Restaurant Fined €25,000 for GDPR Violations: Missing DPO and Inadequate Privacy Notices
A restaurant operator was fined €25,000 after regulators found its website privacy notice was too vague to satisfy Article 13 GDPR transparency requirements, and the business had failed to appoint a mandatory Data Protection Officer under Article 37(1)(b). The organisation's large-scale processing of customer data — spanning online ordering, marketing, and loyalty programs — triggered the DPO requirement, which the controller apparently overlooked or misunderstood. This case illustrates that even non-tech businesses handling customer data at scale are subject to significant GDPR obligations. The High Court's decision to uphold both fines reinforces that regulators and courts will not accept ignorance of compliance duties as a defence.
Tactical Insight
Immediate actions
- Conduct a GDPR scoping assessment to determine whether your data processing activities trigger a mandatory DPO appointment under Article 37.
- Review and rewrite all public-facing privacy notices to ensure they meet the specific transparency requirements of Article 13, including lawful basis, retention periods, and data subject rights.
- Appoint a qualified DPO (internal or external) immediately if large-scale processing of personal data is confirmed.
Long-term improvements
- Establish an annual GDPR compliance review cycle covering privacy notices, data processing inventories, and role obligations.
- Maintain a formal Record of Processing Activities (RoPA) under Article 30 to provide ongoing visibility of data flows and help identify regulatory triggers.
- Embed GDPR training into onboarding and annual refresher programmes for all staff who handle customer data.
Governance & oversight
- Assign clear accountability for data protection compliance to a named senior role, even where a formal DPO is not required.
- Engage external legal or DPO-as-a-service support if in-house expertise is insufficient to interpret evolving regulatory obligations.