EDPB's 2026 Sweep Targets GDPR Transparency Failures, Not the Fines You'd Expect

Most GDPR enforcement coverage points at the biggest checks regulators have cut. That framing misses the mechanic that keeps showing up underneath a huge share of those fines: whether a privacy policy actually told people, in plain and complete terms, what was happening to their data. Documented GDPR fines now total more than EUR 7.1 billion across 2,245 cases since 2018, and a striking share of that enforcement traces back to a narrow set of provisions, Articles 12, 13, and 14, the ones that govern how clearly and completely a business has to disclose its data practices.

Article 12-14 transparency failures already account for 22% of all GDPR fines on record. That is not a rounding error inside a broader enforcement trend. It is the single largest identifiable category of what regulators are actually citing when they act, and it points directly at the wording of the document a business publishes to describe its own data processing, not at some deeper technical failure in how that data is secured.

Source: Kiteworks, GDPR Enforcement Trends: EUR 7.1 Billion in Fines and Rising, captured August 2026.

What Articles 12, 13, and 14 actually require

Article 5(1)(a) sets out the underlying principle: personal data has to be processed lawfully, fairly, and transparently. Articles 12 through 14 are where that principle turns into specific, checkable obligations. Article 12 sets the standard for how information has to be delivered, in a concise, transparent, intelligible, and easily accessible form, using clear and plain language. Article 13 lists what has to be disclosed when data is collected directly from a person, including the identity of the controller, the purpose of processing, the legal basis relied on, and how long the data will be kept. Article 14 covers the same ground for data collected about someone from another source.

None of that is about encryption, access controls, or breach response. It is about whether the document a visitor can read on a website actually says, in language an ordinary reader can follow, what is being collected and why. A privacy policy that lists purposes in vague, catch-all phrasing, that buries retention periods, or that never states a legal basis for processing at all is not a stylistic weakness. Under Articles 12 through 14, it is the specific thing regulators are checking for.

Figure: Article 12-14 transparency failures as a share of all documented GDPR fines since 2018.

Why regulators are converging on this specific mechanic

A recent survey of GDPR enforcement documented a growing regulatory focus on Article 5(1)(a), the lawfulness, fairness, and transparency principle, alongside Article 5(1)(f), integrity and confidentiality. Regulators increasingly treat transparency and fairness as the test of whether an organization built data protection in from the start or bolted it on afterward. That shift matters because transparency failures are comparatively easy for a data protection authority to establish. Proving a security control was inadequate can require forensic review of systems a regulator cannot fully inspect. Proving a privacy policy failed to disclose a required element under Article 13 or 14 requires reading the policy.

That asymmetry is part of why the coordinated 2026 enforcement action lands where it does. Rather than pursuing another round of headline breach investigations, this year's sweep is aimed squarely at notice clarity, checking whether published privacy policies actually meet the Article 12 standard for plain language and the Article 13-14 checklist for required disclosures. A business does not need to have suffered a breach, or even to have done anything with the data that a regulator objects to, to be in scope. It only needs a privacy policy that does not say enough, or does not say it clearly enough.

What a compliant policy actually needs to state

Meeting Article 12-14 obligations means a privacy policy has to name the specific purposes of processing rather than relying on broad categories like "improve our services." It has to state the legal basis for each purpose, whether that is consent, contract, legitimate interest, or another basis under Article 6. It has to disclose how long personal data will be retained, or at minimum the criteria used to determine that period. It has to identify any third parties or categories of recipients the data is shared with, and it has to explain, in language a non-lawyer can follow, how someone exercises their rights to access, correct, or delete their information.

The plain-language requirement in Article 12 is not optional polish. A privacy policy that is technically complete but written in dense legal phrasing can still fail the transparency test, because the standard is not just what was disclosed but whether it was disclosed in a way an average reader could actually understand. That is the exact gap a coordinated sweep on notice clarity is built to find, and it is a gap that shows up in wording choices most businesses never revisit once a policy is published. Our Privacy Policy Generator builds Article 12-14-aligned disclosures directly into the document it produces, so the purposes, legal bases, retention terms, and rights language match what current GDPR transparency enforcement is actually checking for, not just what a template looked like when it was first written.

The information in this article is for informational purposes only and should not be construed as legal advice on any matter, and does not create a lawyer-client relationship.