How GDPR fines are calculated

The legal ceilings

Article 83(4) sets a maximum of €10 million or, for an undertaking, 2% of total worldwide annual turnover of the preceding financial year, whichever is higher ¹. It covers duties such as Articles 25 to 39, which include security and breach notification ¹.

Article 83(5) sets €20 million or 4% of turnover ¹. It covers the basic principles, legal bases, the rights of data subjects and transfers outside the EU ¹. Article 83(6) applies the same higher ceiling to failure to comply with an order of the authority ¹.

Where one set of linked processing operations breaks several rules, the total cannot exceed the maximum for the gravest breach, under Article 83(3) ¹. Member States decide whether and how far public bodies can be fined, under Article 83(7) ¹.

The Article 83(2) factors

• Nature, gravity and duration, including the number of people affected and the damage suffered ¹.
• Whether the breach was intentional or negligent ¹.
• Action taken to mitigate the damage, and the degree of responsibility given security measures ¹.
• Relevant previous breaches and compliance with earlier orders ¹.
• Cooperation with the authority and the way the authority learned of the breach ¹.
• The categories of data affected, codes of conduct, and other factors such as financial benefits gained or losses avoided ¹.

The EDPB five-step method

• Identify the processing operations and check whether Article 83(3) applies ².
• Set the starting amount from the classification of the breach, its seriousness and the turnover of the undertaking ².
• Adjust for aggravating and mitigating factors ².
• Apply the legal maximum for each breach ².
• Check that the final amount is effective, proportionate and dissuasive, and adjust if needed ².

Starting points and company size

The EDPB sets three seriousness levels as a share of the applicable legal maximum ². It then lets authorities scale the starting amount down for smaller undertakings ². The guidelines say these figures are starting points for calculation, not fixed fine amounts ².

How decisions break fines down

Decisions often set a separate fine for each article. The Irish DPC's €251 million decision against Meta of 17 December 2024 set €8 million under Article 33(3), €3 million under Article 33(5), €130 million under Article 25(1) and €110 million under Article 25(2) ³.

The DPC's LinkedIn decision of 24 October 2024 set three fines totalling €310 million for lawfulness, transparency and fairness breaches ⁴.

Other authorities can shape the outcome. In the Meta transfers case, the DPC fined €1.2 billion on the basis of an EDPB binding decision adopted on 13 April 2023, after other authorities objected to its draft ⁵.

The UK ICO uses the same three seriousness bands, 0% to 10%, 10% to 20% and 20% to 100% of the legal maximum ⁶.