Quote:...In May last year the EU’s General Data Protection Regulations (GDPR) came into effect. GDPR was essentially designed to give a thwacking slap on the wrists, or a hefty fine, to those organisations that didn’t do everything they could possibly do to secure customer data.

In the eight months since the introduction of this much welcomed legislation there have been over 59,000 personal data breaches reported across Europe. This isn’t the number of individual records; it’s the number of reported incidents.

• The Netherlands, Germany and the UK topped the table in the report with approximately 15,400, 12,600, and 10,600 reported breaches respectively. 
  
• The lowest numbers of reported breaches were made in Liechtenstein, Iceland and Cyprus with 15, 25 and 35 reported breaches respectively.
  

The findings, released in a report from DLA Piper, noted that Netherlands, with 89.8 reported breaches per 100,000 people topped the list when the number of notifications were measured against country populations, followed by Ireland and Denmark.

Of the 26 EEA countries where breach notification data is available, the UK, Germany and France ranked tenth, eleventh and twenty-first respectively on a per capita basis. Greece, Italy and Romania reported the fewest number of breaches per capita.

GDPR states:

• Personal data breaches which are likely to result in a risk of harm to affected individuals must be notified to data regulators (within 72 hours). Where the breach is likely to result in a high risk of harm, affected individuals must also be notified. 
  
• Sanctions for failing to comply with the new notification requirements include fines of up to €10 million, or up to 2% of the total worldwide annual turnover of the preceding financial year, whichever is higher