In addition, 91 reported fines have been imposed since the regulation went into effect last May.

The General Data Protection Regulation (GDPR) officially went into effect across the European Union on May 25, 2018. Since then, more than 59,000 personal breaches have been reported to regulators.

New data breach notification laws have “fundamentally changed” the risk profile of businesses hit with data breaches, reports global law firm DLA Piper. Breaches likely to cause harm to individuals affected must be reported. Failure to comply can cost fines up to €10 million ($11.4 million) or up to 2% of the firm’s global annual turnover for the previous financial year – whichever is higher.

In the eight months since GDPR has been applied, 91 reported fines have been imposed. Not all were for personal data breaches. The highest to date was a €50 million ($57 million) fine imposed on Google related to processing personal data for advertising without valid authorization. A German company was fined €20,000 ($22,810) for failing to hash employee passwords, which led to a security breach.

The Netherlands reported the most data breaches (15,400 incidents), followed by Germany (12,600) and the United Kingdom (10,600). Those with the lowest number of breaches reported include Lichtenstein (15), Iceland (25), and Cyprus (35). Cyberattacks reported under GDPR range from minor security breaches to major, publicized hacks affecting millions of individuals.