The General Data Protection Regulation (GDPR) has now been in force for roughly a decade, and a recent Compliance Week analysis revisits a question that has followed the law since its debut: does GDPR enforcement actually work the same way everywhere it applies? According to the report, the answer is still no. Ten years in, differences in how individual EU countries police and penalize privacy violations remain a persistent problem, one that has real consequences for the people the law is supposed to protect.

A Decade of GDPR: One Law, 27 Different Enforcers

GDPR was designed as a single, harmonized rulebook covering every EU member state, but it was never enforced by a single, centralized regulator. Instead, each country maintains its own national Data Protection Authority (DPA), responsible for investigating complaints, auditing companies, and issuing fines within its borders. For cases that cross national lines, such as a multinational tech company operating across the bloc, a "lead authority" is typically designated, with coordination handled through the European Data Protection Board.

On paper, this structure allows for local expertise and accessibility, giving residents of each country a regulator that speaks their language and understands their national legal context. In practice, as the Compliance Week analysis reiterates, this decentralized model has produced uneven results. Some DPAs are better funded, more assertive, and quicker to act than others. That unevenness means the strength of your GDPR protections can depend, at least in part, on where a company handling your data happens to be headquartered or where you happen to live.

This isn't a new criticism. Privacy advocates and legal scholars have raised it repeatedly over the years, and the fact that it's still being highlighted a decade after the law took effect suggests it hasn't been fully resolved. A regulation is only as strong as its enforcement, and when enforcement varies significantly from one member state to another, the promise of equal protection across the EU becomes harder to guarantee in practice.

Why Enforcement Gaps Matter for Everyday Users

Inconsistent enforcement isn't just an abstract compliance issue for corporate legal teams. It has practical implications the moment something goes wrong. Consider what happens after a data breach: a company is legally required to notify affected individuals and regulators, but how quickly and thoroughly that notification is followed up on, and whether the responsible DPA pursues meaningful accountability, can differ sharply depending on which country is handling the case.

A recent example illustrates the stakes involved when protections fail. Reporting on the Stormous ransomware attack on a Dutch church network showed how quickly sensitive personal data, in that case tied to a religious organization operating in the Netherlands, can end up exposed once attackers breach a network. Incidents like this underscore why consistent, well-resourced enforcement matters: when a breach occurs, the strength and speed of the regulatory response often determines whether victims get real answers, whether affected organizations improve their security posture, and whether future incidents are deterred at all.

When enforcement is strong, breaches trigger investigations, fines, and public accountability that push organizations toward better data practices. When enforcement lags, whether due to under-resourced regulators, backlogs, or differing national priorities, the deterrent effect weakens, and individuals are left more exposed the next time something goes wrong.

What This Means For You

If you live or do business in the EU, GDPR still gives you meaningful rights: the ability to request access to your data, ask for its deletion, and demand transparency about how it's used. But the report's core finding is a useful reminder that these rights aren't enforced with perfect uniformity, so it pays to be proactive rather than assuming the system will always catch problems for you.

A few practical steps can help close the gap between the protections written into law and the protections you actually experience day to day:

  • Exercise your GDPR rights directly with companies rather than waiting for regulators to act on your behalf.
  • Pay attention to breach notifications and follow up on them, since not every DPA response will be equally fast or thorough.
  • Use strong, unique passwords and enable two-factor authentication, since technical safeguards don't depend on which country's regulator is involved.
  • Consider privacy tools like a VPN or encrypted communications when handling sensitive information, particularly if you're uncertain how rigorously your data will be protected downstream.

The Bottom Line

Ten years after GDPR became law, the framework has undeniably raised the baseline for data protection across Europe and influenced privacy regulation well beyond the EU's borders. But the Compliance Week analysis is a timely reminder that a law is only as effective as its weakest enforcement link. Until enforcement across member states becomes more consistent, individuals will continue to benefit unevenly from the protections GDPR was designed to guarantee. The most reliable path forward, for now, is to combine awareness of your legal rights with sensible personal security habits, rather than relying solely on regulators to close the gap.