10 years of data protection balance sheet
GDPR remains a burden factor for companies
Ten years after the GDPR came into force, 71% of companies have largely implemented the requirements, according to Bitkom. At the same time, effort, legal uncertainty and complexity are increasing. Many companies see new problems, particularly when using AI.
Ten years after the General Data Protection Regulation (GDPR) came into force, data protection is well established in companies, according to a long-term study by the digital association Bitkom. At the same time, many companies are reporting rising costs and increasing uncertainties in practical implementation.
According to the study report "10 years of the GDPR", only 7% of companies had fully or largely implemented the requirements at the start of 2018. In 2024, this figure was 71%. At the same time, more and more companies see the regulation as a burden on business processes: While 25% stated in 2016 that the GDPR made processes more complicated, this figure had already risen to 81% by 2025.
In 2024, 84% of companies reported an increase in data protection costs since the introduction of the regulation. 97% now rate the effort as high, 44% of them as very high. In addition, 72% of the companies surveyed in 2025 stated that Germany overdoes it when it comes to data protection. In 2020, this figure was still at 40%.
For the study, Bitkom Research has conducted an annual representative survey of companies with at least 20 employees in Germany since 2016. Most recently, 603 companies from various sectors took part. Bitkom President Dr. Ralf Wintergerst said: "Data protection is not a chore, it is a central pillar of the digital world."
Companies see additional challenges, particularly when it comes to the use of artificial intelligence. In 2025, 69% of respondents stated that data protection requirements made it difficult to train AI models with sufficient data. In 2023, only 42% stated this. In addition, 63% believe that data protection regulations could force companies that develop AI out of the EU.
Many companies also report problems with data pools for AI and analysis applications. 59% stated that projects had failed or not even been started due to data protection requirements. In 2020, this figure was still 41%.
The study also cites international data transfers, legal uncertainties and the shortage of data protection specialists as further challenges. For example, 61% of companies transfer personal data to the USA. 71% would like to see political solutions for international data transfers. In addition, 82% see unclear data protection regulations as a major problem. 38% complain about a lack of qualified data protection personnel - the highest value in the time series.
The full study report "10 years of GDPR - An interim assessment of data protection in companies" is available for download below.
You might also be interested in
Statement on the European Data Protection Day
How companies protect digital identities and data
On European Data Protection Day 2026, Christian Kubik, Manager Field Advisory Services Team EMEA at Commvault, explains why digital identities are at the heart of data protection. He shows how companies can prevent cyberattacks, secure data and...
read more...Secure focus on access
To ensure comprehensive safety, holistic safety concepts for safety and industrial security on machines are required. Authorizations and access must be clearly regulated.
read more...Safety in production
A new security router from Weidmüller is now available from Conrad. It offers users greater network security and simple remote maintenance of systems and machines.
read more...How edge computing becomes resilient
Edge computing offers companies many advantages. But what about security? Decentralized data processing can quickly become a gateway for attackers, which is why there is no way around adapted cybersecurity strategies - from prevention to back-up...
read more...A critical look at the last 10 years
Ten years ago, Acatech issued a final declaration with clear implementation recommendations for Industry 4.0. At this year's Hannover Messe, Barbara Frei, Executive Vice President for Industrial Automation at Schneider Electric, took a reflective...
read more...United Robotics at the Automatica
Experience robots in action
At Automatica 2023, the United Robotics Group will be showcasing a broad portfolio of robotics solutions for use in various industrial sectors, relying on the know-how of European robotics experts.
read more...New generation of service robots
From June 27 to 30, the United Robotics Group will be presenting its portfolio of robotics solutions at Automatica and showcasing CobiotX, the latest generation of service robots that are mobile in use.
read more..."A strong signal for the industrial location"
After three years dominated by coronavirus, Hannover Messe 2023 celebrated a successful comeback. The exhibitors from the mechanical and plant engineering sector showed with their technologies how climate change can be combated and intelligent...
read more...Good decisions need good data
We make around 20,000 decisions every day, most of them unconsciously. The situation is similar in industry. Decisions should be based on valid data, as this is the only way to avoid mistakes.
read more...