French data protection authority fined Discord for:

Failure to define and respect a data retention period appropriate to the purpose (Article 5.1.e of the GDPR)

Failure to comply with the obligation to provide information (Article 13 of the RGPD)

Failure to ensure data protection by default (Article 25.2 of the GDPR)

Failure to ensure the security of personal data (Article 32 of the GDPR)

Failure to carry out a data protection impact assessment (Article 35 of the GDPR)