GDPR fines: how much can a violation cost?

The headline number people remember about the GDPR is a big one, and it is real, but it is only half the story. Article 83 sets two tiers of fine, and the cap is whichever is higher of a fixed euro figure and a percentage of worldwide turnover. For a small company the euro figure usually bites; for a large group the percentage does, and it is much larger. Here is how each tier works and what pushes a breach into the higher one.

The two tiers of GDPR fine

Article 83(4) sets the lower tier: up to 10 million euros, or in the case of an undertaking up to 2% of total worldwide annual turnover of the preceding financial year, whichever is higher. It covers the more operational duties, such as records of processing, security of processing, data-protection-by-design, and the obligations of processors. Article 83(5) sets the upper tier: up to 20 million euros, or up to 4% of total worldwide annual turnover, whichever is higher. It covers the serious failures, including the basic principles for processing, having a valid lawful basis, the conditions for consent, data-subject rights such as the right to data portability, and unlawful international transfers.

Why the percentage matters more than the euro figure

The phrase "whichever is higher" is the part businesses miss. For an undertaking, the fine is capped at the greater of the euro amount and the turnover percentage, and the percentage is calculated on the whole group's global turnover, not the revenue of one subsidiary or one product. So the 20 million euro figure is a floor for large companies, not a ceiling. A company with billions in turnover is exposed to a fine measured in the hundreds of millions, which is why the largest GDPR penalties have dwarfed the headline euro caps.

How regulators set the amount

Fines are imposed by national supervisory authorities, the data protection regulator in each member state, and Article 83(1) requires that each one be effective, proportionate and dissuasive. Article 83(2) lists the factors that move the number up or down: the nature, gravity and duration of the breach, how many people were affected, whether it was intentional or negligent, what you did to mitigate it, your history, and how well you cooperated. A fine can be imposed on its own or alongside a corrective order, such as a ban on a particular kind of processing, which is sometimes the more disruptive outcome.

What actually draws a fine

In practice the common triggers are processing with no valid lawful basis, weak security that leads to a breach, ignoring or mishandling data-subject requests, and unlawful transfers of data outside the EU. Most of these are avoidable with groundwork rather than heroics: a lawful basis recorded for each activity, a record of processing, reasonable security, and a breach plan. If you are not sure the regulation even reaches you, start with does the GDPR apply to your SaaS.

Next step

If the GDPR applies to you, the cheapest way to manage fine exposure is to close the gaps regulators actually penalise before they matter. The free 2-minute Obligation Scan flags where you are missing a lawful basis, records, or the rights processes that sit in the upper tier, so you can act on the duties rather than price a penalty later. The GDPR compliance hub sets out the full set.