Misconception: GDPR Is a Passing Trend That Will Blow Over

The misconception

“GDPR is just another regulation that will be watered down or forgotten. If I wait long enough, the whole thing will blow over.”

We’ve heard this since 2018. And every year, the opposite happens: enforcement gets stricter, fines get higher, and more countries introduce their own versions of GDPR.

GDPR is not going away

The GDPR is a European regulation, not a directive. That means it has direct effect in all EU member states without needing national implementation. It cannot be weakened by individual countries, and amending it requires consensus among all 27 member states.

There is zero political appetite to weaken privacy protection. If anything, the direction is towards more regulation:

• The AI Act (2024) adds strict rules for artificial intelligence and automated decision-making
• The Digital Services Act imposes new obligations on online platforms
• The Data Act regulates access to and use of data generated by connected products
• The ePrivacy Regulation (in progress) will replace the current cookie directive with stricter rules

Enforcement is accelerating

The numbers tell the story:

• 2019: approximately $400 million in total GDPR fines across Europe
• 2020: $300 million
• 2021: $1.3 billion
• 2022: $2.9 billion (cumulatively)
• 2023: $4.2 billion (cumulatively), including Meta’s record $1.2 billion fine

The trend is clear and irreversible. Supervisory authorities are getting more budget, more staff, and more experience. The initial “grace period” where authorities were lenient is long over.

The world is following Europe’s lead

GDPR is not a European quirk. It has become the global template for privacy legislation:

• Brazil: LGPD (in effect since 2020)
• California: CCPA/CPRA (in effect, with more states following)
• Canada: renewed privacy law (in progress)
• India: Digital Personal Data Protection Act (2023)
• Japan, South Korea, Australia: comparable frameworks
• Africa: Kenya, South Africa, Nigeria have introduced privacy laws

More than 150 countries now have some form of data protection legislation. The direction is global convergence towards GDPR-like standards.

The cost of waiting

Every year you wait, the gap between where you are and where you need to be grows wider:

• More data accumulates without proper documentation
• New tools and services are added without processing agreements
• Employee turnover means nobody knows what data is where
• The risk of a complaint grows as consumers become more privacy-aware

Getting compliant today costs less than getting compliant next year, because there’s less to clean up.

What should you do?

Accept that GDPR is a permanent fixture of the business landscape, just like tax obligations and employment law. The sooner you treat it as business-as-usual rather than a temporary inconvenience, the less it costs and the more benefit you get from it.