> series: anatomy_of_a_breach —— part: 113 —— event: gdpr_enforcement —— max_fine: 4%_global_turnover —— notification: 72_hours<span class="cursor-blink">_</span>_
On 25 May 2018, the General Data Protection Regulation (GDPR) came into force across the European Union and, through the UK's Data Protection Act 2018, in the United Kingdom. For the ICO and data protection across every sector this series has covered, the change was transformative. The maximum fine increased from £500,000 under the Data Protection Act 1998 to the higher of 4% of global annual turnover or €20 million. Breach notification became mandatory within 72 hours. Organisations were required to demonstrate accountability — not just compliance, but evidence that appropriate measures were in place.
To understand the magnitude of the change, consider the breaches documented in this series under the old regime: TalkTalk was fined £400,000 — the near-maximum. Under GDPR, the same breach could have attracted a fine of approximately £72 million (4% of TalkTalk's £1.8 billion revenue). Carphone Warehouse's £400,000 fine could have been £400 million. The Cambridge Analytica Facebook fine of £500,000 (the DPA maximum) could have been $1.6 billion. GDPR did not just raise the ceiling — it raised it by three orders of magnitude.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping CallGDPR transformed data security from an IT concern into a board-level obligation with personal liability for directors. For UK organisations, the practical implications are clear: Cyber Essentials certification provides documented evidence of baseline security measures, regular penetration testing demonstrates proactive vulnerability management, continuous SOC monitoring enables 72-hour breach notification, and incident response capability ensures breaches are managed professionally and reported within regulatory timescales.
After ten years of documenting breaches met with fines that were a rounding error in corporate budgets, GDPR gave the ICO the enforcement power to match the threat. The first major fines — British Airways and Marriott — would demonstrate that the ICO intended to use it.
<a href="/cyber-essentials">Cyber Essentials</a> provides documented evidence. <a href="/penetration-testing">Penetration testing</a> demonstrates proactive security. <a href="https://www.socinabox.co.uk">SOC in a Box</a> enables 72-hour notification. <a href="https://www.cyber-defence.io/services/incident-response">UK Cyber Defence</a> manages incidents within regulatory timescales.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping Call