Corporate data protection malpractices are not uncommon, especially in contemporary technological environments. Embracing a regulatory view, this study attempts to advance a taxonomy of prevailing corporate data protection practices and their causal mechanisms by analyzing cases where organizations were fined for violating data protection legislations. Selecting the General Data Protection Regulation (GDPR) enacted by the European Union (EU) as our benchmark, this study employs an iterative taxonomy development technique as guidance and conducts thematic analysis on 875 cases of GDPR enforcements. In so doing, it develops a taxonomy of prevailing corporate data protection malpractices comprising 6 focal categories and 28 subcategories. Furthermore, this study unearths 4 main categories and 22 subcategories of causal mechanisms underlying the identified data protection malpractices. Empirical findings from this study not only reinforce corporate data protection malpractices established in prior research, but they also yield novel malpractices which have been neglected in previous work. From a pragmatic standpoint, this study yields invaluable insights into the prevention and resolution of corporate data protection malpractices for practitioners.