GDPR Fines Are Up 168%. Is Your Vendor Stack Your Biggest Liability?

By early 2025, GDPR fines have reached a staggering €5.65 billion – up €1.17 billion from the previous year. European regulators are no longer sending warning letters – they're writing record-breaking checks with lots of zeros.

But here's what should really concern Legal and GRC teams: 30% of data breaches now involve third-party vendors, and third-party breaches doubled in the past year according to the Verizon 2025 DBIR. Your organization could be doing everything right internally, and still face a seven-figure fine because a vendor you trusted made a mistake.

The Enforcement Reality Has Changed

For years, GDPR enforcement felt like a distant threat. Regulators focused on the biggest players – Meta, Google, Amazon. Small and mid-sized companies could reasonably assume they weren't on the radar.

That assumption is now dangerous.

Through early 2025, we're seeing:

• 2,245+ enforcement cases tracked across EU member states
• €2.36 million average fine per case – regulators aren't issuing warnings
• Spain leads with 932 fines by volume, but Ireland imposed 8 of the top 10 largest penalties
• Third-party breaches doubled – vendor-related violations are now a primary enforcement focus
• Faster investigations – average time from breach report to fine continues to shrink

The message is clear: GDPR is no longer a paper tiger. It's a regulatory reality with real consequences.

The Vendor Liability Gap

Here's the uncomfortable truth that many Legal teams haven't fully internalized: you are liable for your vendors' data protection failures.

Under GDPR, when you share personal data with a vendor (which nearly every company does), you don't transfer liability – you share it. If that vendor suffers a breach, fails to implement adequate security, or processes data outside the agreed terms, regulators can come after you.

What GDPR Article 28 Actually Requires

GDPR Article 28 sets out specific requirements for using data processors (vendors):

1. Due diligence before engagement – You must verify the processor provides "sufficient guarantees" of GDPR compliance
2. Written contract with specific terms – Not just any contract, but one covering the specific Article 28 requirements
3. Ongoing monitoring – You can't just do due diligence once and forget about it
4. Audit rights – You must have the right to audit your processors

In practice, most organizations fail at #3 – ongoing monitoring. They conduct vendor security assessments at procurement time, file them away, and never revisit them. Meanwhile, the vendor's security posture can change dramatically.

Real-World Vendor-Related GDPR Fines

These aren't hypotheticals. Real organizations have faced real fines because of vendor failures:

Marriott International – €20.4 million (2020)
Marriott was fined partly because Starwood (acquired in 2016) had suffered a breach. The ICO specifically cited inadequate due diligence during the M&A process and failure to assess Starwood's systems.

British Airways – €22 million (2020)
A third-party JavaScript vulnerability on BA's website led to 380,000 customer card details being compromised. The fine was reduced from an initial £183 million, but still represented a massive vendor-related liability.

Fashion ID – €300K+ (2019)
A German fashion retailer was held jointly liable with Facebook for embedding Facebook's "Like" button. The Court of Justice ruled that Fashion ID was a joint controller simply by embedding a third-party tracking widget.

Recent 2025 Enforcement

LastPass UK Ltd – €1.4 million (November 2025)
The UK ICO fined LastPass after a successful cyber attack exploited insufficient security measures – a stark reminder that even security-focused vendors can fail, exposing organizations that rely on them.

TikTok – €530 million (May 2025)
Ireland's DPC fined TikTok for illegal data transfers to China, highlighting the regulatory focus on cross-border data flows with third-party platforms.

LinkedIn – €310 million (October 2024)
Penalized for insufficient legal basis for data processing, demonstrating that even major, well-resourced vendors face significant enforcement.

The Static Assessment Problem

Most organizations still approach vendor risk management with a fundamentally broken model: annual questionnaires.

Here's why that doesn't work:

• Point-in-time snapshots – A vendor's security posture on January 15th tells you nothing about July 15th
• Self-reported data – Vendors complete their own questionnaires, creating obvious conflicts of interest
• Questionnaire fatigue – Vendors receive hundreds of questionnaires; responses become copy-paste exercises
• No verification – Few organizations actually verify the claims vendors make

Consider this scenario: Your legal team approves a SaaS vendor after they complete a 200-question security questionnaire. Six months later, that vendor quietly changes their data processing practices, moves data to a new sub-processor in a non-EU country, or suffers a breach they don't disclose.

Your annual questionnaire won't catch any of this. But when regulators come calling, your organization is still liable.

What Legal and GRC Teams Actually Need

Protecting your organization from vendor-related GDPR liability requires a fundamental shift in approach:

1. Continuous Monitoring Over Annual Review

Vendor risk isn't static. Your monitoring shouldn't be either. You need visibility into changes in vendor security posture, privacy policies, data processing practices, and sub-processor relationships on an ongoing basis.

2. Evidence Over Assertions

Self-reported questionnaire responses are assertions. What you need is evidence – actual analysis of vendor privacy policies, security certifications, breach history, and public posture.

3. Automated Compliance Checks

With hundreds of vendors in a typical enterprise stack, manual review isn't scalable. You need automated systems that can flag potential GDPR risks – like vendors without proper SCCs, inadequate DPAs, or problematic sub-processor chains.

4. Proportionate Response

Not every vendor needs the same level of scrutiny. A vendor processing millions of customer records needs deeper assessment than one that never touches personal data. Your risk management approach should scale with actual risk.

Action Checklist for Legal and GRC Teams

Here's what you can do today to reduce your vendor-related GDPR exposure:

Immediate Actions (This Week)

• ☐ Inventory all vendors with access to EU personal data
• ☐ Identify vendors without signed DPAs (Data Processing Agreements)
• ☐ Flag any vendors with data transfers outside the EU
• ☐ Review sub-processor lists from your top 10 vendors

Short-Term Actions (This Month)

• ☐ Update DPAs to include current SCC requirements
• ☐ Establish a process for vendor breach notification tracking
• ☐ Create a vendor privacy policy monitoring cadence
• ☐ Document your vendor due diligence process (you'll need this if regulators ask)

Strategic Actions (This Quarter)

• ☐ Implement continuous vendor monitoring (not just annual reviews)
• ☐ Develop a vendor risk scoring methodology proportionate to data access
• ☐ Create automated alerts for vendor policy or certification changes
• ☐ Build a rapid vendor assessment process for new procurement

The Bottom Line

GDPR enforcement has entered a new phase. Regulators are more aggressive, fines are larger, and vendor-related violations are firmly in their crosshairs.

The organizations that will avoid seven-figure fines are those that treat vendor risk management as a continuous, evidence-based discipline – not an annual checkbox exercise.

The €5.65 billion in cumulative GDPR fines isn't just a statistic. With enforcement cases now exceeding 2,200 and regulators coordinating across borders, the question is whether your vendor risk management approach will change before or after a regulator makes it change for you.

"The biggest GDPR risk most organizations face isn't their own systems – it's the vendors they've trusted with their data."

– Security Director, Fortune 500 Financial Services Company

📊 GDPR Enforcement Resources

For GRC, Legal, and IT teams monitoring GDPR enforcement trends, these authoritative sources provide essential data and guidance: