Enforcement activity by data protection authorities across Central and Eastern Europe has matured markedly. Aggregate fines in the region have tripled over five years, with employee monitoring and marketing consent the most common triggers.
Where regulators are looking
Cross-border cooperation under the one-stop-shop mechanism now moves faster, and voluntary breach notifications are increasingly followed by full audits. Controllers should treat every notification as the start of a supervisory relationship, not the end of an incident.
Our review of published decisions shows that documented accountability — records of processing, DPIAs, and vendor audits — remains the strongest mitigating factor in fine calculations.
← All Insights