Why GDPR fines keep hitting companies that thought they were compliant
TL;DR
€5.88 billion in GDPR fines have been issued since 2018. The majority went to organizations that had privacy policies, DPOs, and compliance programs in place.
The top fine categories are not cookie banners — they are insufficient legal basis for processing, Article 5 principle violations, and inadequate technical and organisational measures under Article 32.
A GDPR compliance gap analysis is not a checklist exercise. It is a control-by-control audit of what you actually do versus what the regulation specifically requires.
The enforcement gap is widening: regulators now have technical expertise, coordinated cross-border investigation frameworks, and — for the first time — are pursuing personal liability for directors.
The companies most at risk in 2025 are not the ones that ignored GDPR. They are the ones that completed the initial implementation in 2018 and have not touched it since.
The compliance theatre problem
In May 2018, tens of thousands of companies scrambled to become GDPR compliant before the enforcement deadline. They hired consultants, updated privacy policies, installed cookie banners, appointed Data Protection Officers, and sent mass emails asking users to re-confirm consent. Then they filed it away and moved on.
Seven years later, those same companies are receiving fines.
Not because they ignored GDPR. Because they completed the 2018 implementation and treated it as a project with an end date rather than an ongoing operational requirement. The regulation did not change. Their data processing did — new SaaS tools, new marketing platforms, new analytics vendors, new product features — and nobody mapped those changes back to their legal basis, their Article 30 records of processing activities, or their data subject rights procedures.
This is the GDPR compliance gap. It is not a knowledge problem. Most organizations know GDPR exists and roughly what it requires. It is an operational problem: the gap between what your documentation says you do with personal data and what your systems actually do with it today.
The myth that a privacy policy means you are compliant
The myth
If you have a privacy policy, a cookie consent banner, and a Data Protection Officer, you are GDPR compliant. The regulation is primarily about transparency and consent, so as long as you tell users what you are doing and ask for consent where required, you have covered the major risks.
The reality
Transparency and consent are two of GDPR's requirements. The regulation also mandates lawful legal basis for every processing activity, data minimisation, purpose limitation, storage limitation, accuracy, integrity and confidentiality, accountability, and specific technical and organisational security measures. Cookie banners address a narrow slice of consent requirements. They do not touch Article 32 security obligations, Article 28 processor agreements, Article 30 processing records, Article 17 erasure rights, or the six lawful bases for processing under Article 6. LinkedIn was fined €310 million in October 2024. They had a privacy policy. They had a DPO. They had a consent mechanism. The fine was for using behavioural analysis and targeted advertising without a valid legal basis — a fundamental Article 6 failure that no cookie banner addresses.
The CMS GDPR Enforcement Tracker data through March 2025 shows that insufficient legal basis and Article 5 principle violations together account for the largest share of significant fines. Insufficient technical and organisational measures under Article 32 is the third most common category. Cookie and consent violations, despite their public visibility, represent a much smaller proportion of total fine value. The gap between what companies think GDPR requires and what regulators actually enforce is the direct cause of this pattern.
The 2018 compliance wave was led by legal and marketing teams whose primary concern was visible, auditable actions: publish a policy, deploy a banner, send a consent email. These actions are documentable and defensible in the short term. The deeper operational requirements — mapping every processing activity to a lawful basis, maintaining accurate Article 30 records as systems change, implementing and evidencing Article 32 security measures — are engineering and operations problems that legal teams are not equipped to own and that senior leadership rarely prioritises after the initial compliance sprint.
What seven years of GDPR enforcement actually shows
€5.88B
Total GDPR fines issued since May 2018, across 2,245 recorded enforcement actions. More than 60% of that total was imposed after January 2023 — enforcement is accelerating, not stabilising.
CMS GDPR Enforcement Tracker Report, March 2025 / DLA Piper GDPR Survey 2025
363/day
average data breach notifications received by EU DPAs in 2024 (DLA Piper)
€310M
LinkedIn fine, October 2024 — invalid legal basis for behavioural advertising
€290M
Uber fine, August 2024 — unlawful data transfers to the US
4+ years
time from Meta investigation start to €1.2B fine — regulators are patient
What we find when we run GDPR gap analysis on mid-market companies
Assessment base: Gap analysis engagements across SaaS, fintech, and professional services organizations with 20–500 employees, primarily EU-based or EU-data-processing
78% had outdated Article 30 records
Records of Processing Activities documented at implementation in 2018 or 2019 that had never been updated to reflect new SaaS tools, new product features, or changes in data flows. In most cases, the actual processing footprint had grown by 40–60% beyond what the records showed.
61% were processing on the wrong legal basis
The most common error: using consent as the legal basis for processing activities where legitimate interest or contract performance would be more appropriate and more defensible — then structuring consent mechanisms that did not meet GDPR's standard for freely given, specific, informed, and unambiguous consent. This creates a double failure: invalid consent and no fallback basis.
89% had at least one Article 28 gap
Data processing agreements with sub-processors were either missing, outdated, or signed with vendors who had since changed their data processing practices. In several cases, companies had active agreements with vendors that had been acquired and moved data processing to different jurisdictions without notifying customers.
43% could not demonstrate a completed DPIA
Data Protection Impact Assessments were either never conducted for high-risk processing activities, conducted once and never reviewed, or conducted by the same team responsible for the processing — which defeats the purpose of the assessment and would not survive regulatory scrutiny.
Counterintuitive finding
The companies with the largest compliance gaps were not the smallest or least resourced. They were mid-market organizations with dedicated compliance functions. The compliance team's existence created a false sense of coverage: leadership assumed that having a DPO meant being compliant, without understanding that a DPO's role is advisory and oversight — not operational implementation.
The 2018 implementation is now your biggest liability
Common belief
Organizations that completed a thorough GDPR implementation in 2018 are in a better compliance position than those that are implementing now. The early movers have had more time to embed compliance into their operations.
What we found
Early movers are frequently in a worse position than organizations implementing today. The 2018 implementation captured a snapshot of data processing as it existed then. Every SaaS tool added since, every new marketing platform integrated, every product feature that collects new data types has expanded the processing footprint beyond what the original implementation covered. Organizations implementing now are mapping current reality. Organizations who implemented in 2018 are defending a document that describes a company that no longer exists.
The specific failure pattern: a company completes GDPR implementation in 2018. They document 12 processing activities, map each to a legal basis, sign processor agreements, update their privacy policy. Over the next six years they add Salesforce, HubSpot, Intercom, Mixpanel, a new analytics platform, a customer data platform, and four different advertising integrations. Each integration passes data. None of it gets added to the Article 30 records. The legal basis for the new processing is never formally assessed. The privacy policy still describes the 2018 version of the product.
When a DPA investigates following a complaint or breach, they do not audit the 2018 implementation. They audit what is actually happening today. The gap between the two is where the fine lives.
What organizations say before they discover the gap
We went through a full GDPR implementation with an external consultancy. We have all the documentation — privacy policy, cookie policy, DPA template, Article 30 records, the lot. We are covered.
Underlying gap:Documentation produced at a point in time is not evidence of ongoing compliance. GDPR is an operational regulation — it requires that your documentation accurately reflects current processing at all times. A six-year-old Article 30 record from a consultancy engagement is a liability, not an asset, if it no longer reflects what you actually do.
We have a Data Protection Officer. That is specifically what they are there for. If there was a compliance issue, they would have flagged it.
Underlying gap:A DPO's mandate under Article 37-39 is to inform, advise, and monitor — not to implement controls or maintain records. Many DPOs operate without the budget, access, or technical knowledge to identify processing activities that engineering or marketing teams are running without consulting them. The DPO knows what they have been told about. They do not automatically know about the Segment integration your growth team added last quarter.
We have never had a complaint or a breach. If something was wrong, we would have heard about it by now.
Underlying gap:DPA investigations are triggered by complaints, breach notifications, and proactive enforcement sweeps — not by the presence of violations. The Dutch DPA investigation into Clearview AI ran for years before the fine. The Meta investigation that produced the €1.2 billion fine took over four years. The absence of enforcement action is not evidence of compliance. It is evidence that you have not yet been the subject of a complaint or selected for a sweep.
What a GDPR compliance gap analysis actually examines
A genuine GDPR gap analysis is not a questionnaire with yes/no answers. It is a structured audit that maps your actual processing activities against specific regulatory requirements, Article by Article, and produces a gap inventory with defined evidence standards for each remediation item.
The six areas where gaps most consistently appear:
Article 5 — Data processing principles. Do your actual processing activities comply with purpose limitation (data used only for the purpose it was collected), data minimisation (only collecting what is necessary), and storage limitation (data deleted when no longer needed)? Most organizations fail storage limitation silently — data accumulates in databases, backups, and analytics platforms indefinitely because nobody owns the deletion obligation.
Article 6 — Legal basis. Every processing activity requires one of six lawful bases: consent, contract, legal obligation, vital interests, public task, or legitimate interest. The legal basis must be documented, appropriate for the specific processing, and — if consent — must meet the standard of being freely given, specific, informed, and unambiguous. Using the wrong basis, or relying on consent where it cannot genuinely be withdrawn without consequence, is one of the most common enforcement triggers.
Article 28 — Processor agreements. Every vendor who processes personal data on your behalf requires a Data Processing Agreement that meets GDPR's specific requirements. This includes sub-processors that your primary vendors use. If your CRM vendor uses an AI provider to process customer data, you need a chain of agreements covering that relationship.
Article 30 — Records of processing activities. A living document that accurately reflects every processing activity, its purpose, legal basis, data categories, retention period, and recipients. This is the document regulators request first in an investigation.
Article 32 — Technical and organisational measures. Encryption, access controls, pseudonymisation, backup procedures, incident response, staff training — the security measures must be appropriate to the risk, documented, and evidenced as actually implemented. Not described in a policy. Implemented and provable.
Article 35 — Data Protection Impact Assessments. Required for high-risk processing activities. The assessment must be conducted before the processing begins, involve the DPO, and produce a documented risk assessment with mitigation measures.
Example
A 150-person SaaS company running a GDPR gap analysis discovers the following in Article 6 alone: their onboarding flow collects consent for marketing emails, but the consent checkbox is pre-ticked (invalid under GDPR). Their product analytics use Mixpanel under a legitimate interest basis, but no Legitimate Interest Assessment has been documented. Their customer support tool Intercom transfers conversation data to the US under Standard Contractual Clauses that were last reviewed in 2020 and do not reflect the post-Schrems II transfer impact assessment requirement. Three legal basis failures in one product, none of which would appear in a cookie banner audit.
The Secure Controls Framework maps GDPR Article 32 to SCF controls SCF-IAC-01 through SCF-IAC-09 (access control), SCF-CRY-01 through SCF-CRY-04 (encryption), SCF-OPS-01 (operational security), and SCF-IRO-01 through SCF-IRO-04 (incident response). This mapping means that organizations using an SCF-based gap analysis can simultaneously assess their GDPR Article 32 posture and their ISO 27001 Annex A controls using the same evidence set — eliminating duplicate assessment work across frameworks.
The four GDPR gaps that organisations consistently miss
Sub-processor chains are invisible
Companies sign a Data Processing Agreement with their primary vendors and consider the Article 28 obligation satisfied. What they do not track is the sub-processor relationships those vendors maintain. Your CRM vendor uses an AI provider. Your analytics platform uses a cloud infrastructure provider in a different jurisdiction. Your support tool uses a translation service. Each of these is a sub-processing relationship that flows from your original data collection — and each requires coverage in your compliance architecture.
When a DPA investigates a data subject complaint about how their data was handled, they follow the data. If it flowed to a sub-processor without a valid DPA chain, the controller — you, not the vendor — is liable. The vendor's terms of service do not protect you.
Retention policies exist but deletion does not happen
Most organizations document a retention policy as part of their GDPR implementation. The policy says customer data is deleted after three years of inactivity. Nobody builds the deletion mechanism. The policy document satisfies the auditor's checklist; the database accumulates seven years of customer records that should have been deleted four years ago.
Storage limitation is an Article 5(1)(e) obligation. Retaining data beyond the documented retention period is a violation regardless of whether the data was ever misused. It also dramatically expands the blast radius of any future breach — you are liable for data you should not have had.
International transfers are assessed once and forgotten
Post-Schrems II, international data transfers to non-adequate countries require a Transfer Impact Assessment in addition to Standard Contractual Clauses. Companies conducted these assessments in 2021 when the requirement crystallised. Since then, the legal and political landscape has shifted — the EU-US Data Privacy Framework was adopted in 2023, creating a new transfer mechanism, but also creating new compliance obligations for companies relying on it.
Uber's €290 million fine in August 2024 was specifically for transferring European driver data to the US without adequate safeguards. The transfers happened over a period when SCCs existed but the specific safeguards required by post-Schrems II guidance were not in place. A transfer mechanism that was adequate in 2019 may not be adequate today.
Data subject rights requests have no operational process
Most organizations have an email address for data subject requests and a commitment to respond within 30 days. What they lack is an operational process: who receives the request, how they verify the identity of the requester, how they locate all data held across multiple systems, how they document the response, and how they handle requests that touch data held by processors.
Failure to respond to a data subject access request within one month is a direct violation. More significantly, the inability to locate all data held about an individual — because it is spread across a CRM, a support tool, an analytics platform, an email marketing tool, and a data warehouse — means that erasure requests cannot be honoured completely. Partial erasure is a violation of Article 17.
How to run a GDPR gap analysis that survives regulatory scrutiny
- Step 1
Data mapping before documentation. Before touching any compliance document, map what your systems actually do with personal data today. Every integration, every API call that sends user data to a third party, every internal database that stores personal information. Use your infrastructure — talk to engineering, pull your data flow diagrams, audit your SaaS subscriptions. The Article 30 record you produce should reflect this map, not the other way around.
Output:A current-state data flow diagram showing every system, every data type, every transfer destination, and every access point.
Purpose:Regulators audit what is real, not what is documented. A gap analysis built on documented assumptions rather than actual system behaviour will miss the gaps that matter.
- Step 2
Legal basis assessment for every processing activity. For each processing activity identified in the data map, document the legal basis being relied upon and test it. For consent: is it freely given, specific, informed, unambiguous, and withdrawable without consequence? For legitimate interest: has a three-part test been documented — purpose test, necessity test, balancing test? For contract: is the processing genuinely necessary for contract performance or just convenient?
Output:A legal basis register mapping each processing activity to its Article 6 basis, with documented assessment of whether that basis is defensible.
Purpose:This is the single highest-value output of a GDPR gap analysis. Insufficient legal basis is the most common cause of significant fines. Getting this right eliminates the largest enforcement risk.
- Step 3
Article 28 processor audit. List every vendor who touches personal data. For each, verify: is there a current DPA in place that meets GDPR requirements? Does the DPA cover the sub-processors that vendor uses? Has there been any change in the vendor's processing practices, ownership, or data locations since the agreement was signed? Flag any vendor with EU Standard Contractual Clauses that have not been reviewed since the 2021 SCCs update.
Output:A processor register with DPA status, sub-processor list, transfer mechanism, and last review date for each vendor.
Purpose:A missing or outdated processor agreement creates direct Article 28 liability. It also voids the ability to rely on the vendor's sub-processors as legitimate downstream recipients.
- Step 4
Article 32 technical measures evidence audit. For each technical and organisational measure documented in your GDPR implementation, collect evidence that it is actually implemented. A policy that says data at rest is encrypted needs to be backed by a configuration export. A policy that says access is role-based needs an IAM audit. A policy that says staff receive annual training needs attendance records. Document what is evidenced and what is only stated.
Output:An Article 32 evidence register: for each control, the policy claim, the supporting evidence, and the gap where evidence is missing.
Purpose:In an enforcement investigation, regulators do not accept policy documents as evidence of implementation. They ask for configuration exports, audit logs, and training records. If you cannot produce them, the control is considered unimplemented regardless of what your policy says.
- Step 5
Gap prioritisation and remediation roadmap. Rank identified gaps by regulatory risk: Article 6 legal basis failures and Article 5 principle violations carry the highest fine potential and should be remediated first. Article 32 technical gaps that relate to security of processing come next. Article 28 processor gaps, retention failures, and DPIA gaps follow. Assign each gap an owner, a remediation action, a deadline, and an evidence standard that will demonstrate completion.
Output:A prioritised remediation roadmap with owners, deadlines, and evidence requirements. This document also serves as your accountability record under Article 5(2).
Purpose:Regulators take documented remediation activity into account when calculating fines. A company that can demonstrate it identified a gap and remediated it proactively is in a materially better position than one where the gap is discovered during investigation.
Where GDPR enforcement is going — three predictions
Director personal liability will become a standard enforcement tool in at least three EU member states by 2027.
The Dutch DPA's 2024 investigation into whether Clearview AI directors can be held personally liable is not an isolated experiment. Several EU member states already have national provisions enabling this. The pattern with GDPR enforcement has been that novel enforcement tools introduced by one DPA are adopted by others within 18 to 36 months. Personal liability changes the incentive structure at board level in a way that corporate fines do not — a €30 million fine is a cost of doing business for a well-capitalised company; personal liability is not.
Confidence: HighWatch for DPA enforcement decisions that name individual directors or C-suite executives alongside corporate entities. The first upheld personal liability decision outside the Netherlands will be the signal that this is becoming normalised.AI-generated compliance documentation will trigger a new category of GDPR enforcement action by 2026.
As organizations use LLMs to generate privacy policies, DPIAs, legitimate interest assessments, and Article 30 records, regulators will encounter documentation that is internally consistent and formally correct but disconnected from the organization's actual processing activities. A DPIA generated by an AI that has not been given accurate information about what the system actually does is not a DPIA — it is a formatted document. Regulators who ask follow-up questions will quickly identify the disconnect. The enforcement category will likely be framed as failure to conduct a genuine assessment rather than specifically targeting AI use, but the root cause will be AI-generated documentation used as a compliance substitute.
Confidence: Medium-highWatch for enforcement decisions that cite the inadequacy of documented assessments despite their formal completeness — language like 'the submitted DPIA did not reflect the actual processing activities' appearing in DPA decisions.The next major enforcement wave will target mid-market B2B SaaS companies, not consumer platforms.
The largest GDPR fines to date have gone to consumer-facing platforms with millions of users — Meta, Google, LinkedIn, TikTok, Uber. This is partly because consumer complaints drive investigations and partly because Big Tech has been the political priority. The EDPB's Coordinated Enforcement Framework is now turning attention to sector-specific sweeps. B2B SaaS companies process significant volumes of personal data — employee data, customer contact data, usage analytics — often with weaker compliance infrastructure than consumer platforms and far less regulatory scrutiny to date. They have had seven years to build compliance programs. Many have not. The conditions for a targeted enforcement sweep are in place.
Confidence: MediumWatch for EDPB Coordinated Enforcement Framework announcements targeting enterprise software, HR technology, or B2B data platforms as the designated sector for an annual sweep.
Pro tip
The fastest way to find your highest-risk gap
Pull your Article 30 record of processing activities and your current SaaS subscription list side by side. Count the tools in column two that do not appear in column one. Every tool missing from the Article 30 record is an undocumented processing activity. Every undocumented processing activity is an unassessed legal basis, a missing processor agreement, and an unknown transfer destination.
In most mid-market companies this exercise takes 20 minutes and reveals between 8 and 25 undocumented processing activities. Those gaps represent your actual GDPR risk — not the cookie banner configuration you spent three days optimising.
This comparison is the first thing we do in every GDPR gap analysis engagement. The delta between the Article 30 record and the actual tool stack tells you more about an organization's compliance posture in five minutes than a questionnaire tells you in two hours. The organizations most resistant to doing this exercise are usually the ones with the largest deltas.
Signals shaping GDPR enforcement in the next 24 months
EDPB Coordinated Enforcement Framework sweeps becoming annual events with pre-announced target sectors
Watch by: 2025-2026
The EDPB's CEF has run coordinated sweeps on cookie consent, data subject rights, and data transfers. Each sweep produces enforcement actions across multiple member states simultaneously. The pre-announcement of target sectors gives organizations a warning window — but also means that being in the target sector during a sweep year without an updated compliance posture is a material risk. Watch the EDPB's annual work programme for sector announcements.
AI Act Article 10 data governance requirements creating new GDPR intersection obligations
Watch by: 2025-2027
The EU AI Act, in force since August 2024, creates data governance requirements for AI systems that intersect directly with GDPR obligations. Training data, bias testing, and automated decision-making documentation requirements overlap with GDPR Article 22 and Article 35. Organizations deploying AI tools — including internally built ML models and third-party AI integrations — face a dual compliance obligation that neither their GDPR program nor their AI governance program currently covers completely.
Consent or pay models under sustained regulatory attack
Watch by: 2025-2026
Meta's subscription model offering an ad-free experience in exchange for payment — as an alternative to consenting to data processing — is under active regulatory review across multiple EU member states. The question of whether paywalled consent is genuinely freely given under Article 7 will be resolved through enforcement decisions in 2025-2026. The outcome will affect every company that uses consent as the legal basis for advertising-related processing and has considered a similar model.
Cyber insurance underwriters requiring documented GDPR compliance as a policy condition
Watch by: 2026-2027
Cyber insurance policies increasingly require evidence of GDPR compliance posture as a condition of coverage, not just as a risk factor in pricing. The logic is straightforward: a GDPR enforcement action following a breach creates a regulatory liability in addition to the breach costs, increasing insurer exposure. As the insurance market matures, expect documented gap analysis results, remediation records, and evidence of Article 32 technical measures to become standard policy requirements.
Why the 2018 implementation model was always going to fail
When GDPR came into force, the compliance industry responded with a product: the implementation project. Consultancies offered fixed-price engagements with defined deliverables — a privacy policy, a cookie consent solution, a set of templates, an Article 30 record. Organizations bought the product, received the deliverables, and considered the obligation discharged.
The problem is that GDPR is not a project. It is an operational requirement that applies continuously to a processing environment that changes continuously. The implementation project model was designed to produce documentation, not to embed compliance into how an organization actually operates. It was commercially convenient for everyone: the consultancy had a deliverable to sell, the organization had a box to tick, and the DPAs were too busy establishing their enforcement machinery in 2018 and 2019 to audit the quality of implementations.
That window has closed. Regulators now have the expertise, the coordination frameworks, and the political mandate to audit what organizations actually do with personal data — not just what their policies say. The organizations now receiving fines are, in many cases, the ones that bought the 2018 implementation product and trusted it. They were not negligent. They were sold an incomplete solution to a continuous problem.
The correct model is not a project. It is a maintenance program: regular audits of processing activities against documentation, systematic reviews of legal basis as processing changes, ongoing vendor agreement management, and evidence-based Article 32 compliance. This is more expensive and less satisfying than a one-time implementation. It is also the only approach that works.
, Geert Warmenbol, Founder — Vulnox
The gap is not between knowing and not knowing
Every organization of any scale knows GDPR exists. Most know the broad outlines of what it requires. The gap is not knowledge — it is the distance between what their compliance documentation describes and what their systems actually do today.
That gap widens every time a new SaaS tool is added without an Article 28 assessment. Every time a new product feature collects a new data type without a legal basis review. Every time a retention policy is documented but the deletion mechanism is never built. Every time an Article 30 record is filed and not updated for three years.
The companies that will navigate the next phase of GDPR enforcement are not the ones with the most comprehensive 2018 implementations. They are the ones that treat compliance as an operational discipline rather than a documentation exercise — mapping what they actually do, auditing it against what the regulation requires, and maintaining the evidence to demonstrate both.
The enforcement trend is clear: more fines, larger fines, faster investigations, broader sector coverage, and — for the first time — personal liability for the people who signed off on the processing. The question is not whether your organization has a GDPR compliance gap. The question is whether you know where it is before a regulator finds it.
Further Reading
compliance framework automation
How We Mapped 258 Compliance Frameworks to a Single Automated Audit SystemPDPA Compliance Guide
PDPA Compliance Guide: Security Control Gaps for MalaysiaSerbia 87 2018
Serbia 87 2018 Compliance Guide: Gap Analysis for ProfessionalsVulnox Service
digital footprint analysisEMEA compliance frameworks: the complete guide to GDPR, NIS2, DORA, and 40+ regional mandates
why GDPR fines keep hitting companies that thought they were compliantGDPR Enforcement Tracker
GDPR enforcement trackerEuropean Data Protection Board
European Data Protection Board guidelinesGDPR Full Text
GDPR legislative text
Frequently Asked Questions
Why do companies get GDPR fines even when they have a privacy policy?
A privacy policy documents what you say you do with data. Regulators fine you for what you actually do. The gap between the two — undocumented processing activities, incorrect legal bases, inadequate security measures — is where the vast majority of enforcement actions originate. Having a policy is the starting line, not the finish line.
What is the most common reason for GDPR fines?
According to the CMS GDPR Enforcement Tracker, the most common fine categories are insufficient legal basis for data processing, non-compliance with general data processing principles under Article 5, and insufficient technical and organisational measures under Article 32. Cookie banners and consent notices are a small fraction of total enforcement activity despite receiving disproportionate public attention.
How does a GDPR gap analysis work?
A GDPR gap analysis maps your current data processing activities, security controls, and governance procedures against the specific requirements of the regulation — Article by Article, not as a general checklist. Each gap produces a specific remediation item with a defined evidence standard. The output is a prioritised remediation roadmap, not a pass/fail score.
Can executives be held personally liable for GDPR violations?
Yes, and this is an active area of enforcement development. The Dutch Data Protection Authority announced in 2024 it is investigating whether to hold Clearview AI directors personally liable following a €30.5 million fine against the company. Several EU member states already have national provisions allowing personal liability. The trend toward executive accountability is accelerating.
What is the difference between GDPR Article 5 and Article 32?
Article 5 sets the core data processing principles: lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, and integrity. Article 32 requires implementation of appropriate technical and organisational security measures. Violations of Article 5 tend to attract larger fines because they represent fundamental failures of the data protection framework, not just security failures.
How long does a GDPR investigation take before a fine is issued?
DPA investigations typically take 12 to 36 months from complaint or incident to final decision. The Meta fine of €1.2 billion took over four years from the initial investigation to enforcement. Smaller national investigations move faster, often 6 to 18 months. This lag creates a false sense of safety — the absence of a fine does not mean the absence of a problem that regulators will eventually find.
Does ISO 27001 certification protect you from GDPR fines?
Not directly. ISO 27001 demonstrates that you have an information security management system in place, which satisfies part of Article 32's technical and organisational measures requirement. But GDPR covers legal basis, data subject rights, data minimisation, processing transparency, and international transfers — none of which ISO 27001 addresses. Certification reduces risk in one area while leaving others fully exposed.
Related Articles
GovRAMP Moderate authorization: why the Significant Change Request process catches providers off guard
GovRAMP Moderate is the first tier where you need a government sponsor, annual 3PAO reassessment, and a Significant Change Request process that can pause normal product releases for months. Most providers who stall post-authorization were not prepared for what maintaining Moderate status actually costs operationally.
GovRAMP Low+ authorization: the impact level that punishes providers who get the CUI boundary wrong
GovRAMP Low+ is where providers handling limited Controlled Unclassified Information land — or discover they should not be there. The defining failure is not a missing control. It is a CUI boundary that was drawn before anyone asked what data the government actually sends through the system.
GovRAMP High authorization: why FIPS-validated crypto and personnel security controls catch providers off guard
GovRAMP High is where cloud providers discover that having strong encryption is not the same as having FIPS 140-2 validated encryption — and that distinction alone has derailed authorizations from vendors who passed every other control family. The architectural constraints at High are qualitatively different from every lower tier.
Ready to Secure Your Digital Assets?
Get a comprehensive vulnerability assessment for your website today.