GDPR – Fines / Penalties

The headline figures GDPR is known for — up to €20 million or 4% of global annual turnover — are maximums, not price tags. Article 83 sets those ceilings, but the actual number a supervisory authority lands on comes from a separate list of factors it has to weigh case by case. Two of the best-documented GDPR fines in history, British Airways and Marriott, show exactly how far that gap between the ceiling and the final figure can be: both provisional notices were cut by roughly 80–90% once the full Article 83(2) assessment was carried out.

Which Articles Actually Govern Fines

The Two Fine Tiers

Which tier applies turns on which obligation was breached, not on how serious the individual case felt or how large the company is. The lower tier (Art. 83(4)) applies to more administrative failures: the obligations of controllers and processors under Articles 8, 11, 25–39, 42 and 43 — records of processing, data protection impact assessments, DPO appointment, certification, and processor contracts among them. The higher tier (Art. 83(5)) applies to breaches that go to the core of the Regulation: the basic principles of processing including the conditions for consent (Art. 5, 6, 7, 9), data subjects’ rights (Art. 12–22), international transfer rules (Chapter V), and, notably, failure to comply with an order the supervisory authority has already issued.

That last point matters in practice: ignoring a corrective order escalates a case into the higher tier even if the original infringement would only have qualified for the lower one.

The Factors That Actually Set the Number

Article 83(2) lists the considerations a supervisory authority has to weigh, including:

• The nature, gravity and duration of the infringement, and the number of people affected
• Whether the infringement was intentional or negligent
• Any action taken to mitigate the damage suffered by data subjects
• The degree of technical and organisational measures already in place under Articles 25 and 32
• Any relevant previous infringements by the controller or processor
• The degree of cooperation with the supervisory authority to remedy the infringement
• The categories of personal data affected
• How the authority became aware of the infringement, in particular whether it was self-reported
• Compliance with any previously ordered measures against the same controller
• Adherence to approved codes of conduct or certification mechanisms
• Any other aggravating or mitigating factor, including financial benefits gained or losses avoided through the infringement

The British Airways decision below shows this arithmetic explicitly: the ICO’s own published reasoning moved from a £30 million starting point, to a 20% reduction for mitigating factors, to a further £4 million reduction for the economic impact of COVID-19 on the airline industry, arriving at £20 million from a figure that started nowhere near the statutory maximum.

Why Fines Are Calculated on Group Turnover

The percentage-of-turnover option in Article 83(4)–(6) refers to the “total worldwide annual turnover” of the “undertaking” — a concept borrowed from EU competition law, meaning the entire economic unit a company belongs to, not just the specific legal entity that was investigated. This is why a fine against a subsidiary’s processing activity can be calculated against a parent group’s global revenue, and it’s the single biggest reason GDPR fines can reach hundreds of millions or billions of euros even where the specific infringing entity is comparatively small on its own.

Fines Aren’t the Only Corrective Power

Article 58(2) gives supervisory authorities a wider toolkit than fines alone: reprimands, orders to bring processing into compliance within a set period, orders to communicate a breach to affected individuals, temporary or permanent processing bans, and withdrawal of a certification. A fine under Article 83 can be imposed alongside any of these — it doesn’t replace them, and a case can end in a compliance order with no fine at all where the circumstances don’t warrant one, per Recital 148.

Real Cases: From Provisional Notice to Final Fine

Both cases below started with a public notice of intent far above the eventual fine, then went through the Article 83(2) assessment in full public view, making them the clearest illustration available of how the factors actually move the number.

See all fines & penalties enforcement cases →

Recitals That Explain This Issue

Checklist: Reducing Fine Exposure

• Document technical and organisational measures under Articles 25 and 32 before an incident, not after — Article 83(2)(d) weighs what was already in place
• Build an incident response process that supports fast, complete self-reporting — how an authority learned of an infringement is an explicit factor
• Keep a genuine record of cooperation during any investigation, since cooperation is weighed as a mitigating factor in its own right
• Act immediately on any corrective order from a supervisory authority — non-compliance with an order can escalate a case into the higher fine tier
• Track and be able to demonstrate mitigating steps taken for affected individuals as soon as an issue is identified
• Understand that fines are calculated against your wider corporate group’s global turnover, not just the entity under investigation, when estimating exposure
• Remember a fine can be combined with a compliance order or processing ban — fixing the fine risk doesn’t end the interaction with the authority