European Union：数据保护法、网络犯罪、罚款与刑罚
The GDPR is the world's most enforced regime: €7.1bn in fines since 2018 (DLA Piper). NIS2, DORA, the AI Act and the Cyber Resilience Act add cyber and AI duties.
- Law
- GDPR (Regulation 2016/679)
- Authority
- National data protection authorities + EDPB
- Max fine
- €20M or 4% of global turnover
- Breach notification
- GDPR: 72h; NIS2: 24h early warning, 72h notification, final report in 1 month
- DPO
- Mandatory in art. 37 cases
Crimes
| Illegal access to systems (minimum harmonization) | Directive 2013/40/EU | Maximum penalty of at least 2 years; 5 years with botnets or attacks on critical infrastructure |
Risks
- International transfers (Meta €1.2bn, TikTok €530M, Uber €290M)
- Cookies and adtech (CNIL: Google €325M, SHEIN €150M)
- Children's data (Instagram €405M, TikTok €345M)
- Post-breach security (Free €42M, Vodafone €45M)
- Personal management liability under NIS2
- NIS2 (Dir. 2022/2555): transposition by 17 Oct 2024; fines of €10M or 2% (essential) and €7M or 1.4% (important)
- DORA (Reg. 2022/2554): applies to the financial sector since 17 Jan 2025
- AI Act (Reg. 2024/1689): fines up to €35M or 7%; high-risk duties 2 Aug 2026 and 2 Aug 2027, subject to the Digital Omnibus
- Cyber Resilience Act (Reg. 2024/2847): vulnerability reporting from 11 Sep 2026, full application 11 Dec 2027; fines up to €15M or 2.5%
- 443 breach notifications per day in 2025 (+22%), per DLA Piper
- Amazon's €746M fine (Luxembourg) annulled by the courts on 12 Mar 2026
来源: EUR-Lex – GDPR · DLA Piper – GDPR Fines Survey 2026 · CMS Enforcement Tracker · EUR-Lex – NIS2 · EUR-Lex – AI Act