GDPR Enforcement: €7.4 Billion Cumulative and H1 2026 Running at €600M+ — Data Transfer Liability Remains the Dominant Risk

Cumulative GDPR enforcement has now exceeded €7.4 billion since May 2018, with H1 2026 estimated at €600 million and 2025 full-year enforcement at approximately €1.15–1.2 billion. The intersection with the EU AI Act's August 2 enforcement date creates a compounding liability environment: the same data flows and AI system deployments that create EU AI Act Article 50 obligations also create GDPR exposure for insufficient legal basis, unlawful data transfers, and inadequate accountability documentation. The dominant enforcement pattern remains insufficient legal basis (the most frequent violation) and unlawful transfers of data to the United States — Meta's €1.2 billion fine (May 2023, under appeal) remains the benchmark but enforcement at lower tiers has continued consistently. For law firms advising multinational clients on transatlantic data strategy, the GDPR-AI Act overlap is now the primary compliance pairing of the year: the legal basis for AI system data processing must be documented in parallel with AI Act transparency obligation compliance, and the combination of a GDPR investigation and an Article 50 enforcement action against the same AI deployment would produce compounded regulatory exposure that neither compliance programme alone is designed to address.