What Types Of GDPR Breaches Commonly Lead To Fines?

The enforcement record shows clear patterns in the types of failure that most frequently attract regulatory action. The grounds on which the ICO can fine organisations include inadequate security measures, processing personal data without a valid lawful basis, failing to be transparent with individuals about how their data is used, unlawful data sharing or transfers outside the UK or EU without the appropriate legal mechanisms, and keeping personal data for longer than necessary without a documented retention policy.

In practice, cyber and data security failures are currently driving the largest fines. In 2025, the ICO issued six GDPR fines totalling over £20 million, a significant increase on previous years, with the biggest penalties going to organisations that failed to protect sensitive personal data from cyber attack. Not every investigation results in a fine; the ICO also uses reprimands and enforcement notices, and the size of any penalty depends on factors including the nature of the failure, whether it was intentional, and how the organisation responded.