When the EU’s General Data Protection Regulation (GDPR) was enacted in 2018, it set a new bar for data protection and privacy rights, spurring the adoption of heightened data privacy standards around the world. While many companies have been able to adapt to the complexities of the GDPR, few have achieved continuous compliance. And GDPR fines are still hitting companies hard: in 2021, total fines reached EUR 1.1 bio, up EUR 170 mio. more compared to 2020. The fines against Amazon (EUR 746 mio.) and Meta’s WhatsApp (EUR 225) alone accounted for almost 90% of the fines imposed.

In general, it can be observed that he fines especially hit fast-growing and evolving businesses for accidental or careless EU GDPR violations. In a recently published article, Jose Costa explains how creating a privacy-focused culture can minimize such risk.