Industry

Top GDPR statistics businesses must know

GDPR is one of the most extensive regulations governing data collection. Learn who it affects, the types of data it covers, and more.

An icon showing gdpr stats
Read time:
Share this post
Copied
Table of contents
⚡ Key takeaways

The digital age has compelled companies to collect data on customers so they can provide a more customized experience. However, businesses are required to follow specific requirements to maintain the privacy of their customers during the data collection process.

One of the most extensive regulations governing data collection is GDPR.

What is GDPR?

The General Data Protection Regulation, or GDPR, is a strict set of data privacy laws for businesses that collect data on EU citizens.

Under GDPR, businesses are responsible for safeguarding numerous types of personal information, including the customer's IP address, cookie data, home address, and Social Security number.

The complete GDPR manual includes hundreds of laws promoting individuals’ right to digital privacy, which is an integral component of the 1950 European Convention on Human Rights. GDPR replaces the Data Protection Directive of 1995 and addresses the current digital privacy concerns of people who live in the EU.

Does GDPR impact US companies?

As the GDPR’s primary objective is to protect user data of residents of the EU, the regulations are applicable for all businesses, even if they aren’t based in the European Union. This information is covered in Article 3 of GDPR, which discusses the territorial scope of the legislation.

In other words, any company that collects data or provides a service to residents of Europe must comply with GDPR. Specifically, it applies to companies situated and registered outside of the EU that:

  • Are located in the US but target EU customers (for instance, presenting prices in Euros or running location-specific ads).
  • Engage in “professional or commercial activity.” This includes collecting funds from friends and family to finance a side business project.
  • Use digital tools to track cookies or IP addresses of users visiting the website from EU countries.

What types of personal data does GDPR cover?

GDPR covers all types of personal user data, including (but not limited to):

  • Personal ID information, such as names, addresses, contact numbers, or email addresses of users visiting the website
  • Personal information, such as political opinions, ethnic origins, sexual orientation, and religious ideologies
  • Health data, such as the patient’s genetic history, name, test results, emails, and audio recordings or physician notes about a patient
  • Biometric data, such as fingerprints, facial patterns, voice, or typing cadence of users
  • Web data, such as IP addresses, browsing activity, names, emails, and credit card information

GDPR statistics

Complying with GDPR requirements is extremely important for companies, regardless of their location. Let's look at some GDPR statistics to understand why it's important.

GDPR statistics about how Americans feel about digital privacy, the impact of data breaches, how GDPR compliance has impacted user experience, and more

GDPR enforcement: types of violations and fines

According to DLA Piper, GDPR regulators issued nearly $1.2 billion in fines since January 2021 — almost seven times 2020’s total.

As of February 2022, there have been around 1,000 fines, broken down into a few main types of violations:

  • 224 firms were fined for not complying with GDPR.
  • 87 companies were fined for insufficient fulfillment of GDPR.
  • 350 firms were penalized for having an insufficient legal basis for data processing.
  • 202 fines were given to firms that inadequately implemented technical and organizational measures to safeguard user privacy.
  • 97 companies were penalized for their inability to comply with data subjects rights.
  • 6 penalties were due to the company's failure to comply with the data processing agreement.
  • 12 firms were penalized for not hiring a data protection officer.
  • 41 fines were due to ineffective collaboration with a supervisory authority.
  • 6 penalties were made for undisclosed reasons.

How Persona helps businesses with GDPR compliance

When you use Persona for your identity processes, you can focus on growing your business and leave the secure PII storage up to us. Not having PII in your system means you don’t carry the liability of potential breaches or leaked customer data, yet you have easy and reliable access to it whenever you need it. We meet the highest security standards, so you can know that your data is safe with us and that you’re complying with GDPR and other data regulations, such as CPRA, from the start.

If an individual requests their PII, it’s easy to retrieve from Persona because all information about that user is stored under that user’s account. And if you have compliance or legal requirements for how long you can keep PII, you can set up automated PII removal on the cadence of your choosing.

Interested in learning more about how we store PII? Get in touch and we’d be happy to share more.

Frequently asked questions

No items found.

Continue reading

Continue reading

How digital health apps can overcome four barriers to converting users
How digital health apps can overcome four barriers to converting users
Industry

How digital health apps can overcome four barriers to converting users

New patients might abandon onboarding if they’re confused, frustrated, or overwhelmed. Here are four ways digital health apps can improve conversion.

How to create scalable and compliant international KYB processes
How to create scalable and compliant international KYB processes
Industry

How to create scalable and compliant international KYB processes

Industry experts discuss international KYB and debunk common myths while sharing how to build a scalable global KYB process.

Trust and safety survey insights: Fighting identity fraud in the age of GenAI
Trust and safety survey insights: Fighting identity fraud in the age of GenAI
Industry

Trust and safety survey insights: Fighting identity fraud in the age of GenAI

Persona’s trust and safety survey reveals that although many fraud fighters feel effective, few have the tools to proactively mitigate identity fraud at the scale generative AI has introduced.

What the California Privacy Rights Act (CPRA) means for your business
Industry

What the California Privacy Rights Act (CPRA) means for your business

Learn how the California Privacy Rights Act (CPRA) differs from the CCPA, the implications for your business, and how to prepare.

5 best practices for securing health data
Industry

5 best practices for securing health data

Healthcare organizations must prioritize data security to protect patient information and ensure regulatory compliance. Learn how.

A safe place for all your PII
Product

A safe place for all your PII

PII storage to suit all your compliance needs, enabled by Accounts.

Ready to get started?

Get in touch or start exploring Persona today.