Suppose a person based in UK has started a one-man business online, for example, a web blog where people can read articles and post comments. Now, the business owner is focused on testing out the business idea, and does not have money to hire a legal consultant just yet. So there are a few GDPR violations on the web blog that don't seem that obvious (or serious) to the naked eye, for example:

  • Visitors are not asked to consent to using cookies
  • The blog uses a web analytics plugin, that sends customer's IP addresses and locations to a 3rd-party company outside of UK/EU, and the business owner does not sign any additional agreements with the 3rd party
  • The website has a very short and generic Terms of Service page that are just copied over from another similar website, and are not using contractual language
  • Visitors are allowed to upload images to the web server when they write comments, but are not asked/warned to avoid uploading any illegal/copyrighted content

Now, the business owner has no malicious intent to steal people's data, etc, and there have been no security breaches where hackers could gain access to the data. And there are not many users of the web blog anyway (let's say ~500 people who registered their names and email addresses in the system).

However, it is clear that quite a few GDPR rules are violated here. Of course, in theory, the business owner could face lawsuits, but has this ever happened in practice for violations that are similar to the ones described above? How likely it is that if these violations are detected, the owned is just kindly asked to fix them before any fines/lawsuits follow? What aspects usually affect the likelihood of this?

1 Answer 1


Such as violator could be subject to a fine, not just to a lawsuit. That is if action is taken by the national Data Protection Authority (DPA).

My understanding is that DPAs mostly concentrate on large businesses and organizations. But it seems that there have been some actions involvign smaller offenders. The GDPR Enforcement Tracker lists enforcement actions.

Listed actions include:

ID Date Type Fine Amt (Euros) Provision(s)
ETid-1550 2022-12-28 Private individual 600 Art Art. 5 (1) c); Art 13
ETid-1545 2023-01-03 HOA 500 Art. 5 (1) e)
ETid-1536 2022-12-20 Private individual 3000 Art. 6 (1)
ETid-1534 2022-12-20 Private individual 1000 Art. 5 (1) c)

These are just a few recent instances in which individuals or small organizations are shown as having been fined. They show that such consequences do happen in at least some such cases.

  • "not just a lawsuit" is wrong - the GDPR does not give a private individual a right to sue, just like I can't sue my neighbour if he doesn't keep his garden in line with council rules.
    – Dale M
    Jan 12, 2023 at 0:58
  • @Dale I was under the impression that national laws in some countries have now granted a right of priovate action. That would be a good separate question i think. Jan 12, 2023 at 1:01
  • @DaleM Affected data subjects have the “right to an effective legal remedy against a controller or processor” per Art 79 GDPR. They can sue for compliance and damages, but not for punitive fines (only the data protection authorities can do that). An example from the UK is the 2021 Fairhurst v Woodard case regarding CCTV use by neighbors (judgment). Competitors don't have standing to sue though.
    – amon
    Jan 12, 2023 at 11:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .