Rising Regulatory and Governance Pressure on Data Protection and Cybersecurity

European regulators issued roughly €1.2B in GDPR fines in 2025 and received an average of 443 personal data breach notifications per day, signaling increased enforcement and reporting volume alongside overlapping disclosure regimes such as NIS2 and DORA. Ireland remained a leading enforcement authority, including a €530M fine against TikTok, while large technology firms continued to account for most of the largest penalties; cumulative GDPR penalties since 2018 were reported at €7.1B.

In the U.S., an HHS Office of Inspector General management challenges report highlighted persistent federal healthcare cybersecurity gaps, including inconsistent governance and controls across HHS divisions and heavy dependence on contractors and grantees to implement security measures—conditions that complicate prevention and response as ransomware and other attacks continue to target healthcare. Separately, an academic study on insider risk reported that 58% of surveyed college students in technology-related programs said they would violate HIPAA and disclose patient data for sufficient payment, underscoring the human/insider threat dimension that can drive breach risk and downstream regulatory exposure.