Administrative fines under the GDPR can amount to up to EUR 20 million or 4 per cent of total worldwide annual turnover.
Amount and impact
Whichever is higher applies. Besides the amount, the signal effect matters: fine proceedings are public and damage the trust of customers and partners.
The GDPR has two tiers: infringements of organisational obligations, for example, can be punished with fines of up to EUR 10 million or 2 per cent of annual turnover, infringements of the principles, the legal bases or data subject rights with up to EUR 20 million or 4 per cent.
How the authority calculates fines
Fines must be effective, proportionate and dissuasive. Factors taken into account include the nature, gravity and duration of the infringement, intent or negligence, measures taken to mitigate the damage and cooperation with the authority.
According to the CJEU (judgment of 5 December 2023, C-807/21, Deutsche Wohnen), a fine can be imposed directly on the company without a specific member of management having to be identified. A culpable infringement is required.
Legal provisions
- Art. 83 GDPR
- Conditions, calculation and maximum amounts of administrative fines.
- Section 41 BDSG
- Application of the law on administrative offences.
- Section 43 BDSG
- Supplementary provisions on fines; no fines against public authorities.
Related terms.
General Data Protection Regulation (GDPR) The General Data Protection Regulation is the European regulation that governs the processing of personal data uniformly throughout the EU. Art. 2 GDPR Compensation under the GDPR Under Art. 82 GDPR, any person who has suffered material or non-material damage as a result of an infringement of the GDPR has the right to receive compensation. Art. 82 GDPR 