10 Years of the GDPR – An Interim Assessment of Data Protection in Companies

Ten years after the General Data Protection Regulation (GDPR) came into force, data protection has become firmly embedded in the day-to-day organisational practices of companies. At the same time, the associated costs, legal uncertainty and regulatory requirements remain high for many businesses. In particular, digitalisation, international data transfers and artificial intelligence are increasingly putting data-driven innovation under pressure. This report analyses key developments relating to the GDPR from a business perspective and examines how data protection practices and challenges have evolved between 2016 and 2025. It is based on representative surveys of companies conducted by Bitkom Research among businesses with 20 or more employees in Germany.

You can download the full report here in German.