Only measuring GDPR fines overlooks broader enforcement activity trends

In a blog article examining European enforcement trends, Francisco Pérez Bes, Deputy of the Spanish data protection authority (AEPD), noted that the European Data Protection Board (EDPB) 2025 annual report shows total aggregate fines for EU General Data Protection Regulation (GDPR) violations exceeding €1.14 billion.

Pérez Bes argues that the figures reveal a range of enforcement activity across Europe. Slovakia recorded the highest volume of sanctions with 542 penalties, followed closely by Germany with 499, and Spain with 326. Conversely, Ireland issued the highest financial penalties, totalling over €530 million across just four fines, while France accrued over €486 million from 84 sanctions.

In Spain, data protection complaints reached a record high of 30,931, up 64% year over year. This surge led to a rise in fine-yielding proceedings and a total financial penalty collection exceeding €48 million.

Pérez Bes explained that these variations reflect structural differences in supervisory models rather than differences in the severity of penalties, meaning statistical rankings require cautious interpretation. As DPAs turn more towards preventive and corrective measures, such as warnings, reprimands, and processing bans, monetary penalties are increasingly seen as a last resort. As such, Pérez Bes concludes that a lack of comparable metrics makes it difficult to measure the positive impact of these non-punitive methods.

(Translate to English: Google Chrome, Mozilla Firefox, Microsoft Edge, or Apple Safari)

Training Announcement: Freevacy offers a range of independent data protection qualifications from IAPP and BCS. Our certified courses are available at foundation and practitioner levels and cover multiple legal jurisdictions, data protection operations management, and the implementation of complex privacy solutions in technical environments. Find out more.