Olivier Reisch, a partener and local head of DLA Piper’s Luxembourg data protection and cybersecurity practice, said “organisations are operating in an unprecedented cyber risk landscape.” Photo: DLA Piper
A DLA Piper survey published on Wednesday, 21 January shows average daily data breach notifications in Europe reached 443 in 2025, as GDPR enforcement remained intense amid rising cyber risk.
Personal data breaches across Europe rose sharply in 2025, with organisations notifying regulators an average of 443 incidents per day, according to DLA Piper’s latest GDPR Fines and Data Breach Survey, published on Wednesday, 21 January.
That figure marks a 22% increase on the year and the first time daily breach notifications have exceeded 400 since the General Data Protection Regulation entered into force in 2018. Olivier Reisch, partner and local head of DLA Piper’s Luxembourg data protection and cybersecurity practice, said the figures point to a structurally more hostile risk environment.
“Against a backdrop of heightened geopolitical tensions and high-profile cyberattacks, the sharp rise in personal data breaches confirms that organisations are operating in an unprecedented cyber risk landscape,” Reisch said.
The survey covers the period from 28 January 2025 to 27 January 2026 and draws on publicly available data from supervisory authorities across the European Economic Area and the United Kingdom.
European data protection authorities issued around €1,200 million in GDPR fines during the period, broadly in line with 2024 totals, signalling no material easing in enforcement. Since May 2018, cumulative fines have reached €7,100 million, with Ireland remaining the largest enforcer by value.
The biggest penalty imposed in 2025 was a €530 million fine issued by Ireland’s Data Protection Commission against a social media company for unlawful data transfers to China. The record individual sanction remains the €1,200 million fine imposed on Meta Platforms Ireland Limited in 2023.
“Combined with sustained regulatory scrutiny, this reinforces the need for robust governance and cyber resilience,” DLA Piper said, pointing to rising operational pressure as breach notifications continue to climb.
The report comes as policymakers consider adjustments to the regulatory framework. The European Commission proposed a Digital Omnibus package in November 2025, while the UK’s Data (Use and Access) Act 2025 introduced changes to data processing and transfer rules.
DLA Piper said organisations should expect compliance pressure to remain high as cyber risk and reporting obligations continue to expand.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
