Data Protection Compliance Is Not Just For Big Tech

When we think about data protection and GDPR compliance, it's easy to focus on Big Tech giants like Google and Meta. However, the GDPR applies to all organisations, regardless of size or industry. Businesses across sectors – from healthcare providers to energy firms – are increasingly subject to investigations and penalties. Here, we explore five recent cases where companies outside of Big Tech were fined for breaches of GDPR, showing that no one is immune from investigations and fines.

Healthcare Software Provider – France (€800,000 Fine)

• Subject Matter: A healthcare software provider was fined for mishandling sensitive patient data.
• What Went Wrong: The company extracted pseudonymised patient data from doctors' software to perform research studies without obtaining the necessary legal consent or authorisation. Additionally, the pseudonymisation was weak, allowing re-identification of individuals, which exposed personal health information. The company