GDPR Enforcement and Penalties

GDPR infringements

The EU GDPR prescribes a regime of “effective, proportionate and dissuasive” administrative fines of up to 4% of annual global turnover or €20 million – whichever is greater – for organisations that infringe its requirements.

However, not all GDPR infringements lead to data protection fines. Supervisory authorities such as the UK’s ICO (Information Commissioner’s Office) can take a range of other actions, including:

• Issuing warnings and reprimands;
• Imposing a temporary or permanent ban on data processing;
• Ordering the rectification, restriction or erasure of data; and
• Suspending data transfers to third countries.

To find out more about how to comply with the GDPR and avoid regulatory action, read our bestselling GDPR Implementation and Compliance Guide.

What is the maximum administrative fine under the GDPR?

There are two tiers of administrative fine that can be levied as penalties for GDPR non-compliance:

1. Up to €10 million, or 2% of annual global turnover – whichever is greater; or
2. Up to €20 million, or 4% of annual global turnover – whichever is greater.

Fines are discretionary rather than mandatory. They must be imposed on a case-by-case basis and should be “effective, proportionate and dissuasive”.

How are GDPR fines determined?

Fines of up to €10 million or 2% of annual global turnover can be issued for infringements of articles:

• 8 (conditions for children’s consent);
• 11 (processing that doesn’t require identification);
• 25–39 (general obligations of processors and controllers);
• 42 (certification); and
• 43 (certification bodies).

Fines of up to €20 million or 4% of annual global turnover can be issued for infringements of articles:

• 5 (data processing principles);
• 6 (lawfulness of processing);
• 7 (conditions for consent);
• 9 (processing of special categories of data);
• 12–22 (data subjects’ rights); and
• 44–49 (data transfers to third countries or international organisations).

GDPR fines to date

According to the European Data Protection Board, 281,088 cases were logged by supervisory authorities in the first year of the GDPR’s application.

Of these cases, 144,376 related to complaints and 89,271 related to data breach notifications by data controllers. 

Notable GDPR enforcement action:

We will keep this page updated with details of notable GDPR fines as and when they are issued.

How are GDPR fines applied?

When deciding whether to impose a fine and to what level, supervisory authorities must consider a range of factors:

• The nature, severity and duration of the GDPR infringement.
• Whether the infringement was caused intentionally or by negligence.
• Any action taken by the organisation to mitigate the damage suffered by individuals.
• Technical and organisational measures that have been implemented by the organisation.
• Any previous infringements by the organisation.
• The degree of cooperation with the regulator to remedy the infringement.
• The types of personal data involved.
• How the regulator found out about the infringement, and the extent of any notification by the controller or processor.
• Adherence to approved codes of conduct or certification schemes.