GDPR Fines and Penalties: The Two Tiers and the Largest Fines to Date

Article 83 empowers supervisory authorities to impose administrative fines. There are two tiers, and the ceiling is the higher of a fixed euro amount or a percentage of undertaking worldwide annual turnover.

Related: GDPR hub · Principles · Breach notification.

Locked fine tiers (Art 83): up to €10 million or 2% of worldwide annual turnover or up to €20 million or 4% (higher tier), whichever is higher, depending on which provisions were infringed. Authorities also weigh Art 83(2) factors (nature, intent, mitigation, cooperation, prior offences, etc.).

Two Tiers

Tier

Ceiling

Typical provision themes

Lower

€10M or 2%

e.g. certain controller/processor obligations, certification bodies, some monitoring duties

Higher

€20M or 4%

e.g. basic principles, data subject rights, transfers, non-compliance with orders

Notable Enforcement Themes

Unlawful international transfers
Transparency and consent failures
Security of processing (Art 32) after preventable breaches
Ignoring data subject rights timelines

Exact fine amounts change with new decisions; treat press headlines as illustrations, not a tariff schedule.

How CyberSilo Helps

Continuous evidence reduces “unable to demonstrate” risk under Art 5(2)
Faster breach clocks via ThreatHawk detection workflows

Reduce Fine Exposure with Demonstrable Controls

Pair legal counsel with living RoPA, security evidence, and rights workflows before enforcement starts.

Talk to CyberSilo GDPR Automation

Frequently Asked Questions

What is the maximum GDPR fine?

Under Article 83, up to €20 million or 4% of worldwide annual turnover, whichever is higher, for the higher tier of infringements.

Is every violation fined at 4%?

No. A lower tier (up to €10M or 2%) applies to other provisions. Authorities also apply Article 83(2) criteria.

Can authorities ban processing?

Yes. Corrective powers under Article 58 include warnings, orders, and temporary or definitive bans on processing.

GDPR hub · Checklist · Certification · CSA

GDPR Fines and Penalties: The Two Tiers and the Largest Fines to Date

Two Tiers

Notable Enforcement Themes

How CyberSilo Helps

Reduce Fine Exposure with Demonstrable Controls

Frequently Asked Questions

What is the maximum GDPR fine?

Is every violation fined at 4%?

Can authorities ban processing?

Latest Articles

Fintech Compliance Automation: Multi-Jurisdiction Requirements (PCI, SOC 2, GDPR, MAS, SAMA)

How MSSPs Help Clients Achieve PCI DSS Compliance at Scale

The 5 Biggest Operational Mistakes MSSPs Make When Managing Multiple Client SOCs

What Is ISO 27001? A Practical 2026 Guide for Security and GRC Teams

What Is the NIST Cybersecurity Framework? CSF 2.0 Explained for 2026

How NIST Helps Cybersecurity Programs Mature in 2026

GDPR Fines and Penalties: The Two Tiers and the Largest Fines to Date

Two Tiers

Notable Enforcement Themes

How CyberSilo Helps

Reduce Fine Exposure with Demonstrable Controls

Frequently Asked Questions

What is the maximum GDPR fine?

Is every violation fined at 4%?

Can authorities ban processing?

Related GDPR Resources

Latest Articles

Fintech Compliance Automation: Multi-Jurisdiction Requirements (PCI, SOC 2, GDPR, MAS, SAMA)

How MSSPs Help Clients Achieve PCI DSS Compliance at Scale

The 5 Biggest Operational Mistakes MSSPs Make When Managing Multiple Client SOCs

What Is ISO 27001? A Practical 2026 Guide for Security and GRC Teams

What Is the NIST Cybersecurity Framework? CSF 2.0 Explained for 2026

How NIST Helps Cybersecurity Programs Mature in 2026