Make your website GDPR compliant today — Cookiebot automates cookie consent, scanning, and compliance so you don't have to. Try Cookiebot Free

Penalties and Fines

Understanding the administrative fines and penalties that can be imposed for GDPR violations, including how they are calculated.

Administrative Fines under GDPR

Article 83 of the GDPR establishes a framework for imposing administrative fines for non-compliance. The GDPR provides for some of the highest fines in data protection regulation.

Maximum Fine Levels

The GDPR establishes two tiers of maximum fines:

Tier 1 - Up to €10 million or 2% of global annual turnover (whichever is higher):

  • Violations of controller and processor obligations (Articles 8, 11, 25-39, 42, 43)
  • Violations of certification body obligations (Article 42, 43)
  • Violations of monitoring body obligations (Article 41(4))

Tier 2 - Up to €20 million or 4% of global annual turnover (whichever is higher):

  • Violations of basic principles for processing (Article 5)
  • Violations of legal bases for processing (Article 6)
  • Violations of conditions for consent (Articles 7, 8, 9)
  • Violations of data subject rights (Articles 12-22)
  • Violations of international transfer rules (Articles 44-49)
  • Non-compliance with supervisory authority orders

Factors in Determining Fines

Article 83(2) requires supervisory authorities to consider multiple factors when deciding whether to impose fines and determining the amount:

  • Nature, gravity and duration of the infringement
  • Intentional or negligent character of the infringement
  • Actions taken to mitigate damage suffered by data subjects
  • Degree of responsibility, taking into account technical and organizational measures implemented
  • Any relevant previous infringements
  • Degree of cooperation with supervisory authority
  • Categories of personal data affected
  • How the infringement came to the authority's attention (particularly whether it was notified by the controller/processor)
  • Compliance with prior orders or approved measures
  • Adherence to approved codes of conduct or certification
  • Any other aggravating or mitigating factors, such as financial benefits gained or losses avoided

Additional Considerations

When imposing fines, supervisory authorities must ensure they are:

  • Effective: Achieves the desired deterrent effect
  • Proportionate: Appropriate to the specific case
  • Dissuasive: Discourages future violations

Other Penalties and Corrective Powers

Beyond fines, supervisory authorities can:

  • Issue warnings and reprimands
  • Order specific compliance actions
  • Impose temporary or permanent limitations on processing
  • Order suspension of data flows to third countries
  • Order erasure of personal data

Criminal Penalties

Article 84 allows Member States to lay down rules on other penalties, including criminal sanctions, for GDPR infringements not subject to administrative fines.

Notable GDPR Fines

Some of the largest GDPR fines imposed include:

  • €746 million - Amazon (2021) - Targeted advertising practices
  • €405 million - Instagram/Meta (2022) - Children's data protection
  • €225 million - WhatsApp/Meta (2021) - Transparency violations
  • €90 million - Google (2021) - Cookie consent violations

Avoiding Fines

Organizations can reduce the risk of fines by:

  • Implementing robust compliance programs
  • Conducting regular audits and assessments
  • Training staff on GDPR requirements
  • Demonstrating accountability through documentation
  • Responding promptly and cooperatively to supervisory authorities
  • Self-reporting violations when discovered
  • Taking swift remedial action when issues are identified

Related Articles