How GDPR Fines Are Calculated: The EDPB Method in Five Steps

The method comes from the EDPB's Guidelines 04/2022 on the calculation of administrative fines under the GDPR (version 2.1, adopted after public consultation in 2023). Authorities keep discretion within it, but it explains how the same facts should lead to comparable fines across the EU. Our free Breach Cost Calculator applies its main steps.

The legal maximums

Article 83 GDPR sets two tiers. The maximum is the fixed amount or the percentage of total worldwide annual turnover of the preceding financial year, whichever is higher:

Step 1: Identify the processing operations

The authority first establishes which conduct and which processing operations are at issue, and whether several infringements stem from the same or linked processing operations. Under Article 83(3), in that case the total fine cannot exceed the amount specified for the gravest infringement.

Step 2: Find the starting point

This is the heart of the method. The authority takes the legal maximum for the infringement and classifies its seriousness using the nature, gravity and duration of the infringement, whether it was intentional or negligent, and the categories of personal data affected (Article 83(2)(a), (b) and (g)). The level of seriousness sets a band:

The authority may then adjust the starting amount for the size of the undertaking, based on its annual turnover:

The adjustment is optional: authorities are under no obligation to apply it if it is not necessary for an effective, dissuasive and proportionate fine.

Step 3: Aggravating and mitigating circumstances

The amount is then increased or decreased for the remaining Article 83(2) factors, for example:

• action taken to mitigate the damage suffered by the people affected (83(2)(c));
• the degree of responsibility, given the technical and organisational measures in place (83(2)(d));
• relevant previous infringements (83(2)(e));
• cooperation with the authority (83(2)(f));
• how the authority learned of the infringement, for example whether the company notified it (83(2)(h));
• compliance with earlier orders, approved codes of conduct or certification (83(2)(i) and (j));
• any other factor, such as financial benefits gained (83(2)(k)).

Step 4: Apply the legal maximum

Whatever the result of the previous steps, the fine cannot exceed the legal maximum that applies to the infringement: the fixed amount or, for larger companies, the percentage of worldwide turnover.

Step 5: Effective, proportionate and dissuasive

Finally, the authority checks that the amount meets Article 83(1): it must be effective, proportionate and dissuasive. It can still adjust the fine at this stage, for example where a company shows that the fine would irretrievably jeopardise its economic viability. The EDPB treats such inability-to-pay claims strictly and requires objective evidence.

Worked example: a small company

An illustration of how the bands combine, not a prediction for any real case. A company with €8 million annual turnover suffers a breach because of weak security, an infringement of Article 32 that the authority rates as of medium seriousness.

1. Legal maximum (Article 83(4)): €10 million, because 2% of €8 million is less.
2. Medium seriousness: starting amount between €1 million and €2 million (10% to 20%).
3. Turnover adjustment for €2 to €10 million: 0.3% to 2% of the starting amount, so roughly €3,000 to €40,000.
4. Aggravating factors (for example, the breach was not notified) push it up; mitigating factors (fast containment, full cooperation) push it down.
5. The result is capped at €10 million and checked for proportionality.

The same infringement by a company with €800 million turnover would start from a legal maximum of €16 million (2% of turnover) with no turnover adjustment, so the starting amount alone would be €1.6 to €3.2 million.

Run your own numbers: the Breach Cost Calculator takes the infringement tier, the seriousness factors and your turnover, and shows the fine range with your own response costs added.

What actually reduces a fine

• Security measures that match the risk, documented before anything goes wrong (they speak to Article 83(2)(d)).
• Notifying a breach on time and cooperating with the authority.
• Containing the damage quickly and informing affected people where required.
• A clean record: previous infringements are an aggravating factor.

See our step-by-step guide to GDPR breach notification.

Prepared before a breach, not after. The GDPR Data Breach Response Toolkit includes a 72-hour notification checklist, an impact assessment matrix, a breach register and letter templates.

Sources

• EDPB Guidelines 04/2022 on the calculation of administrative fines under the GDPR, version 2.1
• Regulation (EU) 2016/679 (GDPR), Article 83, EUR-Lex

Related tools