Number of fines imposed by violation type across the EU The graph on the left displays the total number of GDPR fines imposed in the EU, broken down by violation type. Insufficient legal basis for data processing - 537 fines Non-compliance with general data processing principles - 424 fines Insufficient technical and organisational measures to ensure information security - 313 fines Insufficient fulfilment of information obligations - 165 fines Insufficient fulfilment of data subjects’ rights - 160 fines Insufficient cooperation with supervisory authority - 69 fines Insufficient fulfilment of data breach notification obligations - 31 fines Insufficient involvement of data protection officer - 15 fines Insufficient data processing agreement - 11 fines Unknown - 9 fines 11