Most privacy fines punish organisations that cannot show where personal data is, why they hold it, or what happens when someone asks about it. This list covers the ten mistakes we see most often under the GDPR, UK GDPR, ePrivacy rules and the CCPA, with a confirmed regulator decision where one exists, and the first fix. It is for the security, privacy and engineering teams who run the controls behind a privacy programme.
The Top 10 at a glance
- No data inventory or record of processing
- The wrong lawful basis, or consent for everything
- Cookies and trackers that fire before consent
- Privacy notices out of sync with practice
- Missed data subject request deadlines
- Breach notification clocks nobody can meet
- Processors without proper contracts
- International transfers without a transfer assessment
- Retention periods written but never enforced
- DPIAs skipped for high-risk processing and AI
| # | Mistake | First fix |
|---|---|---|
| 1 | No inventory or RoPA | Build the RoPA from real systems |
| 2 | Wrong lawful basis | One documented basis per purpose before go-live |
| 3 | Cookies before consent | Gate every non-essential tag on the consent signal |
| 4 | Notices out of sync | Notice review inside change management |
| 5 | Missed request deadlines | One tracked intake with a running clock |
| 6 | Breach clocks missed | Privacy decision step in the incident playbook |
| 7 | Processors without contracts | No data shared before Article 28 terms |
| 8 | Transfers without assessment | Map transfers; document tool and assessment |
| 9 | Retention never enforced | Automated deletion with evidence |
| 10 | DPIAs skipped | DPIA as a gate in project and AI intake |
1. No data inventory or record of processing
The mistake: the record of processing activities (RoPA) is a spreadsheet written once from interviews, while real data sits in SaaS tenants, backups and test environments nobody listed.
Why it matters: GDPR Article 30 requires the record, and requests, retention and transfers all depend on it. The Article 30(5) exemption for organisations under 250 employees does not apply where processing is more than occasional, risky or includes special category data, so payroll alone usually rules it out.
The fix: build the inventory from systems as well as people: data discovery scans, cloud asset inventories and the identity provider's application catalogue, where SSO apps and OAuth grants show where personal data flows. Record purpose, categories, recipients, transfers and retention per activity. See the Data Mapping and ROPA Guide.
2. The wrong lawful basis, or consent for everything
The mistake: picking a lawful basis after the fact, relying on "contract" for processing the service does not need, or asking for consent where people have no real choice, such as employees.
Why it matters: each Article 6 basis brings different rights and limits, and Article 7(3) requires withdrawing consent to be as easy as giving it. In January 2023 the Irish Data Protection Commission (DPC) fined Meta Ireland EUR 210 million for Facebook and EUR 180 million for Instagram after the EDPB determined Meta was "not entitled to rely on the 'contract' legal basis" for behavioural advertising.
The fix: record one basis per purpose in the RoPA before go-live, run a legitimate interests assessment for Article 6(1)(f), and use consent only where refusal has no detriment. See the GDPR Compliance Guide for Security Teams.
3. Cookies and trackers that fire before consent
The mistake: a banner that looks right while advertising and analytics tags load on the first page view, or keep loading after "Reject all".
Why it matters: Article 5(3) of the ePrivacy Directive (in the UK, PECR regulation 6) requires consent before storing or reading non-essential cookies; the ICO says consent must be "more than simply continuing to use the website". In September 2025 the CNIL fined SHEIN's European operator EUR 150 million (SAN-2025-005) because advertising cookies were placed "as soon as they arrived on the site" and, after refusal, "new cookies were still placed and others, already present, continued to be read".
The fix: wire every non-essential tag to the consent platform's signal, honour Global Privacy Control where US state laws require it, and test refusal and withdrawal with a crawler that records cookies and network calls. See the Consent Management Guide: Cookies, CMPs and GPC.
4. Privacy notices out of sync with practice
The mistake: the notice was drafted at launch; since then the product added sharing, vendors and AI features.
Why it matters: GDPR Articles 12 to 14 require clear information on purposes, recipients, retention and rights. The DPC fined WhatsApp EUR 225 million in September 2021 over transparency to users and non-users, including processing shared with other Facebook companies. California's Attorney General settled with Sephora for USD 1.2 million in August 2022, alleging it did not tell consumers it was selling their personal information or process Global Privacy Control opt-outs.
The fix: ask "does this change the notice?" in every change and vendor onboarding, and compare the notice with the RoPA twice a year. See the Privacy Programme Guide for Security Teams.
5. Missed data subject request deadlines
The mistake: requests arrive through email, chat and support tickets with no single queue, no clock and no way to search every system.
Why it matters: GDPR Article 12(3) allows one month, extendable by two further months for complex or numerous requests; the CCPA allows 45 days plus one 45-day extension. In August 2024 the ICO reprimanded the Labour Party: about 78% of 352 outstanding access requests had missed the three-month maximum, and an inbox unmonitored since November 2021 held about 646 more access and 597 deletion requests.
The fix: monitor every published channel, log each request in a workflow that starts the clock on receipt, verify identity in proportion to sensitivity, and keep search runbooks for each RoPA system, including identity stores and logs. See the DSAR Guide: Handling Data Subject Requests.
6. Breach notification clocks nobody can meet
The mistake: the incident plan is built for containment, and privacy hears about the breach after the notification window has closed.
Why it matters: Article 33(1) requires notifying the regulator within 72 hours of becoming aware unless the breach is unlikely to result in a risk, Article 34 requires telling individuals when risk is high, and Article 33(5) requires documenting every breach. The DPC fined Twitter EUR 450,000 in December 2020 for "a failure to notify the breach on time" and "a failure to adequately document the breach". Other clocks run alongside: NIS2 has a 24-hour early warning, and US listed companies file Form 8-K Item 1.05 within four business days of deciding an incident is material.
The fix: add a privacy decision step in the first hours of the playbook, define when "aware" starts, keep a breach register with the risk reasoning, and notify in phases as Article 33(4) allows. See the Incident Response Guide.
7. Processors without proper contracts
The mistake: teams adopt SaaS tools and AI APIs on click-through terms with no data processing agreement.
Why it matters: Article 28(3) requires a contract limiting the processor to documented instructions and covering confidentiality, Article 32 security, sub-processor approval, help with requests and breaches, deletion or return at the end, and audits. The Sephora settlement also required CCPA-compliant service provider agreements.
The fix: make a signed agreement a precondition in procurement, keep a processor register linked to the RoPA, and revoke vendor API keys, OAuth grants and accounts when contracts end. See the Third-Party Access Guide.
8. International transfers without a transfer assessment
The mistake: standard contractual clauses (SCCs) are signed and filed, but nobody has assessed whether the importer's local law lets it honour them, or mapped remote support access from abroad.
Why it matters: GDPR Articles 44 to 46 allow transfers only on an adequacy decision or a safeguard such as SCCs, and since Schrems II the safeguard must work in practice. In May 2023 the DPC fined Meta Ireland EUR 1.2 billion, finding that SCCs plus supplementary measures "did not address the risks to the fundamental rights and freedoms of data subjects", and ordered future US transfers suspended within five months.
The fix: list every transfer, including sub-processors and follow-the-sun support, with its tool: adequacy (for the US, only organisations certified under the EU-US Data Privacy Framework), the 2021 SCCs, or for UK exports the IDTA or UK Addendum. Document a transfer impact assessment and supplementary measures. See the Global Privacy Regulatory Map.
9. Retention periods written but never enforced
The mistake: the schedule says seven years, but nothing is deleted, and copies persist in backups, logs, exports and AI training sets.
Why it matters: storage limitation (Article 5(1)(e)) and erasure (Article 17) apply to every copy. In May 2023 the FTC and DOJ charged Amazon with keeping children's Alexa voice recordings indefinitely and failing to delete transcripts "from all its databases", with a proposed USD 25 million civil penalty. The FTC said "COPPA does not allow companies to keep children's data forever for any reason, and certainly not to train their algorithms."
The fix: attach a retention rule to each RoPA entry, implement it as scheduled deletion jobs or storage lifecycle policies, let backups expire rather than editing them, and keep evidence that jobs ran. See the Data Classification Guide and the Log Management and Retention Guide.
10. DPIAs skipped for high-risk processing and AI
The mistake: a DPIA is written after launch, or never, for biometrics, employee monitoring, profiling or a new AI feature.
Why it matters: Article 35 requires a DPIA before processing likely to result in high risk, and mandates one for systematic automated evaluation with significant effects, large-scale special category data and large-scale public monitoring. The ICO's high-risk list names innovative technology, including "artificial intelligence, machine learning and deep learning", alongside biometrics and tracking. Article 36 requires prior consultation where high risk remains, and Article 27 of the EU AI Act adds a fundamental rights impact assessment for some deployers of high-risk AI systems.
The fix: add a screening question to project intake and AI use-case approval, finish the DPIA before design is fixed, and record residual risk sign-off. See the DPIA Guide: Running a Data Protection Impact Assessment and the AI and Privacy Guide.
Mapping to OWASP
The OWASP Top 10 Privacy Risks (version 2.0) cover the same ground from the application side; P1 and P8 are security risks, so they are omitted.
| Mistake | OWASP Top 10 Privacy Risks | Main legal reference |
|---|---|---|
| 1. No inventory or RoPA | P10 (indirect) | GDPR Art. 30 |
| 2. Wrong lawful basis | P4 Consent on Everything; P10 Collection of Data Not Required for the User-Consented Purpose | GDPR Art. 6, 7 |
| 3. Cookies before consent | P4 Consent on Everything | ePrivacy Art. 5(3); PECR reg. 6 |
| 4. Notices out of sync | P5 Non-transparent Policies, Terms and Conditions | GDPR Art. 12 to 14 |
| 5. Missed request deadlines | P9 Inability of Users to Access and Modify Data | GDPR Art. 12(3), 15 to 22 |
| 6. Breach clocks missed | P3 Insufficient Data Breach Response | GDPR Art. 33, 34 |
| 7. Processors without contracts | P2 Operator-sided Data Leakage | GDPR Art. 28 |
| 8. Transfers without assessment | No direct equivalent (P2 nearest) | GDPR Art. 44 to 46 |
| 9. Retention never enforced | P6 Insufficient Deletion of User Data | GDPR Art. 5(1)(e), 17 |
| 10. DPIAs skipped | P7 Insufficient Data Quality; P10 (indirect) | GDPR Art. 35, 36 |
Where to start
If you can do only three things this quarter: build a system-based inventory (mistake 1); put one tracked intake in front of requests and audit every published contact address (mistake 5); and crawl your main sites to prove nothing non-essential loads before consent or after refusal (mistake 3). Track monthly: requests completed on time (target 100%), tags firing before consent (target zero), processors with Article 28 terms, RoPA entries with automated retention, and breach decisions documented inside 72 hours.
Primary sources: the GDPR, the OWASP Top 10 Privacy Risks, ICO guidance on DPIAs and cookies, the ICO Labour Party reprimand, the CNIL SHEIN decision, DPC decisions on Meta transfers, Meta's lawful basis, WhatsApp and Twitter, the FTC Amazon Alexa action and the California AG's Sephora settlement.
Related NHI Mgmt Group resources: GDPR Compliance Guide for Security Teams · Privacy Programme Guide for Security Teams · Global Privacy Regulatory Map · Identity Data Privacy and Consent Guide. This guide summarises common GDPR, UK GDPR, ePrivacy and CCPA compliance failures and regulator decisions, and is not legal advice.