Administrative fines framework with 11 assessment criteria including nature/gravity/duration of infringement, intentional/negligent character, mitigation actions, prior infringements, cooperation with authorities, and adherence to codes of conduct. Two-tier system: up to €10M/2% for certain violations (Arts 8,11,25-39,42-43), up to €20M/4% for core violations (Arts 5-7,9,12-22,44-49) and non-compliance with authority orders.
Article 83
General conditions for imposing administrative fines
Understanding This Article
Article 83 gives GDPR its enforcement teeth through substantial administrative fines. The €20 million or 4% of global turnover ceiling (whichever is higher) makes GDPR fines among the most severe regulatory penalties worldwide. Major fines have been imposed: Amazon €746M, WhatsApp €225M, Google €90M, demonstrating authorities' willingness to use these powers. The 11 assessment criteria ensure fines are calibrated to violation severity, organizational responsibility, and mitigating factors, promoting proportionate and fair enforcement.
Key Points
- Two-tier fine system: up to €10M/2% or €20M/4% of global annual turnover
- 11 assessment criteria for determining fine amounts
- Must be effective, proportionate, and dissuasive
- Can be imposed with or instead of other corrective measures
- Special rules for public authorities (Member State discretion)
- Subject to judicial review and procedural safeguards