GDPR fines are administrative penalties that data protection authorities impose for breaking the General Data Protection Regulation. Article 83 GDPR sets two tiers: up to €10 million or 2% of worldwide annual turnover for breaches of organisational duties, and up to €20 million or 4% for breaches of the core principles, legal bases and people's rights, whichever amount is higher. The actual amount is decided case by case, using the factors in Article 83(2) and a common EDPB method.
An everyday example
"Example Law Firm LLP" (a made-up example) lets associates paste client files into a free consumer AI tool. There is no data processing agreement and no assessment of the risks. A client complains after a draft containing her medical history turns up in an unrelated matter.
The authority investigates. It might find a breach of the security duty (Art. 32, lower tier), no processor contract (Art. 28, lower tier) and processing without a valid legal basis (Art. 6, higher tier). It then looks at the factors: how many clients were affected, whether health data was involved, whether the firm acted negligently, what it did once it noticed, and how it cooperated. The result might be a fine, but also a reprimand or an order to stop. A fine is one tool among several.
The details, simply
The two tiers (Art. 83(4) and 83(5))
Lower tier: up to €10 million or 2% of worldwide annual turnover, whichever is higher. It covers organisational duties, including:
- data protection by design and by default (Art. 25)
- processor contracts and duties (Art. 28)
- records of processing (Art. 30)
- security of processing (Art. 32)
- breach notification (Art. 33 and 34)
- data protection impact assessments (Art. 35 and 36)
Higher tier: up to €20 million or 4% of worldwide annual turnover, whichever is higher. It covers:
- the basic principles (Art. 5)
- legal bases, consent and special category data (Art. 6, 7 and 9)
- data subject rights (Art. 12 to 22), such as access and the right to be forgotten
- international transfers (Art. 44 to 49)
- ignoring an order from the authority
The percentage is calculated on the turnover of the whole undertaking, usually the corporate group, for the preceding financial year. For large companies, the 4% cap is what matters.
The factors (Art. 83(2))
Fines must be "effective, proportionate and dissuasive". Authorities weigh, among other things:
- The nature, gravity and duration of the breach, the number of people affected and the damage they suffered.
- Whether it was intentional or negligent.
- What was done to mitigate the damage.
- The degree of responsibility, considering the technical and organisational measures in place.
- Previous breaches.
- The degree of cooperation with the authority.
- The categories of personal data affected, for example health data.
- How the authority learned of the breach, including whether the organisation reported it.
- Compliance with earlier orders.
- Adherence to approved codes of conduct or certifications.
- Any other aggravating or mitigating factor, such as financial gain from the breach.
How the amount is calculated (EDPB Guidelines 04/2022)
To make fines more consistent across Europe, the European Data Protection Board adopted Guidelines 04/2022 on the calculation of administrative fines (final version 24 May 2023). They describe five steps:
- Identify the processing operations and the infringements, and how they relate.
- Set a starting point based on the tier, the seriousness of the breach and the company's turnover.
- Adjust for aggravating and mitigating circumstances.
- Apply the legal maximum, which the fine cannot exceed.
- Check that the final amount is effective, proportionate and dissuasive.
The EDPB is clear that this is not a formula: it always involves a human assessment of the case.
The UK
Under the UK GDPR, the ICO's higher maximum is £17.5 million or 4% of worldwide annual turnover, and the standard maximum is £8.7 million or 2%, whichever is higher in each case.
Some of the largest GDPR fines
All three below were imposed by Ireland's Data Protection Commission, which leads on many large tech companies with their EU base in Ireland:
- €1.2 billion, Meta Platforms Ireland (announced 22 May 2023): for transferring Facebook users' personal data from the EU to the US in breach of Art. 46(1).
- €530 million, TikTok (announced 2 May 2025): €485 million for transfers of EEA users' data to China and €45 million for transparency failures.
- €310 million, LinkedIn Ireland (announced 24 October 2024): over the processing of members' data for behavioural analysis and targeted advertising.
Meta and TikTok both said they would appeal. Most fines are far smaller and hit ordinary businesses, from medical practices to retailers, often for security failures or ignored access requests.
This is general information, not legal advice.
What GDPR fines do not reach
Every fine above was about identifiable people. That is the boundary of GDPR: Recital 26 excludes anonymous information. Data that has been anonymised falls outside the regulation, outside Article 83, and outside every factor listed above.
So the fine regime pushes in a particular direction. A company that wants to reuse sensitive data has a lawful route: remove the identifiers, call the result anonymised, and pool, license or sell it. No fine applies because no personal data is processed. The diagnosis, the contract clause or the deal terms remain; only the name is gone. We show that path step by step on the data trail, with sources on legal to sell.
The risk for the company is getting anonymisation wrong. In 2026, France's CNIL fined a health-data company €5 million in a case where the company argued its prescription data was anonymous and the CNIL found it was only pseudonymised. See pseudonymisation vs anonymisation.
What this means when you use AI tools
Most GDPR exposure with AI tools comes from basic gaps, not exotic ones. Check:
- A signed data processing agreement, reaching the model provider behind the tool.
- A legal basis for what staff put in, plus an Art. 9 exception for health data.
- A DPIA where the use is high risk.
- No training and no reuse licence in the provider's terms.
- Clear retention and location: what is kept, for how long, where.
Wysor is built to close these gaps. We act only as your processor under Art. 28 GDPR, on your instructions, and take no licence to reuse your content. We never train on it and never sell it, anonymised or not, and those commitments are in the contract, binding anyone who could ever own Wysor. Data is encrypted in transit and at rest and hosted in the EU, and every connected AI model provider runs with zero data retention. Your team works with GPT, Claude, Gemini and more in one workspace.
FAQ
What is the maximum GDPR fine? Up to €20 million or 4% of worldwide annual turnover, whichever is higher, for the most serious breaches. Lower-tier breaches carry up to €10 million or 2%.
What is the biggest GDPR fine so far? The €1.2 billion fine imposed on Meta Platforms Ireland by Ireland's Data Protection Commission, announced on 22 May 2023, over transfers of Facebook users' data to the US.
Who imposes GDPR fines? The national data protection authorities, such as the CNIL in France, the Data Protection Commission in Ireland or the ICO in the UK. For cross-border cases, the authority where the company has its main EU establishment usually leads.
Can small businesses be fined under GDPR? Yes. GDPR applies regardless of size, and authorities regularly fine small companies and practices. Size and turnover affect the amount, not whether a fine is possible.
Is it a GDPR fine if I fail to do a DPIA? It can be. Failing to carry out a required data protection impact assessment falls in the lower tier: up to €10 million or 2% of worldwide annual turnover.
Further reading
- What is GDPR? A simple explanation
- What is special category data? GDPR Article 9 explained
- Legitimate interest under GDPR: the three-part test explained
- The data trail
Questions about using AI without GDPR risk? Reach us at [email protected] or through the in-app contact form.
