Every major GDPR fine issued by the 27 EU data protection authorities, the UK ICO, and EEA regulators since May 2018, sourced to the original published decision. Estimate your Article 83(4) or 83(5) exposure, or browse the register.
Tier 1 - Art. 83(4)
€10M
or 2% of global annual turnover (whichever is higher). Records, DPO, certification, DPIA breaches.
Tier 2 - Art. 83(5)
€20M
or 4% of global annual turnover (whichever is higher). Principles, consent, rights, transfers.
SECTION I / EXPOSURE ESTIMATE / FORM
Indicative estimate of the administrative fine a supervisory authority could impose under Regulation (EU) 2016/679 Article 83. Inputs reflect the ten criteria set out in Article 83(2). Estimates are not legal advice.
Group-wide global revenue, used for the percentage cap.
Article 83(2)(a): nature, gravity, number affected.
Article 83(5) upper tier (4% or €20M)
Longer infringements weigh against the controller.
F.Mitigating measures (Art. 83(2)(c), (f), (h))
PROCEDURAL NOTE / CALCULATION
Under Article 83(1) GDPR, an administrative fine must be effective, proportionate and dissuasive. Authorities first determine which statutory cap applies, then apply the ten Article 83(2) criteria to arrive at a specific amount within that cap. The criteria include both aggravating factors (intentional conduct, prior infringements, obstruction) and mitigating factors (prompt notification, full cooperation, remedial measures, an effective DPO).
i.
Identify the violated article
Determine which GDPR provision was breached. This sets the tier under 83(4) or 83(5).
ii.
Apply the statutory cap
Compare the percentage-of-turnover cap to the absolute Euro cap. The higher of the two is the ceiling.
iii.
Apply Article 83(2) criteria
Weigh the ten factors to arrive at a specific fine within the cap. Document every factor in the decision.
EXPLORE THE REGISTER
SECTION
Searchable list of every indexed fine. Filter by company, year, country, violation, and status.
Open section →
SECTION
Compare DPA enforcement across Ireland, Spain, France, Germany, Italy, the UK and others.
Open section →
SECTION
Consent, transfers, security, processing, transparency, DPO failures, breach notification.
Open section →
SECTION
Technology, finance, healthcare, telecom, retail, energy and the public sector compared.
Open section →
SECTION
Annual totals, trend lines, headline benchmarks, and the state of GDPR enforcement.
Open section →
SECTION
What does GDPR compliance cost, and how does that compare to the fine you would face?
Open section →
FREQUENTLY ASKED
REGISTER UPDATED 2026-04-28