GDPR in 2024: New Sanctions and Best Practices

GDPR fines and best practices: what to prioritise in 2026

GDPR enforcement is useful when it changes operational decisions, not just when a large fine attracts attention. Weak authentication, unnecessary data retention and incomplete incident communications are practical problems that organisations can identify and address before a regulator becomes involved.

As of November 2026, the priority is to connect privacy requirements with everyday work: who can access personal data, why the organisation keeps it, how people exercise their rights and what happens during a breach. This guide draws lessons from verified enforcement and turns them into a manageable improvement programme.

What recent enforcement tells us

Security controls must work, not merely exist

In a publication dated 14 January 2026, the CNIL reported fines of €27 million against FREE MOBILE and €15 million against FREE. Its findings included insufficiently robust authentication for VPN access and ineffective measures for detecting abnormal behaviour.

These amounts are not a forecast of what another organisation would pay. The practical lesson is that having a security product does not establish that the relevant risk is controlled. Configuration, coverage and response arrangements all matter.

Ask your IT team to demonstrate how remote access is protected, which accounts can use it and how access is removed. Ask who reviews suspicious events and what they do when an alert appears. Evidence of an actual test is more useful than a screenshot showing that a feature is available.

Retention and breach communication need their own controls

The same CNIL publication identifies excessive retention of former subscribers’ data by FREE MOBILE. For both companies, it also describes shortcomings in the information provided to affected individuals after the breach.

A retention schedule therefore needs a deletion process behind it. Similarly, sending a notification is not enough if recipients cannot understand the likely consequences or how to protect themselves. Treat both activities as controlled workflows with an owner, clear instructions and checks on completion.

Build compliance around actual processing

The legal references below come from the official GDPR text on EUR-Lex. Applying them requires attention to your processing activities, role and risks to individuals; a generic checklist cannot decide every case.

Match the purpose to the lawful basis

Article 6 provides several lawful bases. Consent is not a universal solution, and putting a statement in a privacy notice does not create a lawful basis by itself.

For each activity, describe the real purpose and record the justification used. Take a customer form as a test case: which fields are necessary, who receives the information and whether the published explanation matches actual practice. Additional conditions may apply to special categories of personal data, so do not assume that an Article 6 basis settles every issue.

Make retention rules executable

Article 5 includes the storage limitation principle. Set justified retention periods for specific purposes and applicable obligations rather than choosing one period for all company records.

Separate active use, restricted archiving and backup handling. Identify who performs deletion and how exceptions are authorised. Test a record that should have reached the end of its retention period: can staff still find it in exports, shared folders or connected applications?

A deletion procedure should explain what happens when backup data is restored. Otherwise, information removed from live systems may quietly return during recovery.

Give rights requests a reliable route

Under Article 12, organisations must respond without undue delay and normally within one month. An extension of two further months is possible where necessary because of complexity or the number of requests; the individual must be informed within the first month, with reasons.

Create an accessible contact route, assign an owner and track deadlines. Identity checks should be proportionate. Record the reasoning behind a refusal or limitation: for example, a valid erasure request does not automatically override a legal obligation to retain particular records.

Put responsibility ahead of paperwork

Appointing a data protection officer is not mandatory for every organisation. Article 37 defines the circumstances that require one. Assess those conditions and, whether or not a formal DPO is required, make privacy coordination and decision-making explicit.

Article 35 requires an impact assessment for processing likely to result in a high risk to individuals. Record the screening decision rather than assuming either that every application needs a DPIA or that an SME never needs one.

A useful working record brings together:

• the processing purpose and accountable owner;
• access and retention decisions;
• processor contracts and documented instructions;
• control tests and identified weaknesses;
• corrective actions, deadlines and supporting evidence.

This turns GDPR compliance into a repeatable management process instead of a document exercise performed before a customer questionnaire.

Rehearse breach decisions before an incident

Article 33 requires notification to the competent supervisory authority, where feasible within 72 hours of becoming aware of a personal data breach, unless it is unlikely to result in a risk to individuals’ rights and freedoms. Reasons must accompany a late notification. A processor must notify its controller without undue delay.

Article 34 separately addresses communication to affected people without undue delay where a breach is likely to result in a high risk, subject to applicable exceptions. Do not confuse the authority-notification test with the individual-notification test.

Record the facts, effects, response measures and reasoning, including a decision not to notify. Prepare a contact list that works outside normal office hours and make sure somebody can authorise the necessary actions.

A five-step improvement programme

1. Select a meaningful starting point. Choose a processing activity where exposure would have serious consequences for individuals.
2. Compare policy with practice. Walk through the data flow with the staff who actually use the systems, including exports and supplier access.
3. Fix the most consequential gaps. Remove excessive permissions, strengthen authentication and implement justified retention rules.
4. Exercise the workflow. Simulate an access request and a breach assessment using the real contact routes and available staff.
5. Verify completion. Require evidence that each correction works, and repeat the review after significant changes to systems or processing.

Keep the work connected

Domyno combines a SaaS platform with a dedicated human expert: agents prepare work and a human validates it. Its Controls & compliance module supports evidence and action plans, while Third parties & suppliers helps organise supplier oversight. These capabilities support the programme; they do not remove your organisation’s regulatory responsibilities.

To explore a practical workflow for controls, evidence and human validation, request a demo.