Of the 30 national data protection authorities in the European Economic Area, 23 (77%) told the European Data Protection Board (EDPB) that their budget is not enough, and 26 (87%) said the same about staffing. That comes from the EDPB's "Overview on resources made available by Member States to the Data Protection Supervisory Authorities," published on 5 September 2022 and the latest country-by-country comparison from the Board that we could find as of November 2026.
How many data protection authorities say they are underfunded?
In the EDPB's survey, 23 of 30 authorities answered "No" to whether the allocated budget is sufficient to carry out their activities, and 7 answered "Yes": Cyprus, Denmark, Hungary, Ireland, Italy, Liechtenstein and Luxembourg. On human resources the split was starker, with 26 saying "No" and only Denmark, Hungary, Ireland and Liechtenstein saying "Yes".
The EDPB's own wording is that an "important majority" of authorities explicitly state they do not have enough resources, and that a "vast majority" say the same about human resources. These are self-assessments, not an audit of what each authority needs, and the Board notes that the comments accompanying the figures were written by the authorities themselves.
Two details stand out. Austria links its answer to a recent significant increase in the number of complaints it receives. Spain says it needs more resources to handle cooperation procedures, more complaints and new tasks arising from EU regulatory developments.
The survey result is plain: roughly three in four regulators say the money is not there.
How big are data protection authority budgets by country?
Germany's combined 18 authorities had EUR 114,086,030 in 2022, followed by Italy at EUR 44,584,987, the Netherlands at EUR 28,695,000, France at EUR 23,950,000 and Ireland at EUR 23,200,000. At the other end, Malta had EUR 680,000 and Cyprus EUR 869,377. Across all 30 entries the 2022 total is about EUR 348.1 million, by our sum of the EDPB's chart labels.
The EDPB warns that budgets "have to be interpreted in light of possible differences in the scope of competences, activities, and financial responsibilities at national level." The Czech authority's figure includes non-GDPR tasks. Denmark's and Sweden's budgets also cover video surveillance, credit information and debt recovery, and Denmark's includes the whistleblower reporting channel from 2022. Germany's number is the sum of 18 separate bodies.
France reports that its budget splits into 82% staff costs and 16% operating costs. Ireland had EUR 23.2 million in 2022, and our look at GDPR fines under Ireland's DPC covers what its regulator has done with it.
Budget size varies by a factor of about 168 between Germany's combined total and Malta's single authority, so raw comparisons mislead without context.
Which authorities gained or lost budget from 2020 to 2022?
Of the 29 authorities with a 2020 budget figure, 25 saw an increase by 2022 and 4 saw a decrease. Austria rose 63.9%, from EUR 2.8 million to EUR 4.6 million, Cyprus rose 56.4%, Italy 48.0%, Germany 38.1% and Ireland 37.3%. Hungary fell 27.7%, Greece 18.6%, Slovakia 11.9% and the Czech Republic 10.7%.
Figure 1: The six largest percentage budget increases between 2020 and 2022, calculated from budget figures in the EDPB overview. Portugal has no 2020 or 2021 figure and is excluded.
The percentages are our arithmetic on the EDPB's chart labels. One caution applies: a footnote in the EDPB overview says the 2020 figures here are amounts granted, while its 2021 overview reported the amount actually spent, so 2020 figures can differ between the two editions.
| Authority | 2020 budget | 2022 budget | Change |
|---|---|---|---|
| Germany (18 authorities) | EUR 82.6 million | EUR 114.1 million | +38.1% |
| Italy | EUR 30.1 million | EUR 44.6 million | +48.0% |
| Ireland | EUR 16.9 million | EUR 23.2 million | +37.3% |
| Hungary | EUR 5.6 million | EUR 4.0 million | -27.7% |
Source: EDPB, Overview on resources made available by Member States to the Data Protection Supervisory Authorities (5 September 2022). Change calculated by PrivacyTerms.io.
Most budgets rose, but the same survey shows 77% of authorities still call them too small, so growth alone is not closing the gap.
How many people work at EU data protection authorities?
The EDPB overview counts approved posts, not people actually employed: 3,520 posts across the entries that reported a 2022 figure, with Austria and Norway shown at zero for that year. Germany holds 1,155 of them, about 33%. France (263), Poland (260) and Ireland (257) follow, and ten authorities have more than 100 approved posts.
Staffing grew more slowly than money. For the 27 authorities with both 2020 and 2022 figures (leaving out Austria and Norway, shown at zero for 2022, and Portugal, which has no 2020 figure), approved posts went from 3,104 to 3,494, up 12.6%. Ireland is the outlier at 145, 175 and then 257 posts across 2020, 2021 and 2022. The Netherlands went the other way, from 180 to 167. Malta had 14 posts in 2022 and Liechtenstein 7.
Figure 2: How the EDPB and the EU Fundamental Rights Agency (FRA) have tracked authority resources. Source: EDPB overview footnotes and FRA news release (2024).
Posts that are approved but unfilled tell a harsher story. Italy has 139 staff members against 200 full-time posts provided by national law, leaving 61 vacant. The Netherlands had 167 staff against a target of 212. Estonia says only 16 of its positions are filled for lack of financial resources, with staff turnover above 30% over the past two years.
Approved posts are a ceiling, not a headcount, and several authorities cannot fill the ones they have.
What do authorities say they need?
Several authorities put numbers on the gap. Belgium says it needs 10 more full-time staff in 2022, 15 in 2023 and 25 in 2024. Bulgaria says it needs to add more than a third to its existing staff, mostly complaint-handling experts. Lithuania's Ministry of Justice audit division said its inspectorate needed 32 additional posts, and it received 14. Sweden requested a gradual budget increase totaling EUR 5.8 million across 2023 to 2025. Slovakia calls its situation "very critical."
Figure 3: Questions to ask before comparing two authorities' budgets. Source: EDPB overview of resources, footnotes and country comments (5 September 2022).
The EU Fundamental Rights Agency reached a similar conclusion from a different method. It interviewed 70 representatives of data protection authorities from all 27 Member States between June 2022 and June 2023 and found that a large majority of interviewees named inadequate financial and human resources as a major obstacle to their GDPR tasks. Its June 2024 release says "underfunding and a lack of staff hamper the authorities from fully carrying out their mandates." FRA's study is based on qualitative interviews, so it backs up the EDPB's direction but not its numbers.
The shortfall is also documented in the enforcement record itself, covered in our GDPR enforcement statistics and GDPR fines per capita data.
What it means for the largest budgets
Germany holds roughly a third of Europe's regulator money and a third of its posts, which fits its role as the home of 18 separate authorities. Ireland, with 257 posts and EUR 23.2 million, is small by comparison with Germany but is among the larger authorities by headcount. How that translates to fines by country is covered in GDPR fines by country.
Resource gaps are a reason to expect uneven enforcement, not a reason to expect none. FRA reports that authorities often need to prioritize complaint handling over other tasks, which means a complaint about a missing or unclear privacy notice can reach the front of the queue.
The Bottom Line
The EDPB's last country-by-country comparison shows 23 of 30 authorities (77%) calling their budget insufficient and 26 of 30 (87%) calling their staffing insufficient. Budgets for 29 entries grew 25.7% from 2020 to 2022, and approved posts for 27 grew only 12.6%. The FRA's 2024 interviews with 70 authority representatives pointed the same way. For a site owner, the practical reading is that enforcement capacity is thin and uneven across Europe, and that complaints are a main trigger for regulator attention. The most controllable item is a privacy notice that matches what you actually collect. You can generate a privacy policy as a starting point, then check it against your own data flows. This is information, not legal advice, and it does not guarantee any outcome with a regulator.
Frequently Asked Questions
How many data protection authorities say their budget is not enough? 23 of 30 (77%) said their allocated budget is not sufficient, and 26 of 30 (87%) said their human resources are not sufficient, according to the EDPB's overview of resources published on 5 September 2022.
Which EU data protection authority has the biggest budget? Germany, with EUR 114,086,030 in 2022. That figure covers all 18 German supervisory authorities combined, and it is about 33% of the EUR 348.1 million total across the 30 national entries in the EDPB overview.
How many staff do EU data protection authorities have? The EDPB overview shows 3,520 approved posts for 2022 across the entries that reported a figure. Germany accounts for 1,155 of them, and 15 authorities with a non-zero figure have fewer than 60 posts.
Has the EDPB published newer budget figures than 2022? We found no newer edition. As of November 2026 the EDPB's document page still presents the overview published on 5 September 2022, so 2022 is the latest country-by-country budget and staffing comparison in that series that we could locate.
Where the Numbers Come From
- EDPB: Overview on resources made available by Member States to the Data Protection Supervisory Authorities (5 September 2022). Budgets and approved posts for 2020 to 2022, sufficiency answers, country comments. Percentage changes and totals are our calculations from its chart labels.
- EDPB: document page for the resources overview. Publication date of the overview; we found no newer edition as of November 2026.
- EU Agency for Fundamental Rights: Lack of resources undermines EU data protection enforcement (11 June 2024). 70 interviews, all 27 Member States, June 2022 to June 2023.
- EU Agency for Fundamental Rights: GDPR in practice, experiences of data protection authorities (2024). Interview findings on financial and human resources.
Note: All figures verified as of November 2026. The EDPB overview covers 2020 to 2022 and was compiled from authorities' own answers, so current budgets and staffing will differ.
