Since the European Union’s General Data Protection Regulation (GDPR) came into effect in May last year, EU organizations have reported almost 60,000 data breaches, but so far fewer than 100 fines have been issued by regulators.

According to a new report by multinational law firm DLA Piper, the European Commission’s official statistics show 41,502 data breach notifications between May 25, 2018, and January 28, 2019 (Data Protection Day). However, this only covered 21 of the 28 EU member states and didn’t include countries like Norway, Iceland and Lichtenstein, which are not EU members but are part of the European Economic Area (EEA) and are subject to the same regulation.