GDPR Breach Cost Calculator

Under the General Data Protection Regulation (GDPR), supervisory authorities can impose administrative fines of up to €20 million or 4% of global annual turnover — whichever is higher. This applies to the most serious infringements, including violations of data processing principles, conditions for consent, and data subject rights.

For other obligations — including security of processing (Article 32), breach notification (Articles 33 and 34), records of processing and DPIAs — fines can reach up to €10 million or 2% of global annual turnover. Most breach cases fall here, unless the authority also finds a breach of a principle such as integrity and confidentiality (Article 5(1)(f)).

However, the maximum fine is rarely imposed. Since 2023, supervisory authorities follow a common method set out in the EDPB Guidelines 04/2022: they classify the seriousness of the infringement (low, medium or high, giving a starting amount of 0–10%, 10–20% or 20–100% of the legal maximum), adjust it for the size of the undertaking, and then weigh the other factors in GDPR Article 83(2):

Factors That Increase Fines

Nature and severity: Breaches involving sensitive data (health records, financial information, children's data) attract significantly higher fines. The Irish DPC fined Meta €1.2 billion in 2023 for unlawful data transfers, one of the largest GDPR fines so far (Meta has appealed).

Scale of the breach: The number of data subjects affected directly influences fine calculations. A breach affecting millions of users will be treated far more severely than one affecting hundreds.

Duration and negligence: Prolonged breaches that went undetected, or breaches caused by negligent security practices, lead to higher penalties. DPAs look at whether the organization should have known about the vulnerability.

Repeat offenses: Organizations with a history of data protection violations face escalating penalties. GDPR explicitly lists previous infringements as an aggravating factor.

Failure to notify: GDPR Article 33 requires breach notification to the supervisory authority within 72 hours. Failure to meet this deadline — without justifiable reasons — is itself a fineable offense and an aggravating factor.

Factors That Reduce Fines

Encryption and security measures: If compromised data was properly encrypted with strong algorithms, the actual risk to individuals may be minimal. This can significantly reduce both the fine and the obligation to notify data subjects (Article 34(3)(a)).

Cooperation with authorities: Prompt notification, transparent communication, and full cooperation with the DPA investigation are mitigating factors.

Self-reporting and remediation: Organizations that detect breaches through their own monitoring, take immediate containment action, and proactively implement improvements demonstrate good faith.

Certifications: Adherence to approved codes of conduct or GDPR certification mechanisms (Articles 40 and 42) is a factor under Article 83(2)(j). An ISO 27001 certificate is not a GDPR certification, but it can help show the security measures you had in place, demonstrating that the organization took reasonable steps to protect data.

Regulatory fines are often just a fraction of the total cost. These costs depend heavily on your situation, so the calculator lets you add your own estimates for each:

Notification costs include the direct expense of informing affected individuals — letters, emails, dedicated call centers, and credit monitoring services. For large breaches, notification alone can cost millions.

Legal and forensic costs cover incident response, digital forensics investigation, legal counsel, and potential litigation. Complex breaches involving multiple jurisdictions drive these costs significantly higher.

Customer and revenue impact reflects the business consequences — customer churn, contract losses, and reputational damage. These costs depend heavily on your sector and customers, so the calculator uses your own estimates rather than an industry average.

Remediation costs include patching vulnerabilities, rebuilding systems, enhancing security controls, and implementing new monitoring — the investment needed to prevent recurrence.

To put the calculator's estimates in context, here are some notable GDPR enforcement actions:

The Irish DPC has issued the largest GDPR fines to date, primarily against major tech companies processing EU data — reflecting Ireland's role as lead supervisory authority for many Silicon Valley firms operating in Europe.

The French CNIL has been particularly active, fining organizations across sectors from tech giants to small businesses, demonstrating that enforcement is not limited to large corporations.

Italy's Garante and Spain's AEPD are among the most prolific DPAs in terms of enforcement volume, issuing hundreds of decisions annually across a wide range of industries.

Importantly, fine amounts vary significantly by jurisdiction. The same breach can lead to very different fines in different countries, depending on the authority's enforcement priorities and national procedural rules (GDPR itself applies directly in every member state). The EDPB method harmonises how fines are calculated, but each case is still decided on its own facts.

Encrypt personal data: Encryption is the single most effective measure. If breached data is rendered unintelligible through strong encryption, you may not even need to notify affected individuals, and the regulatory risk drops dramatically.

Prepare your incident response: Organizations with a tested incident response plan can detect and contain breaches faster. Faster detection means smaller breaches, lower costs, and easier compliance with the 72-hour notification deadline.

Invest in detection: Automated security monitoring, SIEM systems, and anomaly detection help identify breaches early — when containment is still possible and the blast radius is limited.

Map your data: You cannot protect what you do not know you have. Data mapping helps you understand what personal data you process, where it flows, and where the highest risks lie.

Train your people: Human error remains the leading cause of data breaches. Regular security awareness training — especially phishing simulations and data handling procedures — reduces your attack surface.