GDPR Article 83 governs when and how supervisory authorities impose administrative fines. It gives two main maximum levels, directs authorities to assess the circumstances of each case, and requires fines to be effective, proportionate and dissuasive. It does not turn every GDPR violation into a fixed invoice. The official Article 83 text, reproduced in the CNIL’s official GDPR text, and the EDPB’s final Guidelines 04/2022 are the primary sources for a fine analysis.
A reliable estimate starts with the provision infringed, the undertaking and its relevant turnover, the seriousness of conduct and the authority’s legal and factual findings. A headline fine imposed on another company cannot be multiplied by the number of affected records to predict this case. Administrative proceedings and court review also depend on the jurisdiction. This article explains the common GDPR framework and the evidence a controller or processor should be ready to present. For a broad introduction, see the GDPR fines guide.
Read the two maximum levels correctly
Article 83(4) sets a maximum of €10 million or, for an undertaking, 2% of total worldwide annual turnover of the preceding financial year, whichever is higher, for the obligations listed in that paragraph. These include specified controller and processor obligations under Articles 8, 11, 25–39, 42 and 43, certification-body obligations under Articles 42 and 43, and monitoring-body obligations under Article 41(4). That is a statutory list, not a universal category called “procedural infringements.” A failure under Article 32 security or Article 33 breach notification falls in this group because the listed articles include those provisions.
Article 83(5) sets €20 million or 4%, whichever is higher, for basic principles including conditions for consent under Articles 5, 6, 7 and 9; data-subject rights under Articles 12–22; transfers under Articles 44–49; obligations under Member State law adopted pursuant to Chapter IX; and non-compliance with an authority order or access under Article 58(1) and (2), as specified in the text. Article 83(6) separately applies the same maximum to non-compliance with an order under Article 58(2). Check the actual paragraph and conduct instead of classifying a provision merely by its business impact. The principles guide, Article 6 lawful-basis guide and transfer guide show why very different failures can fall under the same ceiling.
The phrase “whichever is higher” matters. For an undertaking with worldwide annual turnover of €100 million, 2% is €2 million, so the Article 83(4) ceiling is €10 million. For turnover of €1 billion, 2% is €20 million, so the turnover amount is higher. Those are examples of a ceiling, not likely fines. The authority must still assess the case under Article 83(1) and (2) and any applicable national procedural rules. A controller can face other corrective measures even where no fine is imposed; Article 58 powers include orders and restrictions.
Identify the undertaking and relevant turnover
Article 83 refers to “an undertaking” for the percentage ceiling. The Court of Justice’s Deutsche Wohnen judgment, C-807/21, addresses the functional concept of an undertaking and the conditions for fining a legal person under the GDPR. The economic unit may be broader than a single legal entity; group turnover can matter when the entities form one undertaking under the applicable EU-law analysis. Do not assert that every subsidiary automatically takes its ultimate parent’s turnover regardless of economic reality or the authority’s findings.
The court also addressed fault: a fine under Article 83 requires an infringement committed intentionally or negligently; it does not require first attributing the infringement to a named natural person under a national rule. That distinction matters when a company argues that no individual employee was identified. It does not eliminate the need to establish an infringement and the relevant mental element. A defensible case record therefore identifies who made processing decisions, what the organisation knew or should have known, and how its controls operated at the time.
A turnover analysis should use the correct financial year, entities and economic relationship. Collect audited figures and an explanation of corporate control; do not insert a subsidiary’s local revenue into the formula without examining the undertaking issue. Conversely, do not assume a group-wide percentage is itself the fine. The EDPB guidance uses turnover in assessing the starting point and legal maximum, with the final amount tested for effectiveness, proportionality and deterrence.
Apply Article 83(2) to the facts
Article 83(2) lists eleven factors to give due regard to, depending on the individual case. They cover the nature, gravity and duration of the infringement, considering the nature, scope or purpose of processing, people affected and damage; whether it was intentional or negligent; action to mitigate damage; degree of responsibility considering technical and organisational measures; relevant previous infringements; cooperation with the authority to remedy and mitigate; categories of personal data; how the authority learned of the infringement, including whether and to what extent the controller or processor notified it; compliance with earlier Article 58(2) measures concerning the same subject; adherence to approved codes or certification; and other aggravating or mitigating circumstances, including financial benefit gained or losses avoided.
These are not eleven points to tick and average. The nature and duration of unlawful processing may dominate one case, while prompt remediation and a narrow affected population matter in another. A breach involving special-category data may be more serious, but its presence is not a fixed surcharge. Cooperation can be relevant, yet doing only what the law already requires will not always justify a discount. The authority must explain its assessment under the applicable procedure. A controller should supply accurate contemporaneous evidence, not invent a mitigation narrative after receiving a proposed fine. The accountability principle explains why that evidence should exist before an inquiry. A design decision documented under Article 25 can show what safeguards were considered at the time, though it does not automatically excuse a later failure.
For example, a supplier discovers that a privileged account could read clients’ personal data beyond its assignment. Relevant facts include how long the permission existed, whether it was used, number and nature of records, the supplier’s role, previous warnings, when it discovered the issue, how promptly it restricted access and what logs can establish exposure. The same incident may also raise duties under Article 33; the broader breach-notification guide helps separate the incident chronology from the fine analysis. A notification is relevant to Article 83(2)(h), but it does not automatically erase a security failure or prove the infringement. Avoid treating every factor as either permanently aggravating or permanently mitigating without evidence.
Understand the EDPB calculation method
The EDPB Guidelines 04/2022 set out a five-step method for authorities. First identify processing operations and the infringements to be assessed. Then find a starting point, considering the nature and seriousness of the infringement and turnover where relevant. Next assess aggravating and mitigating factors. Then determine the legal maximum. Finally check whether the fine is effective, proportionate and dissuasive. The guidance seeks consistent starting points, not identical outcomes or a calculator that predicts the authority’s result before facts are established.
Read the actual guidance before quoting a percentage range. Earlier versions of this page assigned unsupported “low, medium, high” bands and automatic 5–30% adjustments as if the Regulation supplied them. The EDPB’s method is more nuanced, and the authority may explain why a step is not applicable in a given case. A company can use the method to organise evidence and critique a proposed calculation, but it should not promise a fixed reduction for self-reporting, a DPIA or a certificate. The EDPB overview explains the Board’s role in guidance and dispute resolution.
Deal with several infringements in one operation
Article 83(3) says that if a controller or processor intentionally or negligently infringes several GDPR provisions in respect of the same or linked processing operations, the total amount of the administrative fine shall not exceed the amount specified for the gravest infringement. It limits the combined amount for that relationship. It does not say an authority must write exactly one fine line, may investigate only one provision, or can never adopt more than one decision associated with a wider incident. Identify whether operations are the same or linked before using the rule, and identify the highest applicable statutory maximum correctly.
Imagine one processing operation with a defective lawful basis and inadequate security. The authority could assess both Articles 6 and 32. If Article 83(3) applies, the total administrative fine for the same or linked processing cannot exceed the maximum for the gravest infringement. That is a ceiling, not an instruction to add €20 million and €10 million and then mechanically halve the result. Separate operations or controllers may raise different questions. The authority’s reasoning and the applicable procedural law matter.
The same event may produce an order to change processing, a fine and private claims for compensation. Article 83(3) addresses administrative-fine maxima for linked processing; it does not settle every other remedy. Teams evaluating exposure should avoid treating the ceiling as a full measure of consequences, but should also avoid adding hypothetical maximums as though all applied automatically.
Distinguish corrective action from a fine calculation
Supervisory authorities can use Article 58 corrective powers in addition to or instead of a fine, depending on the case. An order to answer rights requests, secure a system, restrict a processing activity or erase unlawfully retained data can have operational effects beyond a monetary amount. Article 83(1) requires each fine in an individual case to be effective, proportionate and dissuasive. A small infringement may still deserve a meaningful response; a large undertaking’s turnover does not by itself prove the gravity of every issue.
When an organisation receives an inquiry, preserve the relevant versions of notices, processing records, access settings, incident logs and management decisions. Identify what is fact, what is still under investigation and what has been corrected since the event. Respond through the authority’s specified process, with legal advice where necessary. GDPR Article 83 does not prescribe a universal thirty-day document response, thirty-to-sixty-day payment date or sixty-to-ninety-day appeal period. Those questions depend on the competent authority, national procedure and the actual decision. The supervisory-authority guide helps identify the decision-maker in a cross-border case.
Cross-border cases can involve cooperation among concerned authorities and, in some disputes, a binding EDPB decision under Article 65. That does not mean every inspection follows the same six-stage sequence. Check the governing decision and available court route before relying on a proposed settlement or appeal period. A published fine may be challenged or modified; a ranking of “largest GDPR fines” needs dated primary case status to be responsible. This guide therefore does not maintain a live top-ten list or treat a press headline as a final court outcome.
Build a usable internal response file
A case file should link each alleged infringement to the processing operation, period, affected people and records, decision-makers, applicable legal basis or obligation, technical measures, prior warnings, response steps and source documents. Preserve what existed at the time of the alleged conduct separately from what was fixed later. That distinction is essential: remediation is relevant, but it does not rewrite the history of a default setting or missing safeguard. If the authority asks for a precise chronology, provide one that matches logs and correspondence rather than a polished retrospective story.
Analyse Article 83(2) factors with evidence. For mitigation, identify the change, date, scope and proof it reduced harm. For cooperation, identify information actually supplied. For prior infringements, review final findings rather than rumours. For approved codes or certification, establish that the instrument applies to the processing and period. For turnover, show the source figures and undertaking analysis. A lawyer or DPO can challenge the authority’s conclusions, but the operational owners need to supply the underlying facts.
Infringements of the GDPR deserve attention because they can harm people and trigger orders, not because a fine database predicts a precise number. Earlier versions of this page confused the “higher of” formula, treated Article 83(3) as a one-fine rule, asserted unsupported fine rankings and appeal deadlines, and promised an unverified product fine catalogue. Use Article 83 in the official text, the EDPB’s final calculation guidance and the actual authority decision for a case-specific position.