Europe’s privacy regulators continued to levy penalties at scale in 2025, with total GDPR fines reaching approximately €1.2bn, broadly matching the prior year’s pace. That headline figure comes from the latest edition of DLA Piper’s annual GDPR Fines and Data Breach Survey, which tracks enforcement across European supervisory authorities and provides a year-on-year view of how the regime is evolving.
The significance of the 2025 total is not simply the number itself, but what it says about enforcement maturity. Seven years after the GDPR became applicable, regulators are no longer “finding their feet”. Investigations, cross-border cooperation and procedural discipline have become routine. The survey frames this as a sustained, high level of enforcement activity — suggesting that organisations should treat major regulatory scrutiny as a normal operational risk rather than a low-probability event.
While the report is a survey, it reflects a broader reality: large fines are now frequently associated with systemic issues — international transfers, transparency failures, security weaknesses and governance gaps. This is particularly relevant for technology-driven organisations operating at scale, where a single design decision can shape the processing of millions of individuals and multiply impact. It also matters for SMEs: enforcement activity and breach reporting volumes create a “compliance gravity” that reaches supply chains, vendors, and smaller entities that process data on behalf of larger controllers.
For teams tasked with managing privacy risk, the annual enforcement picture is also a planning input. It supports budget conversations (privacy engineering, vendor oversight, incident response) and helps prioritise the controls that repeatedly appear in enforcement narratives: strong records of decision-making, defensible transfer mechanisms, and a credible security posture with evidence.
Acompli perspective: The most practical lesson from the 2025 enforcement totals is that governance evidence is as important as policy. When regulators ask “why did you do this?” they expect a traceable answer: DPIA outcomes, transfer assessments, vendor due diligence, change control, and accountability records. Building these artefacts as living, structured outputs — rather than one-off documents — reduces compliance cost over time and improves audit readiness.