The Biggest GDPR Fines of 2025
GDPR enforcement continues to accelerate. The Irish DPC fined Meta 1.2 billion euros in 2023 for unlawful data transfers to the US — still the largest GDPR fine ever. In 2024 and 2025, enforcement broadened: the Italian DPA fined Clearview AI 20 million euros, LinkedIn received a 310 million euro fine from the Irish DPC for targeted advertising violations, and Uber was fined 290 million euros by the Dutch DPA for transferring driver data to the US without adequate safeguards. Cumulative GDPR fines have now exceeded 4.2 billion euros since the regulation came into force in 2018.
ICO Enforcement in the UK
The UK's Information Commissioner's Office has taken a different approach to enforcement, favouring reprimands and warnings over large fines for most cases. However, the ICO fined Clearview AI 7.5 million pounds in 2022 and issued several six-figure fines in 2024-2025 for failures in data security and breach notification. The ICO's strategic priorities for 2025-2026 focus on children's data protection, AI and automated decision-making, and public sector data handling. John Edwards, the Information Commissioner, has signalled a shift toward more proactive enforcement and larger penalties for serious violations.
Common Themes in GDPR Enforcement
Analysing the pattern of fines reveals consistent themes. International data transfers remain the highest-risk area — the Meta and Uber fines both related to transfers without adequate safeguards. Inadequate security measures leading to data breaches consistently attract fines: regulators expect encryption at rest and in transit, access controls, monitoring, and timely breach notification. Failure to notify within 72 hours is treated as an aggravating factor. Consent and legitimate interest claims are scrutinised heavily, particularly for marketing and profiling activities.
- International data transfers: highest-risk area for large fines
- Inadequate security measures: consistent basis for enforcement
- Late breach notification: treated as aggravating factor
- Consent failures: especially in marketing and profiling
- Children's data: growing enforcement priority
Practical Lessons for UK Businesses
First, know where your data goes. Map every international data transfer and ensure adequate safeguards (Standard Contractual Clauses, adequacy decisions, or binding corporate rules) are in place. Second, invest in prevention — regulators consistently reduce fines for organisations that demonstrate they had appropriate technical measures in place, even if a breach occurred. Third, build a 72-hour incident response capability. The ICO treats late notification as an aggravating factor that increases penalties. BlackFog's ADX technology prevents data exfiltration — the root cause of most reportable breaches. If data never leaves your network, there is nothing to report.