GDPR enforcement commentary keeps returning to three articles: Article 5 (processing principles), Article 6 (lawful basis) and Article 32 (security of processing). Audits also test records of processing and breach handling. The rankings come from law firm analyses, not an official EDPB tally, so treat them as direction, not statistics.
How reliable is "most common"?
We could not find an official EDPB or regulator league table of infringements. Search results lean on secondary analysis. An American Bar Association review of the first year of enforcement counted Article 5 most often, roughly 30 citations across 91 fines, with Article 6 next. Later commentary points to many fines citing Article 32 in breach cases. These counts cover different periods and methods.
So the useful reading is this: principles, lawful basis and security are where regulators spend their time. The sections below are about the evidence for each.
What do auditors test under Article 32?
Article 32(1) lists examples of appropriate measures: pseudonymisation and encryption, ongoing confidentiality, integrity, availability and resilience, the ability to restore access to personal data in good time, and "a process for regularly testing, assessing and evaluating the effectiveness" of the measures.
That last item is the one that catches teams. A policy says encryption is on. The audit asks when someone last checked. For software you build or buy, that includes how you learn about vulnerable components. A dependency inventory and a dated scan history are concrete answers. A statement that "we patch regularly" is not.
Article 32(2) tells you to weigh risks such as accidental or unlawful destruction, loss, alteration and unauthorised disclosure. Keep the risk assessment that shows you did.
What about records of processing?
Article 30(1) requires records covering purposes, categories of data subjects and data, recipients, transfers, planned erasure time limits where possible, and a general description of Article 32 security measures where possible.
Smaller organisations often assume they are exempt. Article 30(5) exempts organisations with fewer than 250 people, but not if processing is likely to risk data subjects' rights, is not occasional, or includes special category or criminal conviction data.
Is breach handling a common gap?
Article 33(1) asks controllers to notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to risk people's rights and freedoms. A late notice must explain the delay. Processors must tell the controller without undue delay under 33(2).
Article 33(5) is the quiet one: you must document every breach, including those you decide not to report. An auditor can ask to see the log of non-reportable incidents and the reasoning.
How big can the fines be?
Under Article 83(4), infringements of controller and processor duties in Articles 25 to 39, which include Articles 30, 32 and 33, can reach EUR 10 million or 2 percent of worldwide annual turnover, whichever is higher. Under Article 83(5), breaches of Articles 5, 6 and 9 and data subject rights can reach EUR 20 million or 4 percent.
What to do
- Write down the lawful basis for each processing activity and link it to the record of processing.
- Check Article 30 records for the details above, and confirm whether the 250 person exemption really applies to you.
- Keep evidence that security measures are tested: dated scans, access reviews, restore tests.
- Keep a software inventory so you can say which systems hold personal data and which components they use.
- Rehearse the 72 hour breach clock, including who confirms awareness.
- Log every breach and near miss with the decision on notification.
- Review processor contracts and what each processor reported back.
Where does Safeguard help?
Safeguard does not certify GDPR compliance. Its docs list GDPR, GDPR Article 25 and UK GDPR framework pages, each covering what a scan checks, its controls, policy templates and automated tests. Use that for technical evidence, such as inventory and vulnerability history. Lawful basis, notices and breach decisions are your own work.
Quick check
Which GDPR article is cited most in fines?
It depends on the source and period. An early enforcement review counted Article 5 most often, while later commentary stresses Article 32 in breach cases. No official ranking was found.
Do I need to log a breach I do not report?
Yes. Article 33(5) requires documenting any personal data breach, including the facts, so the authority can verify compliance.
Sources
- GDPR Article 32, Article 33, Article 30 and Article 83, fetched 18 October 2026
- American Bar Association, emerging trends in the first year of EU GDPR enforcement, seen in search results on 18 October 2026
- Safeguard compliance frameworks docs, fetched 18 October 2026
Last reviewed: 18 October 2026.
