GDPR has turned eight. European regulators are no longer warning — they are auditing, fining, and demanding immediate proof of compliance. If your business processes personal data of clients, employees, or partners, here is what is current for 2026.

EDPB 2026 Enforcement Priority — Transparency

The European Data Protection Board (EDPB) has announced that the coordinated enforcement focus for 2026 is compliance with transparency and information obligations under Articles 12, 13, and 14 of the GDPR. Every business must be able to demonstrate that its clients and employees have been clearly and fully informed — what data is collected, for what purpose, for how long it is retained, and with whom it is shared. National supervisory authorities across the EU are participating in these coordinated audits.

Fines and Enforcement

Since GDPR took effect, over 2,679 fines totalling more than €6.7 billion have been issued across Europe by the end of 2025. Maximum penalties reach up to 4% of annual global turnover or €20 million. Small and medium-sized businesses are not exempt — regulators are actively auditing smaller websites, online shops, and professional service providers.

EU AI Act — Applicable from 2 August 2026

From 2 August 2026, the EU AI Act obligations for high-risk AI systems become enforceable. Any business using AI tools to process personal data — such as automated decision-making, client profiling, or recruitment systems — must conduct a Data Protection Impact Assessment (DPIA) and ensure transparency toward affected individuals.

Digital Omnibus — Simplification Ahead

The European Commission has proposed a package of measures to simplify certain GDPR obligations, primarily targeting small and medium-sized organisations with fewer than 750 employees. The proposals include easing the requirement to maintain Records of Processing Activities (ROPA) and introducing clearer rules on cookie consent. The legislative process is ongoing — final texts are expected by the end of 2026.

Right to Erasure — Increased Scrutiny

Following the EDPB's focus on the right to erasure (Article 17 GDPR) in 2025, follow-up reports and additional audits are expected. Businesses must have a functioning process for handling erasure requests — responded to within the legal timeframe and fully documented.

What to Review in Your Business?

— Is your Privacy Policy up to date and does it include all mandatory elements under Articles 13 and 14 GDPR?
— Do you have signed Data Processing Agreements (DPA) with all vendors processing data on your behalf?
— Are you retaining only data for which you have a legal basis and a defined retention period?
— In the event of a data breach — do you have a procedure to notify the supervisory authority within 72 hours?
— Are you using AI tools? If so — is the legal basis for processing documented?

KDK Corrective and Data Protection

At KDK Corrective, we apply GDPR requirements in practice — encrypted client portal, documented processes, signed DPA agreements, and current legal documentation. If you have questions about data protection in the accounting and financial operations of your business, get in touch with us.

Questions about GDPR compliance for your business? View our services →