When data must be deleted, a copy often survives, or nobody can prove it is gone. This map shows what followed, country by country.
USD 0
The counter above is decided cases. This is a model of where the curve goes. It gives two figures a year in US dollars: exposure, what not deleting costs organisations, and spend, what they pay to delete and to prove deletion. Both are deletion-related; no published study yet measures spend on provable deletion on its own.
Do not add the two figures together. Spend partly offsets exposure.
Breach cost from data that should already have been deleted, e-discovery review of that data, and decided penalties. Storage and manual request handling are left out, so it is a floor.
USD bn a year, log scale. Circles mark dated steps.
Data destruction on retired devices and media, deletion-request software, personal data removal services, records disposition, data discovery and AI data lineage.
USD bn a year, log scale. Circles mark dated steps.
| Compound annual growth rate | 2026 to 2030 | 2030 to 2035 | 2026 to 2035 |
|---|---|---|---|
| Exposure | 54% | 39% | 45%* |
| Spend | 34% | 49% | 42% |
What the rate means. A compound annual growth rate is the steady yearly rise that would take the 2026 figure to the later one. At 45% a year, exposure is 29 times larger in 2035 than in 2026. Exposure grows fastest before 2030, because three dated steps land by then. Spend grows fastest after 2030, because buying lags enforcement by about two years. For scale, measured series today: breach cost per breach rises 12% a year, privacy software 23%, data created 24%, deletion requests about 45% to 60%, frontier AI training compute 400%.
The shape. A staircase on a curve that bends upward. The steps are dated rules that create a new kind of invoice. The curve underneath is AI: each new agent is another place data is copied to, and agents double what they can do about every seven months. Copies grow faster each year, so the underlying rate rises each year, from 12% in 2026 to 40% by 2032, where the model caps it. Spend follows exposure two years later, because buying lags enforcement. If a rule is delayed or rolled back, that year flattens and the curve resumes.
* Three questions readers ask. Is 45% a year believable? Without the acceleration the model gives USD 34bn in 2035; without the steps, USD 75bn. The half-trillion needs both, and both have dates. For a year you can check, 2028 gives USD 39bn exposure and USD 16bn spend on rules already passed. Does cost follow copies? Where breaches published a split, most of the exposed data should already have been gone: AT&T 90%, T-Mobile 84%. Every agent, cache and backup is one more copy. How big is each step? The dates are law; the size is judgement. A 1.3 step is smaller than 2026, when decided penalties on this map went from USD 70m to USD 3bn. The page sizes the category, not any company's share. The gap between the two lines is proof nobody has priced.
Modelled 31 October 2026. Intelligence, not legal or investment advice.
1,056 cases and laws from 240 countries and territories. Every entry links to its source.
Some entries are not tied to one country: EU-wide rules and guidance, and studies that cover many countries.
Each case shows a duty to delete that was missed, or that could not be proven. It does not necessarily show that any product would have prevented the breach or the fine. Fines are the total penalty; in most breach cases the deletion failure was one finding among several, and the entry says so where we can see it. "Why it matters" is our reading, not the regulator's. Where an order is cited, it shows a duty; it does not necessarily show the deletion was carried out, unless the entry says it was checked. Entries marked Secondary rest on news, law firm or commentary sources; check the original before quoting.
"Law, no case yet" means we found no published case, so the entry cites the law that creates the duty. "No general data protection law" is taken from the source cited for that place; sector, constitutional or contract duties may still apply.
Dots mark small states and territories. Overseas departments of France sit inside France. Places follow the Natural Earth 1:50m country set, so Gibraltar, Tokelau and the Sovereign Base Areas are not separate shapes.
The headline total adds the whole fine, settlement or damages award in each case that states an amount, counted once per decision. Where a decision sets a separate amount for each breach, only the amount for the deletion breach is counted. It is not a total of penalties for deletion failures alone. Each counted case carries one of three labels, and the total is split by them under the counter. Failed to delete: a regulator or court stated in its decision or order that data was kept when it should have gone, or that deletion could not be shown. Had to delete: the decision ordered deletion, or deletion was only a side point, and no earlier failure was found. Settled, not proven: the organisation paid to settle claims in which a failure to delete was alleged or deletion was a term of the settlement, and the official record states no finding of liability. Cases that cut the other way, such as fines for failing to keep required records, are shown on the map but left out of the total. Amounts are converted to US dollars at European Central Bank reference rates of 22 October 2026, or at the dollar figure the source gives where the bank publishes no rate. Ranges, caps, proposed or claimed amounts are left out, and where a source gives several amounts the first is counted. Amounts with neither are shown in local currency only and left out of the total. Research compiled 21 to 23 October 2026; entries added since then go through the same source check.
Send us the decision and a link to the source. We check every one against its source before it is added to the map and the counter.
Send us a fineThis map is our best research from public sources, mainly regulator and court decisions, laws, official guidance and published research. We check each entry against its source before it goes live. The map is not complete, sources can change, and errors are possible. Some decisions are under appeal or not yet final; the entry says so where we know it. Amounts are rounded and converted to US dollars as explained above. Where an entry cites a lawsuit, an investigation or a reported incident, it is not a finding that the law was broken. This map is for information only and is not legal advice. To report an error or a missing case, email info@together-alone.com.
This total is a floor. It counts only cases a regulator or court has already decided and published; breaches avoided because data was never kept cannot appear in any dataset. Within each case the amount is the whole penalty unless the decision splits it by breach, so not every dollar is for deletion.
Together Alone Ventures OÜ trading as Zombie Delete · Company number 17288376 · Tartu mnt 67/1-13b, Harju maakond · 10115, Tallinn, Estonia · © 2026 Together Alone Ventures OÜ