 fines.

---