GDPR Becomes Real When Something Goes Wrong
Most organizations treat GDPR as a paperwork exercise until a regulator’s decision letter arrives. August 2026 was a reminder of exactly how expensive that letter can be.
August and early September 2026 were unusually active weeks for European data protection authorities, with penalties ranging from €5,000 to nearly €825 million.
The cases were not about one type of failure automated decision-making, weak identity checks, poor access control, uncooperative management, thin cyber defences and forgotten physical archives all made the list.
Read together, they show that a data-protection programme is only as strong as its weakest operational habit.
What Counts as a Data-Protection Failure
A “failure” under GDPR is rarely a single dramatic breach. It is usually a gap that already existed: a process nobody owned, a control that was never tested, or a decision made without asking whether a person’s rights were affected.
These cases follow that pattern: none involved a novel attack technique. Each was a known, foreseeable risk that had simply not been closed.
The Six Cases
1. Uber B.V. and Uber Technologies Inc.
(Netherlands -€824,990,000)
What happened:
Between 2018 and 2022, Uber’s systems deactivated driver accounts over fraud suspicion or low ratings, with no human review taking place before the decision.
What failed:
High-impact automated decisions were made without human intervention, alongside inadequate transparency about how the decision-making process worked.
Control Failed:
Automated Decision-Making :
The safeguards that ensure no significant decision about a person is made by software alone, without a human able to review or override it.
Why it matters:
This is now the second-largest GDPR fine ever issued, and a clear signal that Article 22’s limits on automated decision-making apply to real, income-affecting platform logic not just theoretical scoring systems.
What to do differently:
Build appropriate safeguards into automated processes that can significantly affect a person’s rights or access to services, including meaningful human review where required, and document the decision logic in plain language.
2. XFERA Moviles S.A.U. (Spain – €200,000)
What happened:
A classic SIM-swap case: the telecom issued a duplicate SIM card to an attacker despite a mismatched identity document, without completing proper verification.
What failed:
Identity verification before issuing the duplicate SIM was inadequate.
Control Failed:
Identity Verification :
The checks that confirm a requester is who they claim to be before a high-risk action, like reissuing a credential, is carried out.
Why it matters:
A shortcut at a shop counter opened the door to SMS-OTP-based account takeover across banking, email and social media.
What to do differently:
Treat SIM-swap and identity-reissue requests as high-risk transactions with mandatory, auditable verification steps.
3. Amato Bestseller S.R.L. (Romania – RON 285,395 / ~€54,400)
What happened:
ANSPDCP imposed four separate fines on this online retailer for unauthorized data access by current and former employees, transparency failures, excessive data collection, and unconsented automated marketing calls.
What failed:
Employee instructions, procedures and differentiated access controls were inadequate, including insufficient control over former employee’s access.
Control Failed:
Access Management :
the rules and reviews that decide who can reach personal data, based on their role, and that revoke access the moment it’s no longer needed.
Why it matters:
Internal access hygiene is as much a GDPR issue as external attacks are.
What to do differently:
Tie access rights to role and employment status, and review them on a fixed schedule rather than only at onboarding.
4. Lab Pharma AS (Norway – NOK 205,000 / ~€18,400)
What happened:
Not a technical breach, but a cooperation failure:
Lab Pharma’s management threatened caseworkers with legal action and repeatedly missed deadlines for submitting documents during a Datatilsynet investigation.
What failed:
Cooperation with the supervisory authority a standalone obligation under Article 31.
Control Failed:
Regulator Cooperation: the obligation to respond to a supervisory authority’s requests and deadlines in good faith, independent of the merits of the underlying case.
Why it matters:
Stonewalling an investigation is its own violation, independent of whatever originally triggered the inquiry.
What to do differently:
Build a defined process, with a named owner, for responding to regulator requests within the deadline.
5. Gerocossen S.R.L. (Romania – RON 26,236.50 / €5,000)
What happened:
A cyberattack hit Gerocossen’s IT infrastructure, exposing customer identification and contact data. The company self-reported the breach.
What failed:
Technical and organizational security measures were inadequate, particularly access logging and monitoring.
Control Failed:
Security Monitoring :
the logging and alerting that let an organization detect and respond to unauthorized access, rather than learn about it after the fact.
Why it matters:
Even a modest fine came bundled with corrective orders the regulator cared as much about fixing the gap as about punishing it.
What to do differently:
Baseline logging and monitoring are not optional extras for smaller companies.
6. HSE (Ireland – €645,000)
What happened:
A physical-security and records-management failure rather than a cyber intrusion: intruders accessed paper medical records stored at two disused psychiatric hospitals, and videos were later posted to social media.
What failed:
Security and retention controls for sensitive paper records held at external, decommissioned facilities.
Control Failed:
Retention & Physical Security:
the discipline of disposing of records once their purpose has ended, and securing the ones still held, in physical form as much as digital.
The DPC also found that the breach was not notified without undue delay and within the required 72-hour period, highlighting the importance of having a clear breach-detection and notification process.
Why it matters:
Digital security programmes routinely overlook physical archives entirely.
What to do differently:
Apply the same access-control and retention discipline to paper records as to digital systems, especially at decommissioned sites.
7. The Six Operational Disciplines
- Know : Maintain an accurate record of what personal data you hold and why.
- Control : Restrict and review who can access it, by role and by need.
- Protect :Apply technical safeguards proportionate to the risk encryption, monitoring, logging.
- Retain : Dispose of data, physical or digital, once its purpose has ended.
- Respond : Have a tested breach-notification and regulator-cooperation process.
- Prove : Keep evidence logs, assessments, decisions that demonstrates compliance, not just claims it.
8. What SMEs Should Do
Smaller organizations don’t need enterprise-scale tooling to close these gaps. A basic access-review cadence, a written data-retention schedule, and a named point of contact for regulator communication cover most of what went wrong in Romania and Norway.
The Gerocossen fine is a useful reminder that even a €5,000 penalty comes bundled with mandatory remediation the real cost of ignoring the basics is rarely just the fine itself.
9. What CISOs and DPOs Should Take from This
The pattern across these cases is organizational, not purely technical. Automated systems need documented human oversight. Identity checks need enforcement, not just policy on paper.
Access rights need lifecycle management, not a one-time setup. And cooperation with regulators needs to be treated as a compliance obligation in its own right, with its own owner and its own deadline.
10. How GDPR Connects with NIS2, DORA and AI Governance
These cases don’t sit in isolation from the rest of Europe’s regulatory landscape. NIS2 raises the bar on security monitoring and incident reporting for a wider range of sectors directly relevant to cases like Gerocossen’s.
DORA imposes similar operational-resilience expectations on financial entities, where SIM-swap-style identity failures like XFERA’s carry acute risk.
And the EU AI Act’s governance requirements around automated decision-making echo, and extend, the human-review expectations behind the Uber fine. Organizations building compliance programs now benefit from treating GDPR, NIS2, DORA and AI governance as overlapping requirements rather than separate checklists.
10. Conclusion:
These six enforcement cases span a wildly different range of penalties, but they share a common thread: none stemmed from an unforeseeable event. They came from ordinary operational gaps an unreviewed algorithm, an unverified request, an unrevoked account, an ignored deadline, a thin security baseline, an unattended archive.
Closing those gaps is rarely glamorous work, but it is precisely what turns GDPR from a paperwork exercise into a functioning system of protection, before a regulator’s letter arrives.
10. References:
- Article 22 GDPR Automated individual decision-making
- Article 31 GDPR Cooperation with the supervisory authority
- Dutch DPA (Autoriteit Persoonsgegevens) decision Uber
- AEPD decision (PDF) XFERA Moviles S.A.U.
- ANSPDCP announcement, 6 August 2026 Amato Bestseller S.R.L.
- Datatilsynet decision Lab Pharma AS
- ANSPDCP announcement, 28 August 2026 Gerocossen S.R.L.
- DPC decision Health Service Executive (HSE)
- NIS2 Directive (EU) 2022/2555
- DORA Regulation (EU) 2022/2554
- EU AI Act Regulation (EU) 2024/1689
Need help turning GDPR & DORA into a clear action plan?
If this article resonated with challenges inside your organisation, let’s map your current controls and build a pragmatic, risk‑based roadmap for the next 90 days.