The Irish Data Protection Commission (DPC) continues to dominate European GDPR enforcement, issuing €4.04 billion in fines since May 2018, according to the latest Data Breach Survey from law firm DLA Piper. Ireland’s total is almost four times higher than second-placed France, cementing the DPC’s position as Europe’s largest data regulator by a wide margin.
The DPC issued the largest fine of 2025, a €530 million penalty against TikTok over the transfer of European users’ personal data to China. TikTok is currently appealing the ruling. In 2023, the DPC also imposed a €1.2 billion fine against Meta, which remains the largest GDPR fine ever issued. The survey shows that eight of the top 10 GDPR fines of all time have been handed down by the Irish regulator.
Despite the high totals, the DPC has collected only a fraction of its fines. Of the €4.04 billion imposed, just €20 million has been paid, largely due to ongoing legal challenges.
Across Europe, GDPR fines in 2025 totalled approximately €1.2 billion, similar to 2024 levels, with Ireland and France accounting for more than €1 billion of that sum. Cumulative GDPR fines across the continent now stand at €7.1 billion since the regulation came into force in 2018. France has overtaken Luxembourg to become the second-largest enforcer overall and is now the only other European country, besides Ireland, to have issued more than €1 billion in fines since 2018.
The survey also highlights a sharp increase in personal data breach notifications across Europe, with daily alerts rising 22% to an average of 443 per day—the first time notifications have exceeded 400 since GDPR was introduced. Ireland bucked this trend, recording only a 3% rise in breach notifications year-on-year.
John Magee, partner and global co-chair of DLA Piper’s Data, Privacy and Cybersecurity Group, said regulators are increasingly scrutinising a wider range of sectors beyond technology and social media, including financial services, telecommunications, and utilities. “While the total value of fines held steady, regulators remain willing to impose substantial monetary penalties, despite ongoing criticism from outside the EU,” he said.
Mr. Magee added, “Ireland’s Data Protection Commission remains Europe’s pre-eminent enforcer by some distance. The large uptick in personal data breach notifications across Europe is reflective of an increasingly risky cybersecurity threat landscape fuelled by heightened geopolitical tensions and high-profile cyberattacks.”
The survey underscores Ireland’s central role in GDPR enforcement, with the DPC continuing to set the standard for data protection across the European Union while maintaining its focus on large technology firms and expanding oversight to other sectors.
