Data protection complacency has gone from a latent risk to a real financial threat. For HR Directors and Compliance Officers across Europe, the era of warnings is over: the General Data Protection Regulation (GDPR) is now enforced consistently, and the figures show that doing nothing is often the most expensive decision a company can make.
According to the DLA Piper GDPR Fines and Data Breach Survey published in January 2026, fines imposed since the GDPR came into force in May 2018 add up to around 7.1 billion euros across the jurisdictions surveyed, with roughly 1.2 billion euros issued in 2025 alone. The same survey recorded an average of 443 personal data breach notifications per day in Europe, 22% more than the previous year.
For a company that manages frontline, deskless staff, ignoring privacy risks on personal devices is not just a line on the balance sheet. It is a source of operational instability.
The largest GDPR fines have been imposed on big tech companies, most of them by the Irish Data Protection Commission, which supervises the European headquarters of many of these groups. But data protection authorities across Europe also regularly sanction ordinary employers for the way they handle staff data.
Most of these cases don't come from sophisticated cyberattacks. They come from everyday weaknesses in how workers' information is managed: personal phone numbers shared in groups, documents sent through consumer apps, or former employees who keep access to company data.
A word of caution on "average fines": a few very large penalties distort the averages. For an HR team, the useful question is not the European average, but which specific practices expose the company and what the GDPR sets as the maximum for each.
| HR practice | What the GDPR says | Maximum fine |
| Using employees' personal numbers in WhatsApp groups | Processing needs a valid legal basis (Art. 6), and consent is rarely valid at work. | Up to €20 million or 4% of global turnover. |
| Sending payslips or documents through consumer apps | Data must be processed with appropriate security (Art. 32). | Up to €10 million or 2% of global turnover. |
| Former employees keeping company data | Data must be erased when no longer needed (Arts. 5 and 17). | Up to €20 million or 4% of global turnover. |
| Failing to report a data breach | Breaches must be notified to the authority within 72 hours (Art. 33). | Up to €10 million or 2% of global turnover. |
These are the maximums set by the GDPR. Actual fines depend on the severity of the breach, the size of the company and the decision of each national authority.
For many companies, using personal WhatsApp to coordinate shifts or send payslips looks free. In reality, it is one of the most expensive channels a company can choose. European data protection authorities consider that, because of the hierarchy in the employment relationship, consent to join a work group is very hard to prove as freely given. That removes the usual defense of many companies. We explain this in detail in the GDPR fine you don't see and in our article on why HR shouldn't store personal phone numbers.
One of the least visible risks is data that stays behind after an employee leaves. Once the employment relationship ends, the legal basis for keeping that person in work communication channels disappears. In WhatsApp groups, however, the history and contacts remain on the former employee's phone. Without technical means to revoke access instantly, the company cannot guarantee security or erasure. See how to solve it in how to revoke access to corporate data immediately.
The right to disconnect is not regulated by the GDPR but by national labour law, and more and more European countries have adopted it. France, Belgium and Portugal, among others, require employers to respect workers' rest time and to set clear rules on contact outside working hours. Penalties are set by each country's labour law, and the risk grows when constant connection leads to stress or burnout.
Ommnio is built to remove the practices that drive these risks:
For a complete overview of employers' obligations, read our GDPR guide to employee data privacy for deskless teams.
The cost of a professional platform is a small fraction of the impact of a single GDPR fine, plus the time and reputation lost in an investigation. HR Directors who keep their workforce on WhatsApp groups or manual systems are betting their company's stability against increasingly active data protection authorities.
Don't wait for a breach notification to start your digital transformation. Protect your organization, respect your frontline team and turn compliance into a competitive advantage with the right technology.