The European Union’s General Data Protection Regulation (GDPR) has been in force for nearly six years. Some industries—and some companies—have been more prone to fall foul of the rules than others.

A glimpse at websites like the GDPR Enforcement Tracker show Big Tech firms, which have been subject to numerous complaints and the largest fines, have not yet proven to be the worst serial offenders under the legislation. Meanwhile, telecommunications companies and banks, for example, appear to be routinely penalized for noncompliance.

Neil Hodge is a freelance business journalist and photographer based in Nottingham, United Kingdom. He writes on insurance and risk management, corporate governance, internal audit, compliance, and legal...