Ireland's Data Protection Commission logged 16,160 new GDPR cases in 2025, a 45% jump from 11,091 in 2024, according to the DPC's Annual Report 2025, published June 30, 2026. That single regulator's caseload is the clearest read available on where GDPR enforcement actually stands in 2026: most activity never becomes a fine, the fines that do land are wildly uneven by country, and a fresh EU-wide audit is already underway.
How many GDPR cases did regulators open in 2025?
16,160 new cases arrived at Ireland's DPC in 2025 alone, a regulator that handles a disproportionate share of EU enforcement because it is the lead supervisory authority for Meta, TikTok, Google, and most other large platforms under GDPR's one-stop-shop rule. That is up sharply from 11,091 in 2024, and the DPC's own report points to a specific driver: a surge in AI-assisted complaint drafting added both volume and complexity to the cases it received.
Figure 1: New GDPR cases received by Ireland's Data Protection Commission, 2024 versus 2025. Source: Data Protection Commission, Annual Report 2025 (published June 30, 2026).
A single national regulator logging more than 16,000 new cases in one year is not a rounding error in the GDPR enforcement story. It is most of the story.
How does Ireland's case count compare to the rest of the EU?
Ireland's DPC is one data point inside a much larger enforcement system. CMS Law's GDPR Enforcement Tracker Report 2026, the most widely cited aggregator across all 30-plus supervisory authorities, counts 2,685 confirmed fines with a disclosed amount as of its March 1, 2026 cutoff, or 3,062 recorded cases once cases with limited public detail are included. enforcementtracker.com's continuously updated database, checked in July 2026, runs slightly ahead at 3,202 recorded actions, since it folds in additional publicly reported cases as they surface.
Figure 2: GDPR enforcement cases recorded EU-wide, by tracker, as of their respective 2026 cutoffs. Source: CMS Law GDPR Enforcement Tracker Report 2026 and enforcementtracker.com.
None of these three counts agree exactly, because each tracker applies a different disclosure bar. For a fuller breakdown of what those fines add up to in euros, see our companion post on GDPR fines totals, averages, and records, which puts the cumulative figure at roughly EUR 7.1 billion through January 2026 per DLA Piper's own annual survey.
What kinds of cases is Ireland's DPC actually handling?
Most of the DPC's 16,160 new cases in 2025 never turn into a fine. The regulator concluded 11,734 cases that year, an increase of 12% over 2024, but finalized only 4 large-scale inquiries that produced an administrative penalty. Alongside that, it concluded 208 cross-border complaints as lead supervisory authority, up 43% year over year, and 275 electronic direct marketing investigations, up 88%, backed by 50 warning letters sent to companies over unsolicited marketing.
Figure 3: Valid data breach notifications received by Ireland's DPC, 2023 to 2025. Source: Data Protection Commission, Annual Reports 2023, 2024, and 2025.
Breach notifications tell a different story than complaints do. They rose from 6,991 in 2023 to 7,781 in 2024, then fell 16% to 6,521 in 2025, with 85% of that year's notifications closed out by year end. A site that has not reviewed its breach-notification wording and its consent language against current GDPR requirements is exposed on both fronts at once; a privacy policy generator built for GDPR compliance keeps that documentation current without waiting for a regulator inquiry to flag the gap.
Which countries issue the most GDPR fines by value?
EUR 1.15 billion in GDPR fines landed across the EU in 2025, according to the European Data Protection Board's Annual Report 2025, and almost all of it is concentrated in two countries. Ireland's EUR 530.77 million and France's roughly EUR 486.9 million together make up close to 89% of that total, while Germany and Spain, despite issuing far more individual fines, contributed only single-digit percentage shares each.
Figure 4: Share of 2025 EU GDPR fine value, by country. Source: European Data Protection Board, Annual Report 2025 (published April 9, 2026), Data Protection Commission Annual Report 2025.
Ireland's share is driven overwhelmingly by a single decision, the EUR 530 million fine against TikTok. That pattern, one mega-fine reshaping an entire country's annual total, shows up again and again in GDPR enforcement data; our timeline of GDPR fines from 2018 to 2026 tracks the same effect across the whole eight-year record, and our breakdown of Big Tech's GDPR fines since 2018 shows Meta, TikTok, and a handful of other platforms account for more than two-thirds of the EU's entire confirmed fine total on their own.
Do more fines mean bigger fines? Not even close.
The relationship between fine count and fine value runs almost entirely backwards. Germany issued 499 GDPR fines in 2025, more than any other country, for a combined EUR 48.1 million, an average of roughly EUR 96,400 per case. Ireland issued just 4 fines that year for EUR 530.77 million total, an average of about EUR 132.7 million per case, more than 1,300 times Germany's average.
Figure 5: GDPR fines issued by country, 2025, ranked by count. Source: European Data Protection Board, Annual Report 2025.
Spain sits closer to Germany's pattern, with 324 fines in 2025 for EUR 45.2 million, or about EUR 139,500 per case. France lands in between, with 84 fines averaging roughly EUR 5.8 million each. Regulators that fine often tend to fine small; regulators that fine rarely tend to fine enormous.
What is the EDPB auditing under GDPR in 2026?
The European Data Protection Board's 2026 Coordinated Enforcement Framework has 25 national data protection authorities checking whether privacy notices comply with GDPR Articles 12, 13, and 14, the provisions that govern how clearly and completely a business has to disclose its data practices. It is the EDPB's fifth coordinated sweep since the program began in 2022, and each cycle follows the same pattern: joint investigation, aggregated findings, published guidance, then targeted enforcement in the following year.
The EDPB's own 2025 figures show how much cross-border machinery already runs behind the scenes: 414 new cross-border cases were registered in the Board's case register during 2025, 1,299 one-stop-shop procedures were triggered under GDPR Article 60, and 572 of those reached a final decision. A transparency-focused sweep in 2026 means outdated or vague privacy policy language is now a specific, named audit target rather than a general compliance risk. The UK runs a separate post-Brexit regime with its own regulator, the ICO, but shows a similar pattern of concentrated, rising penalties; see our average ICO fine tracker for how that comparable system has moved since 2023.
How did DPC Ireland's enforcement activity change from 2024 to 2025?
| Metric | 2024 | 2025 | Change |
|---|---|---|---|
| New cases received | 11,091 | 16,160 | +45% |
| Data breach notifications | 7,781 | 6,521 | -16% |
| Direct marketing investigations concluded | 146 | 275 | +88% |
| Fines imposed | over EUR 652 million | EUR 530.77 million | about -19% |
Source: Data Protection Commission, Annual Reports 2024 and 2025.
Case volume and fine value moved in opposite directions at the same regulator in the same year: 16,160 new cases arrived while total fine value actually fell, which is the clearest evidence that counting fines alone understates how much enforcement activity is happening.
The Bottom Line
16,160 new GDPR cases at one regulator in one year is the number that should reset how enforcement gets covered. Fine totals get the headlines, but they capture a small, uneven slice of what data protection authorities actually do: most of the DPC's caseload closed without a monetary penalty, the EU's total fine value is dominated by two countries, and a fresh transparency audit covering 25 DPAs is already running in 2026. For any business collecting data from EU residents, the practical read is that audit exposure is broader than fine risk, and the specific gap regulators are checking for this year, clear and complete disclosure under Articles 12 through 14, is fixable before an inquiry ever opens.
Frequently Asked Questions
How many GDPR enforcement cases were there in 2025? Ireland's Data Protection Commission alone logged 16,160 new cases in 2025, up 45% from 11,091 in 2024, per the DPC's Annual Report 2025. EU-wide, CMS Law's GDPR Enforcement Tracker Report 2026 counts 3,062 recorded enforcement cases since 2018, including cases with limited public detail.
Do most GDPR cases end in a fine? No. The DPC concluded 11,734 cases in 2025 but finalized only 4 large-scale inquiries that produced a fine, totaling EUR 530.77 million. Most concluded cases close through guidance, corrective orders, or no violation found rather than a monetary penalty.
Which country issues the most GDPR fines? It depends on whether you count by volume or value. Germany issued 499 fines in 2025 but only EUR 48.1 million total, while Ireland issued just 4 fines worth EUR 530.77 million, according to the EDPB's Annual Report 2025 and Ireland's DPC Annual Report 2025.
What is the EDPB auditing under GDPR in 2026? Transparency and information obligations under GDPR Articles 12 to 14. The European Data Protection Board's 2026 Coordinated Enforcement Framework has 25 national data protection authorities checking whether privacy notices actually tell people, clearly and completely, what happens to their data.
Where the Numbers Come From
- Data Protection Commission (Ireland). (2026). "Annual Report 2025." Published June 30, 2026. Source of the 16,160 new cases, 11,734 concluded cases, 6,521 breach notifications, 208 cross-border complaints, 275 marketing investigations, and EUR 530.77 million in fines cited throughout this post.
- European Data Protection Board. (2026). "EDPB Annual Report 2025." Published April 9, 2026. Source of the EUR 1.15 billion EU-wide 2025 fine total, the 414 cross-border cases and 1,299 Article 60 one-stop-shop procedures, and the 2026 Coordinated Enforcement Framework details.
- CMS Law. (2026). "GDPR Enforcement Tracker Report 2026, Numbers and Figures." 2,685 confirmed fines and 3,062 total recorded cases as of the March 1, 2026 cutoff.
- PPC Land. (2026). "EDPB 2025 Annual Report: EUR1.15bn in GDPR Fines, New AI and DMA Rules." Country-level 2025 fine breakdown (France EUR 486.9 million across 84 fines, Germany EUR 48.1 million across 499 fines, Spain EUR 45.2 million across 324 fines) drawn from the EDPB Annual Report 2025 and cross-checked against the DPC's own Ireland figure.
Note: All figures verified as of October 2026. GDPR enforcement data is refreshed at least twice a year as the DPC, the EDPB, and CMS Law publish new annual reports and tracker updates.
