GDPR across Europe: the failures behind the biggest fines

Across the EEA, the largest GDPR fines rarely come from exotic technology. They come from a handful of failures that repeat across sectors and borders.

What actually gets fined?

Not the tools, but the fundamentals: a weak or missing legal basis, poor transparency, data kept longer than needed, employee monitoring beyond the law, and cross-border transfers without a valid mechanism. Our enforcement reading shows the same pattern by sector.

What makes processing defensible?

There is no universal checklist, but there are criteria a regulated organisation should be able to evidence on demand:

• A documented legal basis for each purpose, decided before processing starts.
• A DPIA for high-risk or large-scale processing, completed and dated.
• Records of processing and retention that are enforced by the system, not by good intentions.
• A transfer mechanism (SCC and, where relevant, a transfer impact assessment) for data leaving the EEA.
• Boundaries on monitoring that respect Art. 88 and local labour rules.

Why templates fail

A policy copied from another company answers to no one’s actual processing. Supervisory authorities do not fine the absence of a document; they fine the absence of the reasoning behind it. That reasoning is context-specific, and it has to exist before, not after, the first complaint.

This is where an in-house certified data protection auditor changes the outcome: the obligations are built into the design, across every country where you operate.